Utah Code § 63A-19-502: Data privacy complaint process.

(1) An individual who makes a data privacy complaint shall first submit the complaint to the chief administrative officer of the governmental entity that is the subject of the complaint.

(2) Upon receipt of a data privacy complaint under Subsection (1), the chief administrative officer shall attempt to resolve the complaint with the individual.

(3) If the chief administrative officer is unable to resolve a data privacy complaint with the individual under Subsection (2), the individual or the governmental entity may request mediation with the ombudsperson in accordance with Section 63A-19-501.

(4) If an individual submits a data privacy complaint directly to the ombudsperson, the ombudsperson shall:

(a) notify the individual and the governmental entity that the complaint will be referred to the chief administrative officer of the governmental entity; and

(b) refer the complaint to the chief administrative officer.

(5) This section does not apply to a complaint about data privacy that is within the authority of:

(a) the Government Records Office created in Section 63A-12-202; or

(b) the government records ombudsman established in Section 63A-12-204.

(6) An employee of a governmental entity may submit a confidential and anonymous data privacy complaint directly to the attorney general.

(7) An employee of a governmental entity who submits a complaint under Subsection (6) is entitled to the protections described in Title 67, Chapter 21, Utah Protection of Public Employees Act.