Utah Privacy Law for Small Business: What Actually Applies

Every few months a Utah owner forwards me the same email. Some compliance vendor has noticed their contact form and would like a few hundred dollars a month to keep them out of trouble with "Utah's new privacy law." The email is vague about which law, which is the tell.

The short version runs opposite to what most people expect. The famous Utah privacy statute almost certainly does not apply to you, and its revenue floor is set so high that no amount of data collection changes the answer. A much older Utah statute does apply to you, at any size, and it carries a duty most small businesses have quietly never met.

Worth knowing which is which before you buy anything.

The threshold nearly every Utah business misses

The Utah Consumer Privacy Act's applicability section sets a three part test, and the word joining the parts is "and."

You have to conduct business in Utah or target Utah residents. You have to have annual revenue of $25,000,000 or more. And you have to clear one of two volume thresholds: personal data on 100,000 or more consumers in a calendar year, or personal data on 25,000 or more consumers combined with over 50 percent of gross revenue coming from selling that data.

The revenue figure is a floor, not a factor. Fall below it and the chapter does not apply, no matter how many customer records you hold. A 14 person marketing firm in Sandy with 60,000 email subscribers is not a covered controller. No data subject request process, no opt out link, no privacy notice obligation under that chapter.

The exemption list goes further. Nonprofit corporations are out entirely, as are institutions of higher education, HIPAA covered entities and their business associates, and financial institutions under Gramm-Leach-Bliley. Employee and contractor data sits outside the chapter too, which surprises owners who assumed HR files were the risky part.

The 2027 change is about cars, not about you

If someone tells you Utah's privacy law changes on January 1, 2027, they are technically right and practically misleading.

That applicability section genuinely is superseded on that date, by HB 357 from the 2026 general session. Read what it actually does. It leaves the $25,000,000 floor and both volume thresholds exactly as they are, then adds a second category of covered business: motor vehicle manufacturers who sell or lease vehicles in Utah and collect data through an in-vehicle system. The new sections require model year 2030 and later vehicles to carry in-car privacy controls, including the ability to delete data a driver typed into the dashboard, and to honor a court ordered deletion within five business days.

Notice what that makes it. Carmakers become the first class of business the chapter reaches with no revenue threshold at all. When the legislature asked who else this should cover, the answer was not small business.

The statute that does apply to you, at any size

Utah's Protection of Personal Information Act has been on the books for years and almost nobody sells a subscription against it.

It opens with the sentence compliance emails never quote: any person who conducts business in the state and maintains personal information shall implement and maintain reasonable procedures to prevent unlawful use or disclosure, and to destroy records containing personal information that are not to be retained. No revenue threshold. No employee count. No small business carve out.

The destruction standard is specific: shredding, erasing, or otherwise modifying the information to make it indecipherable. Dragging a folder to the trash is not on the list.

Then there is the breach section, where the real obligation lives. When you become aware of a breach, you owe a good faith, reasonable and prompt investigation into whether the information has been or is likely to be misused for identity theft or fraud. If it has been or likely will be, you notify every affected Utah resident in the most expedient time possible without unreasonable delay. Utah sets no fixed day count, which cuts both ways.

Volume adds recipients:

1. 500 or more Utah residents affected: notify the Utah Attorney General's office and the Utah Cyber Center as well.
2. 1,000 or more: add every nationwide consumer reporting agency.

Two more provisions are worth knowing. If you hold data you do not own, which is the position every vendor occupies, you must notify and cooperate with the owner immediately on discovery. And a waiver of that section is void and unenforceable, so no contract clause gets anyone out of it.

Personal information is narrower than you assume

Here is the part that changes what you actually have to do.

Under the chapter's definitions, personal information means a first name or first initial and last name combined with one of exactly three things: a Social Security number, a financial account or card number together with the code or password that would let someone use it, or a driver license or state identification card number. It only counts when that data is unencrypted or not otherwise rendered unreadable.

So the ordinary contact form collecting a name, an email address, and a paragraph about a kitchen remodel does not hold personal information under this chapter. A client intake packet with a photographed driver license does. A homegrown invoicing tool storing card numbers next to their security codes very much does.

None of that is a general pass. HIPAA still reaches a covered entity's records, card networks still bind you by contract, and Utah's AI rules still apply to a chat widget no matter what it stores, which we covered in the Utah AI disclosure law. It only means the Utah breach clock is narrower than the phrase "customer data" suggests. The same logic applies to what you let crawlers and third party scripts reach, a question we worked through in should you block AI crawlers.

Where this data actually piles up

In the intake work we are building for a residential treatment provider, the first real design decision was not which steps to automate. It was which fields the system stores at all versus reads once and drops. That question sounds boring and it is the whole game, because you cannot lose what you never kept.

On a typical small business site, a name plus an identifier accumulates in places nobody chose:

1. Form to email. Every submission sits in an inbox forever, plus the sending service's logs, plus whatever spreadsheet someone built off it.
2. Attachments. Intake forms with file uploads are where licenses, voided checks, and insurance cards arrive.
3. One time exports. A CSV pulled for a mailing two years ago, still in Downloads and still in shared Drive.
4. Staging databases and backups seeded from production, usually with weaker access control than production has.
5. Vendors, each holding a copy, each with a private definition of prompt.

Number three is the one I find most often, and it is free to fix this afternoon.

The afternoon version of compliance

Seven things, none requiring a lawyer:

1. Inventory where a name lands next to a Social Security number, an account or card number, or a license number. Systems, not intentions.
2. Stop collecting fields you never use. An unread Social Security number box is pure liability.
3. Set retention on attachments and exports, then actually delete, to the indecipherable standard.
4. Encrypt at rest wherever your stack allows it, for the reason above.
5. Write a two page incident procedure naming who investigates and who signs the notice. The statute treats your own documented procedure as the compliance path when its timing stays consistent with the chapter.
6. Ask each vendor what happens on their breach, and get the answer in writing.
7. Read your own privacy policy and cut every promise you do not keep. Nothing in the consumer privacy act compels that policy at your size, and a broken promise is enforceable whether or not the statute reached you.

The FTC's Start with Security guide is free, plainly written, and better than most paid checklists if you want the longer version.

Frequently asked questions

Do I need a privacy policy if the consumer privacy act does not apply to me? Not because of that chapter. You probably still need one because ad platforms, app stores, and payment processors require it by contract, and because analytics and email tools ask you to represent that you have one. Make it describe what you actually do rather than what a template assumed.

My revenue is under $25 million but most of my customers live in California and Colorado. Then Utah's threshold is the wrong one to check. Other states set the bar far lower and key on the consumer's residence rather than your office's. Utah being permissive tells you nothing about the rest of the map, and email is where this bites first, which is part of why deliverability and consent overlap so much in our email deliverability post.

When does the breach notification clock start? When you become aware of the breach, though what you owe first is the investigation, not the notice. Notification follows once you have scoped the breach and restored the system's integrity, in the most expedient time possible without unreasonable delay. Deliberately vague, and not a license to sit on it.

We store card numbers so repeat billing is easier. Is that a problem? Yes, and the statute is the least of it. Hand that job to your processor and keep a token instead. This is a routine fix on any custom software build, and one of the few changes that shrinks your compliance surface and your support load at the same time.

Utah asks less of your website than the compliance emails imply and more of your filing habits than anyone mentions. Skip the subscription. Spend an afternoon finding where names sit beside license numbers, delete what you do not need, encrypt what you keep, and write down who makes the call when something goes wrong. If you want a second set of eyes on where that data actually lives across your website and internal tools, we can map it with you.

Map where your customer data lives