Newsroom

The Complainant in this matter was concerned that the governmental entity’s application foremployment requires an applicant to provide their Social Security Number (SS#). TheGovernment Data Privacy Act (GDPA) requires government entities to only “obtain and processonly the minimum amount of personal data reasonably necessary to efficiently achieve aspecified purpose”. See Utah Code § 63A-19-401(2)(a)(ii). Representatives from thegovernmental entity said they

The Complainant in this matter was concerned that the governmental entity sent out a survey,which requested or collected personal data, without a privacy notice. The Government DataPrivacy Act (GDPA) at Subsection 63A-19-402(1) requires a governmental entity to provide aprivacy notice to an individual “from whom the governmental entity requests or collectspersonal data”. Representatives from the governmental entity indicated that they

The Practice 9 Inventorying page has two new updates:

The authority links have been updated for privacy practices 1-21. You can find them by clicking on the individual practices located on Tools and Resources.

The slide deck used in the virtual workshop titled Chief Administrative Officer has been added to Practice 1. You can download a static copy of those slides here.

An updated SCORM file has been added for the 2025 Privacy Awareness Training. The video has been added to the Department of Government Operations YouTube channel and can be streamed from the Practice 8 webpage.  State Agencies: A copy of the 2025 Privacy Awareness Training has been added to KnowBe4. Please contact your KnowBe4 administrator to have them initiate a training campaign. The course can be

A preliminary DRAFT of the Privacy Program Report Template has been added to the Privacy Program Links under Tools and Resources. Note: This version has not yet been finalized by the Utah Office of Data Privacy. It is provided for review and comment purposes only. The Office welcomes and encourages public and stakeholder feedback to inform the finalization of this

The Privacy Impact Assessment (PIA) has been updated. There are two notable changes: Access the PIA on Privacy for Government or Tools & Resources under Privacy Program Links.

New micro-trainings are available in Tools & Resources for:

We have added a new icon to our Privacy Program Links for ‘Privacy Awareness Training‘ Privacy Awareness Training links previously located under Tools & Resources are now available in Practice #8 – Statewide Privacy Awareness Training

An updated SCORM file has been added for the Privacy Awareness Training. The new file includes: Downloadable links can be found on the Practice 8 webpage

We’ve implemented an automated response for individuals who join the Utah Office of Data Privacy mailing list. Additionally, instructions for unsubscribing have been included in our Notice of Collection. Both the mailing list information and the Notice of Collection are available at the bottom of our homepage.

The Utah Office of Data Privacy has formally partnered with the Gary R. Herbert Institute for Public Policy to support its statutory responsibilities. This partnership includes co-hosting data governance workshops and summits, as well as conducting academic research that informs whitepapers used by ODP. Find out more on our Tools and Resources webpage.

The 2025 Data Privacy Awareness Training will be a short 8 minute video. This should be viewed by all employees of a governmental entity who: Training shall be completed: Links for local governments to access the statewide Data Privacy Awareness Training have been added to the Tools and Resources page. This includes download files for MP4, MOV, and a Transcript

Workshop Details This workshop provides a practical introduction to conducting Privacy Impact Assessments (PIAs) for government entities. You’ll learn how to use the PIA as a tool to identify privacy risks, determine the impact on individuals, and outline safeguards to reduce those risks. The content aligns with Utah’s Privacy Program Framework and supports compliance with GDPA, GRAMA, and DARS. The

We have updated the icons for our Privacy Program Links and added a placeholder for the upcoming Privacy Program Report (Coming Soon).

The Complainant in this matter was concerned that the contact form on the governmentalentity’s website did not include a privacy notice as required by the Government Data PrivacyAct (GDPA). Subsection 63A-19-402(1) requires a governmental entity to provide a privacynotice to an individual “from whom the governmental entity requests or collects personal data”.The Complainant also pointed out that to file a

The Complainant in this matter was concerned that their photo was released by aschool employee in August 2020 without complying with the requirements in the GovernmentRecords Access and Management Act (GRAMA). Subsection 63G-2-204(1)(a) provides that aperson seeking to obtain a record in the possession of a governmental entity must submit awritten request to the governmental entity containing the person’s name,

Under Utah law (Utah Code § 63A-19-402.5), government agencies have to let you—or your legal guardian— know when they’re asking for or collecting your personal information. We have posted a template that contains a format for simple processing and another for more complex processing. This template can be found under Tool and Resources.

The Complainant in this matter expressed concerns regarding the use of automatic licenseplate reader systems (ALPR) by two law enforcement agencies (LEAs). The Complainant wasalso concerned with the LEAs’ use, sharing, and retention of the license plate data (Data)obtained from these ALPRs. Specifically, the Complainant was worried that the LEAs mayretain Data, either in databases that are currently in use