Utah data breach notification law

Who must notify and when

notify affected individuals in the most expedient time possible without unreasonable delay, after

Attorney general notice

Yes Utah requires notification to both the Office of the Attorney General and the Utah Cyber Center when

What counts as a breach

In Utah 'breach of system security' means an unauthorized acquisition of computerized data maintained by a person that compromises the security, confidentiality, or integrity of personal information; however, acquisition of personal information by an employee or agent of the person possessing unencrypted computerized data is not a breach unless the personal information is used for an unlawful purpose or disclosed in an unauthorized manner.1

What counts as personal information

In Utah 'personal information' means a person's first name or first initial and last name, combined with any one or more of the following data elements relating to that person when either the name or data element is unencrypted or not protected by another method that renders the data unreadable or unusable: (i) Social Security number; (ii)(A) financial account number, or credit or debit card number; and (ii)(B) any required security code, access code, or password that would permit access to the

Coverage and remedies

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Utah

68 reports to HHS OCR affecting 7,085,448 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Utah.

Frequently asked questions