{"data":{"id":"us-ut/utah-code-63a-19-406","jurisdiction":"us-ut","citation":"Utah Code § 63A-19-406","heading":"Data breach notice to individuals affected by data breach.","body":"(1)\n(a) Except as provided in Subsection (1)(b),a governmental entity shall provide cause a data breach notice to be sent to an individual or legal guardian of an individual affected by the data breach:\n(i) after determining the scope of the data breach;\n(ii) after restoring the reasonable integrity of the affected system, if necessary; and\n(iii) without unreasonable delay except as provided in Subsection (2).\n(b) A governmental entity or the governmental entity's contractor is not required to provide a data breach notice to an affected individual as described in Subsection (1)(a)if the:\n(i) personal data involved in the data breach would be classified as a public record under Section 63G-2-301; and\n(ii) the governmental entity prominently posts notice of the data breach on the homepage of the governmental entity's government website.\n(2) A governmental entity or the governmental entity's contractor shall delay providing notification under Subsection (1)at the request of a law enforcement agency that determines that notification may impede a criminal investigation, until the law enforcement agency informs the governmental entity that notification will no longer impede the criminal investigation.\n(3) The data breach notice to an affected individual shall include:\n(a) a description of the data breach;\n(b) the individual's personal data that was accessed or may have been accessed;\n(c) steps the governmental entity is taking or has taken to mitigate the impact of the data breach; and\n(d) recommendations to the individual on how to protect the individual from identity theft and other financial losses.\n(4) Unless the governmental entity reasonably believes that providing notification would pose a threat to the safety of an individual, or unless an individual has designated to the governmental entity a preferred method of communication, a governmental entity or the governmental entity's contractor shall provide notice by:\n(a)\n(i) email, if reasonably available and allowed by law; or\n(ii) mail; and\n(b) one of the following methods, if the individual's contact information is reasonably available and the method is allowed by law:\n(i) text message with a summary of the data breach notice and instructions for accessing the full notice; or\n(ii) telephone message with a summary of the data breach notice and instructions for accessing the full data breach notice.\n(5) A governmental entity shall also provide a data breach notice in a manner that is reasonably calculated to have the best chance of being received by the affected individual or the legal guardian of an individual, such as through a press release, posting on appropriate social media accounts, or publishing notice in a newspaper of general circulation when:\n(a) a data breach affects more than 500 individuals; and\n(b) a governmental entity is unable to obtain an individual's contact information to provide notice for any method listed in Subsection (4).","path":["Title 63A Utah Government Operations Code","Chapter 63A-19 Government Data Privacy Act","Part 63A-19-4 Duties of Governmental Entities"],"source_url":"https://le.utah.gov/xcode/Title63A/Chapter19/63A-19-S406.html","current_through":"2026 General Session","vintage":"","retrieved_at":"2026-09-03T11:34:33Z","sha256":"7fe6c7633205727f313a2e6419d0cd534f975b01cb14ba96a18e142dbfc862e3","source_id":"us-ut","stale":false,"prev":"us-ut/utah-code-63a-19-405","next":"us-ut/utah-code-63a-19-407"},"notice":"GroundRules: Original legal text. Not legal advice."}