USA – UTAH Trends and Developments Contributed by: Clifford Blair, Kirton McConkie
lytics platforms and AI systems to determine whether sensitive data is implicated directly or indirectly. Definition of “Sale” and Competitive Clarity Utah defines “sale” narrowly as the exchange of per - sonal data for monetary consideration. This approach contrasts with California’s broader “monetary or other valuable consideration” standard. Utah further excludes disclosures consistent with a consumer’s reasonable expectations. This narrower construction reduces ambiguity for organisations engaged in ana - lytics, cross-context advertising, or vendor partner - ships. However, multi-state operators must remain cautious. Practices that fall outside Utah’s definition may still constitute a sale under California or Colorado law. Controllers and Processors: Allocation of Duties and Vendor Management As is common in many privacy statutes around the world, the Utah Consumer Privacy Act distinguishes between controllers and processors and uses defini - tions similar to other jurisdictions: controllers deter - mine the purposes and means of processing personal data, while processors act on behalf of controllers pursuant to written instructions. Organisations sharing personal data with vendors, service providers or other third-parties should have contracts in place governing the data. Such controller- processor contracts must: • describe the nature and purpose of processing; • impose confidentiality obligations; • require reasonable administrative, technical and physical safeguards; and • ensure that subcontractors provide equivalent protections. Periodic review of processor agreements and due diligence documentation strengthens defensibility in the event of regulatory scrutiny of such data sharing. Consumer Rights and Operational Demands Utah consumers possess defined rights under the Utah Consumer Privacy Act. Controllers must imple - ment structured workflows to receive, verify and
respond to requests efficiently. Consumers have the right to: • confirm whether personal data is processed and access that data; • delete personal data provided by the consumer; • obtain a portable copy of previously provided data; • opt out of targeted advertising or the sale of per - sonal data; and • correct inaccurate personal data (effective 1 July 2026). The right of correction, effective 1 July 2026, requires particular attention. Correction requests may neces - sitate updates across multiple systems. Organisa - tions should define internal criteria for evaluating such requests and document implementation deci - sions. Controllers must respond to data subject rights requests within 45 days. A single 45-day extension is permitted when reasonably necessary. In the case of data subject complaints or regulatory investigations, the Attorney General must provide written notice and a 30-day opportunity to cure before enforcement action, as discussed in more detail below. Transparency and Privacy Notices Transparency is an important element in Utah privacy law, as in other jurisdictions. Controllers must pro - vide consumers with a reasonably accessible privacy notice describing: • categories of personal data processed; • purposes of processing; • categories of third parties receiving data; and • available consumer rights and methods for exercis - ing them. Overly generic disclosures risk undermining statutory transparency obligations. Regular review is advis - able, particularly when deploying new technologies or modifying vendor relationships. Data Minimisation and Security Practices Although the Utah Consumer Privacy Act does not use the term data minimisation explicitly, responsible data governance remains essential. Collecting only the data necessary for defined business purposes reduces risk exposure and simplifies compliance obligations. The
622 CHAMBERS.COM
Powered by FlippingBook