63A-19-401. Duties of governmental entities.
(1) Except as provided in Subsectionsand, a governmental entity shall comply with the requirements of this part. (1)(b) (c) If a more specific or more restrictive law governs the treatment of a type of personal data, the more specific or more restrictive law shall control. A governmental entity that is exempt under Section,, orfrom complying with the requirements in Title 63G, Chapter 2, Part 6, Collection of Information and Accuracy of Records, is exempt from complying with the requirements in this chapter. 63G-2-702 63G-2-703 63G-2-704
(2) A governmental entity shall: initiate a data privacy program before December 31, 2025; obtain and process only the minimum amount of personal data reasonably necessary to efficiently achieve a specified purpose; meet the requirements of this part for all new processing activities implemented by a governmental entity; and for any processing activity implemented before May 7, 2025, as soon as is reasonably practicable, but no later than July 1, 2027: identify any non-compliant processing activity; prepare a strategy for bringing the non-compliant processing activity into compliance with this part; and include the information described in Subsectionsandin the privacy program report described in Section. (2)(a)(iv)(A) (B) 63A-19-401.3 A governmental entity that fulfills the reporting requirement under Sectionsatisfies the requirement to initiate a privacy program under Subsection. 63A-19-401.3 (2)(a)(i)
(3) A governmental entity may not: establish, maintain, or use undisclosed or covert surveillance of individuals unless permitted by law; sell personal data unless expressly required by law; and share personal data unless permitted by law.