All Roll Calls
Yes: 206 • No: 4
UtahH.B. 4502026 General SessionHouse
Data Privacy Amendments
Sponsored By: David Shallenberger (Republican)
Signed by Governor
Electronic PrivacyTechnologyElectronic InformationGovernment RecordsPublic Utilities and TechnologyEthicsGovernment Operations (State Issues)Data and Cyber Security
Personalized for You
How does this bill affect your finances?
Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Bill Overview
Analyzed Economic Effects
15 provisions identified: 9 benefits, 2 costs, 4 mixed.
Government workers can report privacy problems anonymously
Government employees can send confidential, anonymous data privacy complaints directly to the Utah attorney general. Employees who do so receive protections under the Utah Protection of Public Employees Act.
At-risk government workers get privacy protections
More current and former state, federal, and local government workers can apply to make certain personal records private. Their regular work or recent credible threats must create an immediate, substantial risk of physical harm from disclosure. Records do not become private automatically. Applications last up to four years, or one year after death, and may be rescinded.
Election reports hide personal contact details
The lieutenant governor must remove individuals' phone numbers and street numbers and names before releasing covered election-finance reports. This also applies to required Judicial Retention Elections reports. Public release of those details is unlawful. A government officer or employee who knowingly releases them commits a class B misdemeanor.
Faster notice of government data breaches
Government breaches involving data used or likely used for theft, fraud, or other crimes require notice within five days of discovery. Officials must notify affected people and the attorney general, then add missing details as they become available. Breaches affecting 500 or more people also require notice to the Utah Cyber Center and attorney general. Government entities and contractors give individual notices after assessing the breach and restoring system safety when needed; law enforcement can delay notice. Public-record data can receive a prominent homepage notice instead, and another outreach method is required when more than 500 people lack available contact details.
More ways to resolve government privacy complaints
Individuals or legal guardians can request corrections to personal data they supplied and, when legally allowed, identifiable information in government records. Government entities must provide a request process but do not have to grant every correction. Privacy complaints must first go to the entity's chief administrative officer, who must try to resolve them. Unresolved complaints can go to a new privacy ombudsperson, a governor-appointed Utah attorney, for requested mediation. The ombudsperson can provide education and publish resolved-complaint summaries, but cannot handle records-office matters, expand the complaint, testify about mediated matters, or audit agencies.
Government contractors must follow privacy rules
Contracts entered into or renewed after July 1, 2027, must explicitly require contractors to follow Utah's government privacy chapter. This applies to personal data contractors process or access under the contract, to the same extent as the government entity. Contractors are exempt from the chapter's privacy training requirements.
Government gets privacy training and support
Employees who access personal data, and their supervisors, must take privacy training within 30 days of starting work and annually. Training covers privacy duties, records management, security, and applicable privacy and public-records laws. Entities can use state training or their own training that meets the requirements. The privacy office must offer training materials and can provide guidance, assessment tools, optional cooperative contracts, research support, and data governance models. The technology division must consult the chief privacy officer on covered digital credentials and records work, replacing two previously listed privacy officials.
Government privacy audits get public follow-up
Beginning May 6, 2026, the State Auditor publishes government privacy practices, offers guidance and training, and handles individual audit requests. Each year, the auditor prioritizes the highest-risk practices for audits and recommends needed reforms. Reports go quarterly to the Utah Privacy Commission and by October 1 annually to the Judiciary Interim Committee. Covered regulating bodies must hold a public hearing within 90 days of a reform recommendation, with class A notice at least 30 days beforehand. The public can ask questions before the body decides on reforms; exemptions cover state agencies, legislative and judicial branches, independent entities, and specified executive bodies.
Sensitive government data gets clearer safeguards
Government use of living people's genetic data or precise location data can qualify as high-risk processing. The assessment weighs privacy effects, data sensitivity and amount, ability to consent, and risks of unauthorized access or use. Profiling includes automated assessments or predictions about a person's finances, health, preferences, reliability, behavior, location, or movements. When another law sets more specific or stricter rules for a type of personal data, that law controls.
Fewer notices when government collects information
Utah government entities no longer have several notice duties when asking for information that could be private or controlled. The removed notices covered why information was collected, intended uses, sharing recipients, and consequences of refusing. The law also removes duties to post those notices where information is collected and explain specified details upon request.
Government privacy deadlines can be extended
The Utah privacy office can grant extensions or exemptions when government entities apply. It can also grant a group of entities a one-time extension on its own initiative. A group extension must name the covered entities and the specific legal duty. It cannot last longer than 12 months.
Unregistered local governments risk funding restrictions
Covered local entities must renew registration annually, updating incorrect information or confirming it remains correct; registration lasts one year from notice. Dissolved entities need not renew, and deadlines can be extended for circumstances outside an entity's control reported before the deadline. After notice of non-registration, the State Auditor can withhold state funds or property-tax payments and block access to money. The auditor must remove the access block after receiving the lieutenant governor's notice of registration. The auditor must allow payments needed to avoid major operational disruption or meet debt obligations, and can approve other appropriate payments.
Government data reviews face firm deadlines
Government entities must identify noncompliant data activities started before May 7, 2025, and plan how to fix them. They must include this work in privacy program reports as soon as practical, no later than July 1, 2027. The law removes the separate duty to document each noncompliant activity. Beginning July 1, 2027, state agencies cannot collect, keep, or use personal data in a record series without a complete, accurate privacy annotation. That annotation must list data types, purposes, legal authority, and any additional details required by office rules.
Government data sales exclude record fees
A government transfer of personal data to a third party for money counts as a sale under the privacy rules. Government entities cannot sell personal data unless lawfully required. Record-access fees and fees under an approved fee schedule do not count as sales. Payments between government entities for covered public-record access do not count as purchases of personal data.
Government records get privacy and access limits
Records designated by the law follow Utah's rules for records that are not public. Those rules govern private, controlled, or protected classifications and limits on disclosure. Government entities can use information in private or controlled records only for purposes in their filed statement. They can also use it for purposes legally allowed for another government entity receiving the record.
Sponsors & Cosponsors
Sponsor
David Shallenberger
Republican • House
Cosponsors
Kirk A. Cullimore
Republican • Senate
Roll Call Votes
House vote • 3/5/2026
House/ uncircled
Yes: 0 • No: 0
House vote • 3/5/2026
House/ circled
Yes: 0 • No: 0
House vote • 3/5/2026
House/ concurs with Senate amendment
Yes: 66 • No: 1
Senate vote • 3/4/2026
Senate/ passed 2nd & 3rd readings/ suspension
Yes: 28 • No: 0
Senate vote • 3/4/2026
Senate/ uncircled
Yes: 0 • No: 0
Senate vote • 3/4/2026
Senate/ circled
Yes: 0 • No: 0
Senate vote • 3/4/2026
Senate/ substituted
Yes: 0 • No: 0
Senate vote • 3/4/2026
Senate Comm - Favorable Recommendation
Yes: 6 • No: 0
House vote • 3/2/2026
House/ uncircled
Yes: 0 • No: 0
House vote • 3/2/2026
House/ substituted
Yes: 0 • No: 0
House vote • 3/2/2026
House/ passed 3rd reading
Yes: 72 • No: 0
House vote • 2/27/2026
House/ circled
Yes: 0 • No: 0
House vote • 2/24/2026
House Comm - Favorable Recommendation
Yes: 7 • No: 1
House vote • 2/24/2026
House Comm - Substitute Recommendation
Yes: 8 • No: 0
House vote • 2/18/2026
House Comm - Held
Yes: 10 • No: 2
House vote • 2/18/2026
House Comm - Substitute Recommendation
Yes: 9 • No: 0
Actions Timeline
Governor Signed
3/19/2026House/ to Governor
3/16/2026HouseHouse/ received enrolled bill from Printing
3/16/2026HouseHouse/ enrolled bill to Printing
3/12/2026HouseEnrolled Bill Returned to House or Senate
3/12/2026Draft of Enrolled Bill Prepared
3/6/2026Bill Received from House for Enrolling
3/6/2026House/ signed by Speaker/ sent for enrolling
3/5/2026HouseHouse/ received from Senate
3/5/2026HouseSenate/ to House
3/5/2026SenateSenate/ signed by President/ returned to House
3/5/2026SenateSenate/ received from House
3/5/2026SenateHouse/ to Senate
3/5/2026HouseHouse/ concurs with Senate amendment
3/5/2026HouseHouse/ uncircled
3/5/2026HouseHouse/ circled
3/5/2026HouseHouse/ placed on Concurrence Calendar
3/5/2026HouseHouse/ received from Senate
3/5/2026HouseSenate/ to House with amendments
3/4/2026SenateSenate/ passed 2nd & 3rd readings/ suspension
3/4/2026SenateSenate/ substituted
3/4/2026SenateSenate/ uncircled
3/4/2026SenateSenate/ circled
3/4/2026SenateSenate/ 2nd & 3rd readings/ suspension
3/4/2026SenateSenate/ Rules to 2nd Reading Calendar
3/4/2026Senate
Bill Text
Enrolled
3/12/2026
Substitute #6
3/4/2026
Substitute #5
3/2/2026
Substitute #4
2/27/2026
Substitute #3
2/25/2026
Substitute #2
2/24/2026
Substitute #1
2/17/2026
Introduced
2/2/2026