{"data":{"id":"us-ut/utah-code-13-61-203","jurisdiction":"us-ut","citation":"Utah Code § 13-61-203","heading":"Controller's response to requests.","body":"(1) Subject to the other provisions of this chapter, a controller shall comply with a consumer's request under Section 13-61-202 to exercise a right.\n(2)\n(a) Within 45 days after the day on which a controller receives a request to exercise a right, the controller shall:\n(i) take action on the consumer's request; and\n(ii) inform the consumer of any action taken on the consumer's request.\n(b) The controller may extend once the initial 45-day period by an additional 45 days if reasonably necessary due to the complexity of the request or the volume of the requests received by the controller.\n(c) If a controller extends the initial 45-day period, before the initial 45-day period expires, the controller shall:\n(i) inform the consumer of the extension, including the length of the extension; and\n(ii) provide the reasons the extension is reasonably necessary as described in Subsection (2)(b).\n(d) The 45-day period does not apply if the controller reasonably suspects the consumer's request is fraudulent and the controller is not able to authenticate the request before the 45-day period expires.\n(3) If, in accordance with this section, a controller chooses not to take action on a consumer's request, the controller shall within 45 days after the day on which the controller receives the request, inform the consumer of the reasons for not taking action.\n(4)\n(a) A controller may not charge a fee for information in response to a request, unless the request is the consumer's second or subsequent request during the same 12-month period.\n(b)\n(i) Notwithstanding Subsection (4)(a), a controller may charge a reasonable fee to cover the administrative costs of complying with a request or refuse to act on a request, if:\n(A) the request is excessive, repetitive, technically infeasible, or manifestly unfounded;\n(B) the controller reasonably believes the primary purpose in submitting the request was something other than exercising a right; or\n(C) the request, individually or as part of an organized effort, harasses, disrupts, or imposes undue burden on the resources of the controller's business.\n(ii) A controller that charges a fee or refuses to act in accordance with this Subsection (4)(b) bears the burden of demonstrating the request satisfied one or more of the criteria described in Subsection (4)(b)(i).\n(5) If a controller is unable to authenticate a consumer request to exercise a right described in Section 13-61-201 using commercially reasonable efforts, the controller:\n(a) is not required to comply with the request; and\n(b) may request that the consumer provide additional information reasonably necessary to authenticate the request.","path":["Title 13 Commerce and Trade","Chapter 13-61 Utah Consumer Privacy Act","Part 13-61-2 Rights Relating to Personal Data"],"source_url":"https://le.utah.gov/xcode/Title13/Chapter61/13-61-S203.html","current_through":"2026 General Session","vintage":"","retrieved_at":"2026-09-03T11:34:33Z","sha256":"ccda79f747cfa9d416ab47fa42d73eb839bff9db81f22ca1ddafebb8f853eee7","source_id":"us-ut","stale":false,"prev":"us-ut/utah-code-13-61-202","next":"us-ut/utah-code-13-61-301"},"notice":"GroundRules: Original legal text. Not legal advice."}