Utah Data Breach Notification Law

The Utah data breach notification law starts with an investigation

Under the Utah data breach notification law, a business that learns of a breach of a system holding Utah residents' personal information must conduct a prompt, good faith investigation. If the investigation shows misuse for identity theft or fraud has occurred or is reasonably likely, notice to residents is due in the most expedient time possible without unreasonable delay ¹.

Personal information follows the core definition used across the states: a name with a Social Security number, a driver's license number, or a financial account or card number with its access code. Utah does not add the medical, biometric or login data that many newer laws cover ¹.

Three other duties sit around the notice rule:

• Vendors. A business that maintains data for another must notify and cooperate with the owner immediately after discovery when misuse is likely ¹.
• Law enforcement. Law enforcement can ask for a delay in notice ¹.
• Security. Section 13-44-201 requires reasonable procedures to protect personal information before anything goes wrong ¹.

The investigation decides whether Utah residents are notified

Utah's harm test is part of the trigger. Notice is required only if the investigation shows misuse for identity theft or fraud has occurred or is reasonably likely to occur ¹. The statute does not require you to document or report a decision not to notify ¹.

Write it down anyway. If you decide a breach does not need notice, the facts behind that call (what was accessed, for how long, whether data left the network) are what you will rely on if the Attorney General or a customer later asks. A forensic report from your incident response firm is the usual basis.

Mind the pace, too. The law expects a prompt investigation, so a slow one is not a safe way to push back the notice.

Notifying the Attorney General, the Utah Cyber Center and credit bureaus

Utah sends breach reports to a state cybersecurity office as well as the Attorney General. If misuse relating to 500 or more Utah residents has occurred or is reasonably likely, notify both the Office of the Attorney General and the Utah Cyber Center ¹. The report should include:

• The date of the breach and the date it was discovered
• The total number of people affected and the number in Utah
• The types of personal information involved
• A short description of the breach

The statute sets no deadline for this report ¹. A 2024 amendment, effective May 1, 2024, updated the Cyber Center reference and the confidentiality rules for reports to the two offices ¹.

At 1,000 or more Utah residents, the business must also notify the consumer reporting agencies ¹.

One open point: a 2026 bill changed the Utah Cyber Center's duties. Our record treats the May 1, 2024 version of the notice section as current, and whether the 2026 law touched that section has not been confirmed.

Encryption and Utah's cybersecurity defense

Personal information is covered only when it is unencrypted or not protected by another method that makes it unreadable or unusable ¹. Utah's text says nothing about a key that is stolen along with the data. That does not make weak key handling safe: data an attacker could read is hard to call unreadable or unusable.

Utah also rewards preparation. Under the Cybersecurity Affirmative Defense Act, a business has an affirmative defense to claims that it failed to implement reasonable security controls if it created, maintained and reasonably complied with a written cybersecurity program that was in place at the time of the breach ³. A written information security plan is where that program starts, and our small business cybersecurity guide covers the controls behind it.

Utah penalties and the no-lawsuit rule

The Attorney General enforces the Utah law. It may seek a civil penalty of up to $2,500 per violation for a specific consumer and up to $100,000 in total for related violations. Higher amounts are possible when 10,000 or more Utah residents and 10,000 or more other residents are involved ².

The chapter states that it creates no private right of action ². A 2025 amendment, effective May 7, 2025, changed the enforcement section but not the penalty amounts ².

Utah breach response: the first week

With the attack still under way, an insured Utah company contacts its carrier first, submits an FBI report on ic3.gov, and saves logs and disk images before any rebuild ⁵⁸⁶. Utah's 2025 count at IC3 was 9,903 complaints and about $195 million in reported losses ⁷.

Then:

1. Begin the prompt, good faith investigation with your IT team or a forensic firm; its findings decide whether notice is owed.
2. Look for required panel lawyers in the policy before hiring counsel; carrier conditions for small firms covers this.
3. Count Utahns against the 500 and 1,000 lines and list everyone else by state. Colorado and Nevada run their own rules, and each state's requirements are in our table.
4. Draft resident notices and the AG and Cyber Center report together.

Larger companies may also fall under the Utah Consumer Privacy Act. It applies only to businesses with $25 million or more in annual revenue that also handle personal data of 100,000 or more Utah consumers a year, or 25,000 or more while earning over half their gross revenue from selling it ⁴. Clinics also answer to the federal HIPAA notice rule. Local IT support pricing is on our Salt Lake City page.

We compared this summary with Utah Code Title 13, Chapter 44 on October 13, 2026. Nothing here is legal advice; a Utah lawyer should confirm what applies to your business.