{"data":{"id":"us-ut/utah-code-13-61-304","jurisdiction":"us-ut","citation":"Utah Code § 13-61-304","heading":"Limitations.","body":"(1) The requirements described in this chapter do not restrict a controller's or processor's ability to:\n(a) comply with a federal, state, or local law, rule, or regulation;\n(b) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, local, or other governmental entity;\n(c) cooperate with a law enforcement agency concerning activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local laws, rules, or regulations;\n(d) investigate, establish, exercise, prepare for, or defend a legal claim;\n(e) provide a product or service requested by a consumer or a parent or legal guardian of a child;\n(f) perform a contract to which the consumer or the parent or legal guardian of a child is a party, including fulfilling the terms of a written warranty or taking steps at the request of the consumer or parent or legal guardian before entering into the contract with the consumer;\n(g) take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or of another individual;\n(h)\n(i) detect, prevent, protect against, or respond to a security incident, identity theft, fraud, harassment, malicious or deceptive activity, or any illegal activity; or\n(ii) investigate, report, or prosecute a person responsible for an action described in Subsection (1)(h)(i);\n(i)\n(i) preserve the integrity or security of systems; or\n(ii) investigate, report, or prosecute a person responsible for harming or threatening the integrity or security of systems, as applicable;\n(j) if the controller discloses the processing in a notice described in Section 13-61-302, engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws;\n(k) assist another person with an obligation described in this subsection;\n(l) process personal data to:\n(i) conduct internal analytics or other research to develop, improve, or repair a controller's or processor's product, service, or technology;\n(ii) identify and repair technical errors that impair existing or intended functionality; or\n(iii) effectuate a product recall;\n(m) process personal data to perform an internal operation that is:\n(i) reasonably aligned with the consumer's expectations based on the consumer's existing relationship with the controller; or\n(ii) otherwise compatible with processing to aid the controller or processor in providing a product or service specifically requested by a consumer or a parent or legal guardian of a child or the performance of a contract to which the consumer or a parent or legal guardian of a child is a party; or\n(n) retain a consumer's email address to comply with the consumer's request to exercise a right.\n(2) This chapter does not apply if a controller's or processor's compliance with this chapter:\n(a) violates an evidentiary privilege under Utah law;\n(b) as part of a privileged communication, prevents a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under Utah law; or\n(c) adversely affects the privacy or other rights of any person.\n(3) A controller or processor is not in violation of this chapter if:\n(a) the controller or processor discloses personal data to a third party controller or processor in compliance with this chapter;\n(b) the third party processes the personal data in violation of this chapter; and\n(c) the disclosing controller or processor did not have actual knowledge of the third party's intent to commit a violation of this chapter.\n(4) If a controller processes personal data under an exemption described in Subsection (1), the controller bears the burden of demonstrating that the processing qualifies for the exemption.\n(5) Nothing in this chapter requires a controller, processor, third party, or consumer to disclose a trade secret.","path":["Title 13 Commerce and Trade","Chapter 13-61 Utah Consumer Privacy Act","Part 13-61-3 Requirements for Controllers and Processors"],"source_url":"https://le.utah.gov/xcode/Title13/Chapter61/13-61-S304.html","current_through":"2026 General Session","vintage":"","retrieved_at":"2026-09-03T11:34:33Z","sha256":"ef9c285d097a2fb3946448d8093557536e6557017ddcb7745cc365f974ce1c76","source_id":"us-ut","stale":false,"prev":"us-ut/utah-code-13-61-303","next":"us-ut/utah-code-13-61-305"},"notice":"GroundRules: Original legal text. Not legal advice."}