Protecting personal information is a shared responsibility between individuals, businesses, and government entities. Utah law establishes clear expectations for how personal data should be handled, stored, and protected, while giving consumers meaningful rights over their information. The Office of the Utah Attorney General and the Utah Department of Commerce’s Division of Consumer Protection play a central role in enforcing these standards and addressing violations.
Utah law gives consumers the right to understand how their personal information is collected, used, and shared by businesses. Consumers may request access to their personal data, ask for certain data to be deleted, and opt out of the sale of personal information or its use for targeted advertising. These rights are intended to provide transparency and allow individuals greater control over their digital footprint. Consumers also play an important role in protecting their own data. Being mindful of what information is shared online, reviewing privacy notices, and using basic security practices can help reduce the risk of misuse or unauthorized access. When consumers believe their data rights have been violated, they may file a complaint with the Utah Division of Consumer Protection.
Businesses that collect or process personal data from Utah residents are required to follow state consumer protection and privacy laws. This includes being transparent about what information is collected, how it is used, and whether it is shared with third parties. Businesses must also take reasonable steps to safeguard personal information against unauthorized access, disclosure, or misuse.
When businesses engage in the sale of personal data or targeted advertising, they must provide consumers with clear notice and an opportunity to opt out. They must also follow reasonable procedures to prevent unlawful use or disclosure of personal information. Additionally, companies doing business in Utah must provide notice to consumers and the Utah Attorney General and the Utah Cyber Center of certain data breaches in the most expedient time possible and without unreasonable delay. Companies that fail to meet these obligations may be subject to investigation or enforcement action by the Office of the Utah Attorney General, often in coordination with the Utah Division of Consumer Protection.
