--- title: The Utah Consumer Privacy Act description: Utah is now the fourth state to enact a comprehensive data privacy law. The Utah Consumer Privacy Act makes a few changes to the formula from other states. image: https://safe.truevault.com/hubfs/Utah-Capitol.jpg --- - [CCPA](https://safe.truevault.com/learn/ccpa/what-is-the-ccpa) - [GDPR Compliance](https://safe.truevault.com/gdpr-guide) - [HIPAA](https://safe.truevault.com/learn/hipaa) - [HIPAA Compliance](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [Personally Identifiable Information](https://safe.truevault.com/blog/what-is-pii) - [PHI](https://safe.truevault.com/protected-health-information) - [Resources](https://safe.truevault.com/learn/) - Login [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com) - [Resources](https://safe.truevault.com/learn/) - Login - Login - [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) - [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com) [Blog](https://safe.truevault.com/blog) - [Home](https://www.truevault.com/index.html) - [Blog](https://safe.truevault.com/blog) ![The Utah Consumer Privacy Act](https://safe.truevault.com/hubfs/Utah-Capitol.jpg) # The Utah Consumer Privacy Act By Phillip Walters/ Published on April 1, 2022 Recently signed into law by Governor Spencer Cox, the Utah Consumer Privacy Act (UCPA) is now the nation’s fourth data privacy law to go on the books. While it does not go into effect until December 31, 2023, it’s never too early to learn about the new law and how it compares to privacy legislation in other states. The new law is closely modeled on Virginia’s Consumer Data Privacy Act (VCDPA), as opposed to the California Consumer Privacy Act (CCPA). It grants similar privacy rights to consumers as the VCDPA, permanently exempts employment and B2B data, and creates no private right of action. Considering all the similarities, it’s worth taking a look at how the UCPA is different from its Virginia counterpart. ## Who Does the Utah Consumer Privacy Act Apply To? The UCPA’s most striking feature in comparison to other data privacy laws is its narrower focus on larger businesses. Specifically, **the Utah Consumer Privacy Act only applies to businesses that have at least $25 million in annual revenue**. This minimum-revenue threshold is unique to the UCPA, and will result in far fewer small and medium-sized businesses being required to comply. For those businesses that do have at least $25 million in annual revenue, the UCPA applies to them if they conduct business in Utah and meet one of these two thresholds: 1. They control or process the personal data of at least 100,000 Utah residents in a year, OR 2. They control or process the personal data of at least 25,000 Utah residents in a year and derive 50% or more of their gross annual revenue from the sale of personal data The UCPA also contains a long list of categories of organizations that are exempt, so that it is largely restricted to for-profit entities. The exemptions include: - Governmental entities - Nonprofit corporations - Institutes of higher education - Native American tribes - Covered entities and business associates, as defined by HIPAA - Financial institutions regulated by the Gramm-Leach-Bliley Act Regarding enforcement, though Utah’s Division of Consumer Protection may investigate claims of noncompliance, the attorney general has exclusive authority to pursue an enforcement action. Businesses will generally have 30 days to cure any violations, but after that they can be fined up to $7500 per violation. ## Privacy Rights Under the UCPA The UCPA creates four rights for consumers with regard to their personal data. These rights are: - **Right to access** personal data processed about the consumer - **Right to portability**, i.e., to receive a copy of personal data in a portable and readily usable format - **Right to delete** personal data provided by the consumer - **Right to opt out** of targeted advertising and the sale of the consumer’s personal data These might seem standard—they are quite similar to data privacy rights in Virginia, Colorado and California—but there are a few notable differences. First, Utah lawmakers have curiously left out the right to correct inaccurate personal data, which exists in those other three states. There is also a subtle difference in the UCPA’s right to delete: It only applies to personal data *provided by the consumer*, as opposed to applying to all personal data provided by and obtained about the consumer (as is the case with the Virginia law). At the least, this appears to exempt personal data received from data brokers from deletion, and potentially data from other sources as well. Once received, consumer requests must be resolved within 45 days, with the option to extend for another 45 days when reasonably necessary.   ## Sensitive Data As with Virgnia’s privacy law, the UCPA has special rules about the processing of “sensitive data,” though it handles the issue a bit differently. Sensitive data is defined as: - Personal data that reveals an individual's racial or ethnic origin, religious beliefs, sexual orientation, or citizenship or immigration status - Information regarding an individual's medical history, mental or physical health condition, or medical treatment or diagnosis by a healthcare professional  - The processing of genetic personal data or biometric data for the purpose of identifying a specific individual - Specific geolocation data This sticks pretty closely to Virginia’s definition of sensitive data, but while Virginia requires a consumer’s *consent* before processing such data, the UCPA only requires that consumers be informed and have the opportunity to opt out of the processing. On a related note, while the VCDPA requires businesses to complete a data protection assessment before processing sensitive data—or using targeted advertising, selling personal data, profiling consumers, and any other processing that presents a heightened risk to consumers—the Utah privacy law has no such requirement.   ## Planning for Utah Consumer Privacy Act Compliance While some businesses might be grimacing at the thought of having to comply with another state privacy law, the good news is that the UCPA adds very few wrinkles to a multi-jurisdictional compliance strategy. By the time 2024 comes around, most businesses that will be required to follow Utah’s privacy rules should already be compliant with the Virginia, Colorado, and California laws. Because the UCPA takes the same basic approach as Virginia but with a generally lighter touch, it should not take many adjustments to bring your business into compliance. TrueVault Polaris helps businesses navigate the complexities of data privacy compliance through a single cloud-based software. With our intuitive question-and-answer interface, you can get your company compliant quickly and at a lower cost. Contact our team to schedule a demo.   [![Schedule Call](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4693513/949d85da-b649-4822-b380-0922b22c3b60.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4693513/949d85da-b649-4822-b380-0922b22c3b60) ### Latest Posts ## [Should Utah's Privacy Law Be on Your Radar?](https://safe.truevault.com/blog/utah-privacy-law-does-it-apply) Phillip Walters / November 17, 2022 ## [Connecticut’s Privacy Law: Does It Apply to Your Business?](https://safe.truevault.com/blog/connecticut-privacy-law-does-it-apply) Phillip Walters / November 10, 2022 ## [Global Privacy Control: A New Requirement for Compliance](https://safe.truevault.com/blog/global-privacy-control) Phillip Walters / November 7, 2022 ## [A Cookie Banner Isn't Enough for CCPA Compliance](https://safe.truevault.com/blog/a-cookie-banner-isnt-enough) Phillip Walters / October 27, 2022 ## [Why CCPA Compliance Matters to HR](https://safe.truevault.com/blog/why-ccpa-matters-to-hr) Phillip Walters / October 21, 2022 ### Mailing List ### Company - [Blog](https://safe.truevault.com/blog) - [Contact Us](https://safe.truevault.com/contact-us-2019) - [Careers](https://truevault.workable.com) - [HIPAA Compliance Checklist](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [PDF: Developers Guide to HIPAA compliance](https://my.leadpages.net/leadbox/14472b173f72a2%3A131fd12f8b46dc/5760820306771968/) ### Developers - [Patterns](https://safe.truevault.com/patterns) - [Documentation](https://docs.truevault.com/) - [Quick Start Guide](https://safe.truevault.com/quick-start-guide) - [Secure Infrastructure](https://safe.truevault.com/secure-infrastructure) - [API Overview](https://safe.truevault.com/api-overview) ### Latest Posts ### Contact Us 201 Mission Street, 12th Floor San Francisco, CA 94105 Email: [hello@truevault.com](mailto:hello@truevault.com) 2024 © All Rights Reserved.  [Privacy Policy](https://privacy.truevault.com/privacy-policy)  |  [Terms of Use](https://www.truevault.com/legal/truevault-terms-of-use)  |  [Supplemental Terms](https://www.truevault.com/legal/truevault-supplemental-terms-of-use) | [California Privacy Notice](https://privacy.truevault.com/privacy-policy#california-privacy-notice)