Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Utah |
|---|---|
| Statute citation | Utah Code Ann. §§ 13-44-201 to 13-44-202 (Protection of Personal Information Act) (amended |
| Individual notice timing | notify affected individuals in the most expedient time possible without unreasonable delay, after |
| Attorney general notice | Yes Utah requires notification to both the Office of the Attorney General and the Utah Cyber Center when |
| Biometric data | No |
| Medical information | No |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Utah 'breach of system security' means an unauthorized acquisition of computerized data maintained by a person that compromises the security, confidentiality, or integrity of personal information; however, acquisition of personal information by an employee or agent of the person possessing unencrypted computerized data is not a breach unless the personal information is used for an unlawful purpose or disclosed in an unauthorized manner.1 |