Title 63A, Title 63A: Utah Government Operations Code

63A-19-203. Utah Privacy Commission created. (1) There is created the Utah Privacy Commission. (2) The commission shall be composed of no more than 14 members. The governor shall appoint: one member who, at the time of appointment provides internet technology services for a count…

63A-19-204. Commission duties. (1) The commission shall: annually develop, approve, and make public by May 1 of each year a data privacy agenda that identifies for the upcoming year: governmental entity privacy practices to be reviewed by the commission; educational and training …

63A-19-301. Utah Office of Data Privacy. (1) There is created within the department the Utah Office of Data Privacy. (2) The office shall coordinate with the governing board and the commission to perform the duties in this section. (3) The office shall: create and maintain a data…

63A-19-302. Chief privacy officer -- Appointment -- Powers -- Reporting. (1) The governor shall, with the advice and consent of the Senate, appoint a chief privacy officer. (2) The chief privacy officer is the director of the office. (3) The chief privacy officer: shall exercise …

63A-19-401. Duties of governmental entities. (1) Except as provided in Subsectionsand, a governmental entity shall comply with the requirements of this part. (1)(b) (c) If a more specific or more restrictive law governs the treatment of a type of personal data, the more specific …

63A-19-401.1. Privacy annotations. (1) Beginning July 1, 2027, a state agency shall make a complete and accurate privacy annotation for each record series containing personal data that the state agency collects, maintains, or uses. After July 1, 2027, a state agency that has not …

63A-19-401.2. Training requirements. (1) An employee of a governmental entity shall complete data privacy training that includes instruction on: data privacy best practices, obligations, and responsibilities; the relationship between privacy, records management, and security; the…

63A-19-401.3. Privacy program report. (1) On or before December 31 of each year, the chief administrative officer of each governmental entity shall prepare a report that includes: how the governmental entity has initiated the governmental entity's privacy program; a description o…

63A-19-401.4. Requirements for contractors. (1) Except as provided in Subsection, a contractor that processes or has access to personal data as a part of the contractor's duties under a contract with a governmental entity is subject to the requirements of this chapter to the same…

63A-19-402. Personal data collection -- Privacy notice. (1) A governmental entity shall provide a privacy notice to an individual, or the legal guardian of an individual, from whom the governmental entity requests or collects personal data. (2) If the personal data collected by a…

63A-19-402.5. Website privacy notice. (1) A governmental entity's government website shall include notice to a user of: the identity of the governmental entity responsible for the government website; how to contact the governmental entity that is responsible for the government we…

63A-19-403. Procedure to request amendment or correction of personal data. (1) A governmental entity that collects personal data shall provide a procedure by which an individual or legal guardian of an individual may request an amendment or correction of: personal data that has b…

63A-19-404. Retention and disposition of personal data. (1) A governmental entity that collects personal data shall retain and dispose of the personal data in accordance with a documented record retention schedule. (2) Compliance with Subsection (1) does not exempt a governmental…

63A-19-405. Data breach notification to the Cyber Center and the Office of the Attorney General. (1) A governmental entity that identifies a data breach affecting 500 or more individuals shall notify the Cyber Center and the attorney general of the data breach. In addition to the…

63A-19-406. Data breach notice to individuals affected by data breach. (1) Except as provided in Subsectiona governmental entity shall provide cause a data breach notice to be sent to an individual or legal guardian of an individual affected by the data breach: (1)(b), after dete…

63A-19-407. Technology transparency study -- Report to Legislature. (1) The office and the commission shall jointly study the implementation of processing activities for which an individual's personal data may be collected without the ability to provide direct notice: the public …

63A-19-408. Private information concerning certain government employees. (1) As used in this section: "At-risk government employee" means a current or former: peace officer as specified in Section; 53-13-102 state or federal judge of an appellate, district, justice, or juvenile c…

63A-19-501. Data privacy ombudsperson. (1) There is created within the office the position of data privacy ombudsperson. (2) The governor shall appoint the ombudsperson with the advice of the governing board. (3) The ombudsperson shall: be an attorney in good standing and authori…

63A-19-502. Data privacy complaint process. (1) An individual who makes a data privacy complaint shall first submit the complaint to the chief administrative officer of the governmental entity that is the subject of the complaint. (2) Upon receipt of a data privacy complaint unde…

63A-19-601. Enforcement. (1) Upon instruction by the board, the state auditor shall: investigate alleged violations of this chapter by a governmental entity; provide notice to the relevant governmental entity of an alleged violation of this chapter; and for a violation that the s…

63A-19-602. Disciplinary action. A governmental entity may take disciplinary action, which may include suspension or discharge, against any employee of the governmental entity who intentionally violates any provision of this chapter.