In one paragraph
Utah's HB 450 reorganizes oversight of how state and local government entities handle personal data under the Government Data Privacy Act. It restructures the Utah Privacy Commission to include state agency, city, county and public education members, moves its support to the Utah Office of Data Privacy, makes a data privacy ombudsperson part of that office, sets a complaint process (complaints go first to the entity, then to mediation), and moves the state privacy auditor's duties to the state auditor. The act already treats facial recognition, automated decision-making and profiling as high-risk processing. It governs government, not businesses. Effective May 6, 2026.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
No direct duties for private businesses: it governs how Utah state and local government handle personal data, including high-risk uses such as facial recognition and automated decisions.
Key provisions
- Amends the Government Data Privacy Act (Utah Code Title 63A, Chapter 19) and the Government Records Access and Management Act; applies to governmental entities
- Utah Privacy Commission restructured to include representatives of state agencies, cities, counties and public education; the Utah Office of Data Privacy now supports it
- The Office of Data Privacy may issue recommendations and guidance and partner with state universities; with the commission it studies governmental use of passive data collection technology and reports to the Government Operations Interim Committee
- The data privacy ombudsperson becomes part of the Office of Data Privacy; complaints go first to the entity's chief administrative officer, then may go to mediation with the ombudsperson (Utah Code § 63A-19-502)
- The state privacy auditor's responsibilities move to the state auditor's office; correction procedures cover information beyond personal data
- The act's definition of high-risk processing activities includes facial recognition technology, automated decision-making, profiling, and genetic, biometric and specific geolocation data
- Signed March 19, 2026; effective May 6, 2026
Latest legislative action
Mar 19, 2026. Governor Signed
Sponsors (showing 5 of 11)
| Name | Role |
|---|---|
| Christofferson, Kay J. | Primary |
| Hayes, Sahara D | Primary |
| Last, Bradley G. | Primary |
| Pitcher, Stephanie D | Primary |
| Shallenberger, David | Primary |
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error