← All US breach laws·UT

Utah data breach notification law

Utah's data breach notification requirements under Utah Code §§13-44-101 to 13-44-301 (Protection of Personal Information Act). Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Utah Code §§13-44-101 to 13-44-301
Enforcer
Utah Attorney General + Utah Division of Consumer Protection
AG notification
Required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
In the most expedient time possible and without unreasonable delay
Notify the state regulator
Yes — if more than 500 Utah residents are affected, written notice to the AG and Cyber Center
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required when the breach involves PI and there is a likelihood of identity theft or other fraud
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Utah law

First name/initial + last name with SSN, DL/state ID, financial account + access code

Penalties and enforcement

Up to $2,500 per violation, capped at $100,000 per breach
Enforced by: Utah Attorney General + Utah Division of Consumer Protection. Official regulator page →

Common pitfalls

⚠ Utah requires notice to both AG and Cyber Center for 500+ resident breaches — duplicate filing is required

Frequently asked questions

How long do I have to notify Utah residents after a data breach?
In the most expedient time possible and without unreasonable delay
Do I have to notify the Utah Attorney General?
Yes — if more than 500 Utah residents are affected, written notice to the AG and Cyber Center
Does Utah require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Utah's breach notification requirement?
Yes — Utah has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Utah residents sue me directly for a data breach?
No — Utah's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Utah law?
First name/initial + last name with SSN, DL/state ID, financial account + access code
What are the penalties for failing to comply with Utah's breach notification law?
Up to $2,500 per violation, capped at $100,000 per breach

Related state breach laws

Tennessee (TN)
Tenn. Code §47-18-2107
Texas (TX)
Tex. Bus. & Com. Code §521.053
Vermont (VT)
9 V.S.A. §§2430
Virginia (VA)
Va. Code §18.2-186.6

Pre-empt the Utah breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Utah's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit