Utah Consumer Privacy Act Compliance in Less Than 1 week

The Utah Consumer Privacy Act (UCPA) is one of the few US state data privacy laws. State laws protect consumers against excessive data processing practices without a federal data protection law.

Governor Spencer Cox signed the UCPA in March 2022. Its effective date is 31 December 2023.

It grants consumers rights and imposes some duties on businesses. 

UCPA applies to any business that:

• Conducts business in the state of Utah or produces a product or service that is targeted to consumers who are Utah residents of the state, and
• Has annual revenue of $25,000,000 or more, and
• Satisfies one or more of the following thresholds:
  - During a calendar year, controls or processes personal data of 100,000 or more Utah residents,
  - Derives over 50% of the entity’s gross revenue from the sale of personal data and
  - Controls or processes personal data of 25,000 or more consumers.

The UCPA exemptions include:

• Government bodies
• Tribes
• Business associates
• Nonprofits
• Institutions of higher education
• Protected health information according to the Health Insurance Portability and Accountability Act (HIPAA)
• Personal data collected as part of human subjects research
• Data protected by the Gramm-Leach-Bliley Act (GLBA)
• Financial institutions process data according to the Fair Credit Reporting Act (FCRA) and others.

UCPA defines personal data as any information that is linked or reasonably linkable to an identified individual or an identifiable individual. Simply put, any information that could directly or indirectly identify a person are personal data.

This includes personal names, Social Security Numbers, Driver’s License Numbers, email addresses, phone numbers, IP addresses, browsing behavior, or any other information that could lead to a person acting in an individual or household context.

Deidentified data, aggregated data, or publicly available information are not under the UCPA scope. They are excluded.

Sensitive data means personal data that reveals:

• Racial or ethnic origin
• Religious beliefs
• Sexual orientation;
• Citizenship or immigration status
• Health data
• The processing of genetic personal data or biometric data, if the processing is to identify a specific individual, or
• Specific geolocation data.

You have transparency duties to your consumers, which obliges you to give them a privacy notice on data collection. It must contain a clear notice of:

• The categories of personal data processed by the controller
• The purposes for which the categories of personal data are processed
• How consumers may exercise a right
• The categories of personal data that the controller shares with third parties, if any
• The categories of third parties, if any, with whom the controller shares personal data
• How to opt out of the sale of personal data and targeted advertising.

To learn about cookie blocking, please see this guide.

Yes, we offer GDPR readiness tests, website audits, training and more. Please schedule a call here.

Yes, we offer full support for a wide range of privacy laws including CCPA and LGPD.

Yes, we offer volume discounts. Please schedule a call here.

Yes, you can. We offer a FREE trial. You can cancel anytime.

You sure can. Go to your administration panel at any time, and you will find cancel in the account section.