Privacy Law Library

Student Data Protection Act (third-party contractor provisions)

Utah SDPA

Students

Governs ed-tech and other contractors that handle Utah student data: use limited to the contracted service, mandatory contract terms, return or deletion at contract end, and no sale or targeted advertising. 2026 H.B. 55 and S.B. 296 amendments took effect July 1, 2026.

Where
Utah
Citation
Utah Code Title 53E, Chapter 9, Part 3 (53E-9-301 to 53E-9-311)
Status
In force
Last amended
2026-07-01
Enforced by
Utah State Board of Education
People can sue
Yes
Penalties
State Board civil penalty up to $25,000, bar on future contracts, and payment of notification costs; class A misdemeanor for individuals; private actions by parents or adult students for knowing or reckless 53E-9-309 violations (53E-9-310) and by students under 53E-9-311(11).
Applies to
  • Third-party contractors that collect or receive student data under a contract with an education entity, other than photography, yearbook, and similar services (53E-9-301(20)); not general audience applications (53E-9-309(7))
  • Any third party receiving educational data of more than 10 students under 53E-9-311 (53E-9-311(10))

Practices it requires

  • Use personally identifiable student data only for the contracted service and permitted uses.Utah Code 53E-9-309(1), (4)
  • Accept mandatory contract terms; after a privacy violation, the education entity may terminate and the contractor may not charge termination fees.Utah Code 53E-9-309(2) · From 2026-07-01
  • Return or delete student data at the end of the contract.Utah Code 53E-9-309(5)
  • Do not sell student data, use it inconsistently with the contract, or use it for targeted advertising.Utah Code 53E-9-309(6)
  • Third parties receiving educational data must use it only as the student's informed consent allows and must not redisclose it.Utah Code 53E-9-311(9) · Only if: Third party receiving educational data of more than 10 students · From 2026-07-01

Sources

Checked against these sources on 2026-09-23 by research agent (Claude), primary sources.

Unverified: Original enactment date of 53E-9 Part 3 was not recorded in the memo.

Research reference, not legal advice.