1. Home
  2. State breach laws
  3. Utah

Utah data breach notification law

What Utah requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Utah Code §§ 13-44-101 to 13-44-301 (notice requirement at § 13-44-202; enforcement at § 13-44-301).

No fixed deadline
Notification deadline
Required
AG notification
No
Private right of action
Affirmative defense
Liability protection

What this means if you sell security services

Utah sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits. Utah also gives organizations with a qualifying security program an affirmative defense in breach lawsuits, a concrete state-law reason for a prospect to build and document one.

See recent Utah breach filings →

Requirements in detail

Statute
Utah Code §§ 13-44-101 to 13-44-301 (notice requirement at § 13-44-202; enforcement at § 13-44-301)
Deadline to notify residents
In the most expedient time possible and without unreasonable delay, after an investigation shows that misuse of the information for identity theft or fraud has occurred or is reasonably likely. Timing may account for law enforcement needs, determining the scope of the breach, and restoring system integrity, and notice may be delayed at a law enforcement agency's request.
Attorney General notification
Yes, when misuse involving 500 or more Utah residents has occurred or is reasonably likely, both the Office of the Attorney General and the Utah Cyber Center must be notified, on the same most-expedient-time timeline that applies to residents. That notice must include the breach date, the discovery date, the total number affected (including Utah residents), the types of information involved, and a short description. Nationwide consumer reporting agencies must also be notified when 1,000 or more Utah residents are affected.
Penalties
The Attorney General enforces the law. Civil penalties are up to $2,500 for a violation or series of violations concerning a specific consumer, and up to $100,000 in total for related violations concerning more than one consumer. The $100,000 cap does not apply if the violations concern 10,000 or more Utah residents and 10,000 or more residents of other states, or if the business agrees to settle for more. The Attorney General may also seek injunctive relief and attorney fees.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Utah's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
Utah's Cybersecurity Affirmative Defense Act (2021) gives organizations with a written security program conforming to a recognized framework affirmative defenses to claims that they failed to implement reasonable controls, respond appropriately, or notify appropriately. The defense is lost if the organization had actual notice of a threat and didn't act on it. These protections limit lawsuits; they don't change the duty to notify. Utah Code §§ 78B-4-701 to 78B-4-706
Recent changes
SB 98 (2024 General Session, Chapter 426), effective May 1, 2024, updated the Utah Cyber Center reference and added the required contents for the notice sent to the Attorney General and the Utah Cyber Center. Amendments in 2024 and 2025 (2025 General Session, Chapter 173) to the enforcement section changed only venue rules for Attorney General lawsuits.

Utah breach notification FAQ

What is the data breach notification deadline in Utah?

In the most expedient time possible and without unreasonable delay, after an investigation shows that misuse of the information for identity theft or fraud has occurred or is reasonably likely. Timing may account for law enforcement needs, determining the scope of the breach, and restoring system integrity, and notice may be delayed at a law enforcement agency's request. The governing law is Utah Code §§ 13-44-101 to 13-44-301 (notice requirement at § 13-44-202; enforcement at § 13-44-301).

Does Utah require notifying the Attorney General of a data breach?

Yes, when misuse involving 500 or more Utah residents has occurred or is reasonably likely, both the Office of the Attorney General and the Utah Cyber Center must be notified, on the same most-expedient-time timeline that applies to residents. That notice must include the breach date, the discovery date, the total number affected (including Utah residents), the types of information involved, and a short description. Nationwide consumer reporting agencies must also be notified when 1,000 or more Utah residents are affected.

What are the penalties for failing to report a data breach in Utah?

The Attorney General enforces the law. Civil penalties are up to $2,500 for a violation or series of violations concerning a specific consumer, and up to $100,000 in total for related violations concerning more than one consumer. The $100,000 cap does not apply if the violations concern 10,000 or more Utah residents and 10,000 or more residents of other states, or if the business agrees to settle for more. The Attorney General may also seek injunctive relief and attorney fees.

Can individuals sue over a data breach in Utah?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Utah?

Utah's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Utah limit breach lawsuits for companies with a cybersecurity program?

Utah's Cybersecurity Affirmative Defense Act (2021) gives organizations with a written security program conforming to a recognized framework affirmative defenses to claims that they failed to implement reasonable controls, respond appropriately, or notify appropriately. The defense is lost if the organization had actual notice of a threat and didn't act on it. These protections limit lawsuits; they don't change the duty to notify.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Utah Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →