Utah Amends Data Breach Notification Law | Practical Law

Utah Amends Data Breach Notification Law | Practical Law

Utah has amended its data breach notification law to specify the contents of data breach notices to the state and revise confidentiality provisions.

Utah Amends Data Breach Notification Law

Practical Law Legal Update w-042-7308 (Approx. 3 pages)

Utah Amends Data Breach Notification Law

by Practical Law Data Privacy & Cybersecurity
Published on 20 Mar 2024Utah
Utah has amended its data breach notification law to specify the contents of data breach notices to the state and revise confidentiality provisions.
On March 19, 2024, Utah Governor Spencer Cox signed SB 98, which amends the state's data breach notification statute (Utah Code §§ 13-44-101 to 13-44-301).
Under the amendments, an organization notifying the Utah Attorney General (AG) or Utah Cyber Center (CC) of a data breach must include the following information if it is available at the time of notice:
  • The date of the breach.
  • The date the organization discovered the breach.
  • The total number of individuals affected, including the number of Utah residents.
  • The type of personal information affected.
  • A short description of the breach.
SB 98 also amends the notification statute's sections on the confidentiality of certain information submitted to or produced by the AG or CC to align them with Utah's Government Records Access and Management Act (Utah Code §§ 63G-2-101 to 63G-2-901).
The amendments take effect May 1, 2024. For more information about Utah's data breach notification law, see State Q&A, Data Breach Notification Laws: Utah.