{"data":{"id":"us-ut/utah-code-78b-4-702","jurisdiction":"us-ut","citation":"Utah Code § 78B-4-702","heading":"Affirmative defense for a breach of system security.","body":"(1) A person that creates, maintains, and reasonably complies with a written cybersecurity program that meets the requirements of Subsection (4), and is in place at the time of a breach of system security of the person, has an affirmative defense to a claim that:\n(a) is brought under the laws of this state or in the courts of this state; and\n(b) alleges that the person failed to implement reasonable information security controls that resulted in the breach of system security.\n(2) A person has an affirmative defense to a claim that the person failed to appropriately respond to a breach of system security if:\n(a) the person creates, maintains, and reasonably complies with a written cybersecurity program that meets the requirements of Subsection (4) and is in place at the time of the breach of system security; and\n(b) the written cybersecurity program had protocols at the time of the breach of system security for responding to a breach of system security that reasonably complied with the written cybersecurity program under Subsection (2)(a) and the person followed the protocols.\n(3) A person has an affirmative defense to a claim that the person failed to appropriately notify an individual whose personal information was compromised in a breach of system security if:\n(a) the person creates, maintains, and reasonably complies with a written cybersecurity program that meets the requirements of Subsection (4) and is in place at the time of the breach of system security; and\n(b) the written cybersecurity program had protocols at the time of the breach of system security for notifying an individual about a breach of system security that reasonably complied with the requirements for a written cybersecurity program under Subsection (3)(a) and the person followed the protocols.\n(4) A written cybersecurity program described in Subsections (1), (2), and (3) shall provide administrative, technical, and physical safeguards to protect personal information, including:\n(a) being designed to:\n(i) protect the security, confidentiality, and integrity of personal information;\n(ii) protect against any anticipated threat or hazard to the security, confidentiality, or integrity of personal information; and\n(iii) protect against a breach of system security;\n(b) reasonably conforming to a recognized cybersecurity framework as described in Subsection 78B-4-703(1); and\n(c) being of an appropriate scale and scope in light of the following factors:\n(i) the size and complexity of the person;\n(ii) the nature and scope of the activities of the person;\n(iii) the sensitivity of the information to be protected;\n(iv) the cost and availability of tools to improve information security and reduce vulnerability; and\n(v) the resources available to the person.\n(5)\n(a) Subject to Subsection (5)(b), a person may not claim an affirmative defense under Subsection (1), (2), or (3) if:\n(i) the person had actual notice of a threat or hazard to the security, confidentiality, or integrity of personal information;\n(ii) the person did not act in a reasonable amount of time to take known remedial efforts to protect the personal information against the threat or hazard; and\n(iii) the threat or hazard resulted in the breach of system security.\n(b) A risk assessment to improve the security, confidentiality, or integrity of personal information is not an actual notice of a threat or hazard to the security, confidentiality, or integrity of personal information.","path":["Title 78B Judicial Code","Chapter 78B-4 Limitations on Liability","Part 78B-4-7 Cybersecurity Affirmative Defense Act"],"source_url":"https://le.utah.gov/xcode/Title78B/Chapter4/78B-4-S702.html","current_through":"2026 General Session","vintage":"","retrieved_at":"2026-09-03T11:34:34Z","sha256":"71c1b37cda52bf937d79986643462cf9c3b9b8c390868643b25f78cfd293729c","source_id":"us-ut","stale":false,"prev":"us-ut/utah-code-78b-4-701","next":"us-ut/utah-code-78b-4-703"},"notice":"GroundRules: Original legal text. Not legal advice."}