Privacy Law Library

Protection of Personal Information Act

Utah PPIA

Breach notification · Data security

Utah's data security, disposal, and breach notification law. It covers name plus SSN, financial account or card number with access code, or driver license or state ID number. It requires reasonable safeguards, secure disposal, and notice to affected Utah residents, and at scale to the Attorney General, the Utah Cyber Center, and consumer reporting agencies.

Where
Utah
Citation
Utah Code Title 13, Chapter 44 (13-44-101 to 13-44-301)
Status
In force
Last amended
2025-05-07
Enforced by
Utah Attorney General
People can sue
No
Penalties
Civil penalty up to $2,500 per consumer and up to $100,000 aggregate for related violations (higher caps if 10,000+ Utah and 10,000+ other-state residents are affected, or by settlement); injunctions and fees available; no cure period (13-44-301).
Applies to
  • Any person who conducts business in Utah and maintains personal information (13-44-201)
  • Any person who owns or licenses computerized data including personal information about a Utah resident (13-44-202)
  • Excludes financial institutions and their affiliates as defined in 15 U.S.C. 6809 (13-44-103)

Security duties

  • Implement and maintain reasonable procedures to prevent unlawful use or disclosure of personal information.Utah Code 13-44-201(1)(a)
  • Destroy records containing personal information that will not be retained by shredding, erasing, or otherwise making the information indecipherable.Utah Code 13-44-201(1)(b), (2)

Breach duties

  • On a breach, conduct a prompt good-faith investigation and notify affected Utah residents if misuse for identity theft or fraud has occurred or is reasonably likely, in the most expedient time possible without unreasonable delay (law-enforcement delay allowed).Utah Code 13-44-202(1)-(2), (4)
  • If 500 or more Utah residents are affected, also notify the Office of the Attorney General and the Utah Cyber Center with breach and discovery dates, numbers affected, data types, and a short description.Utah Code 13-44-202(1), (6)(b) · Only if: 500+ Utah residents affected
  • If 1,000 or more Utah residents are affected, also notify nationwide consumer reporting agencies.Utah Code 13-44-202(1) · Only if: 1,000+ Utah residents affected
  • A person maintaining data on behalf of an owner or licensee must notify the owner or licensee of a breach; waivers of these duties are void.Utah Code 13-44-202(3), (7)

Sources

Checked against these sources on 2026-09-23 by research agent (Claude), primary sources.

Unverified: Original enactment year and effective date of chapter 13-44 were not recorded in the memo.

Research reference, not legal advice.