Data Breach Notice to Residents and State Authorities in Utah
At a glance
| Covered entity and service provider | Owner/licensee of computerized PI investigates and notifies; nonowner maintainer notifies and cooperates with owner/licensee immediately after discovery if misuse occurs or is likely; financial institutions excluded (§§ 13-44-102, -103, -202(1),(3)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of computerized PI; name plus SSN, financial-account access, or license/state ID; protected or public data excluded (§ 13-44-102(1),(4)) |
| Risk screen or notice exception | Prompt good-faith investigation; resident notice only if identity-theft/fraud misuse occurred or is reasonably likely; good-faith employee acquisition excluded absent unlawful use/disclosure (§§ 13-44-102(1), -202(1)(a)-(b)) |
| Individuals who receive notice | Each affected Utah resident when investigation finds identity-theft/fraud misuse occurred or is reasonably likely (§ 13-44-202(1)(b)) |
| Individual notice deadline and clock | Most expedient time possible without unreasonable delay after breach scope and reasonable system integrity restored; no fixed outer day limit (§ 13-44-202(2)) |
| Regulator threshold and deadline | At 500 affected Utah residents, AG AND Utah Cyber Center; same most-expedient/without-unreasonable-delay timing; specified incident details (§ 13-44-202(1)(c),(2),(6)(b)) |
| Consumer-reporting-agency notice | At 1,000 affected Utah residents, each nationwide consumer reporting agency; same timing rule (§ 13-44-202(1)(d),(2)) |
| Individual delivery and content | First-class mail, qualifying electronic notice, or telephone; statute has no itemized resident-letter content, but specifies regulator-report fields (§ 13-44-202(5)(a),(6)(b)) |
| Substitute notice conditions and channels | If direct methods infeasible for a resident, newspaper of general circulation AND publication under § 45-1-101; no numeric cost/population shortcut (§ 13-44-202(5)(a)(iv)) |
| Delays and alternate compliance | Requested police delay until clearance; timely own-policy or regulated-entity resident-notice route; § 13-44-202 waiver void (§ 13-44-202(4)-(5),(7)) |
Requirements one by one
Trigger and investigation
Utah Code § 13-44-102(1) defines a breach as unauthorized acquisition of computerized personal information. The covered combinations in § 13-44-102(4) are a name with a Social Security number, financial-account access data, or a driver's license or state ID number. Protected and lawfully public information are excluded. Good-faith employee or agent acquisition is excluded unless the information is unlawfully used or improperly disclosed. Financial institutions and their affiliates are outside this chapter under § 13-44-103.
When an owner or licensee becomes aware of a breach, § 13-44-202(1)(a) requires a prompt, reasonable, good-faith investigation. Resident notice follows only if misuse for identity theft or fraud has occurred or is reasonably likely.
Residents, state offices, and reporting agencies
Under § 13-44-202(1)(b)-(d), the holder notifies each affected Utah resident; at 500 or more affected Utah residents it also notifies both the Attorney General and Utah Cyber Center; at 1,000 or more it adds each nationwide consumer reporting agency. The state-office report states the breach and discovery dates, total and Utah resident counts, data type, and a short incident description to the extent known or available, under subsection (6)(b).
Section 13-44-202(2) requires each notice in the most expedient time possible without unreasonable delay, after scope determination and reasonable system-restoration work. It sets no fixed outer day count. A nonowner maintainer must notify and cooperate with the owner or licensee immediately after discovery if misuse occurs or is reasonably likely, under subsection (3).
Delivery and substitute publication
Section 13-44-202(5)(a) allows first-class mail to the most recent address, qualifying electronic notice, or telephone. If these methods are not feasible for a resident, it permits publication in a newspaper of general circulation and as required by § 45-1-101. The statute specifies state-report content but no itemized resident-letter checklist.
What trips people up
The substitute route is per resident. Section 13-44-202(5)(a)(iv) turns on whether direct delivery is feasible for the affected Utah resident. It does not offer a numeric cost or population shortcut.
A law-enforcement request can pause resident notice. Under § 13-44-202(4), the agency must determine notice may impede a criminal investigation and request delay. The holder gives notice in good faith without unreasonable delay after the agency says notice will no longer impede it.
Alternate procedures have conditions. Section 13-44-202(5)(b)-(c) recognizes timely own-policy notice or a regulated person's notice under its primary regulator's law. Subsection (7) makes a waiver of the section void.
Common questions
Does every breach require a resident letter?
No. Under § 13-44-202(1)(a)-(b), the investigation must show identity-theft or fraud misuse has happened or is reasonably likely.
Is telephone notice allowed?
Yes. Section 13-44-202(5)(a)(iii) allows telephone notice, including lawful automatic dialing.
Statutes and sources
- Utah Code § 13-44-102 — definitions.
- Utah Code § 13-44-103 — applicability.
- Utah Code § 13-44-202 — notices and delivery.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Utah law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Utah law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace