Newsroom

An updated version of the Privacy Program Framework is now available. Key changes include: You can access the updated framework, along with the individual pages for each privacy practice, on the Tools & Resources webpage.

Workshop Details This workshop walks participants through the annual requirement for governmental entities to submit a privacy program report by December 31. We’ll cover what the report must include, why it’s important, and how to use the ODP-provided template to make the process easier. Key takeaways: See more events and add this workshop to your calendar.

A new micro-training is available for Record and Data Sharing or Selling. You can access that training on the practice webpage.

Template 1 – Contracts that Involve Personal Data Utah Code § 63G-2-206(6) provides requirements and restrictions under which an entity may disclose records that contain personal data with contractors and private providers. Utah Code § 63A-19-401(4) includes new requirements for contractors who enter into or renew a contract to process personal data on behalf of a governmental entity. After May

The [Clarifying Roles] handout outlines the core responsibilities of data privacy, records management, and cybersecurity within governmental entities. It can be a valuable tool for advocating resource allocation by showing decision-makers the staffing, training, and technology needed to meet compliance obligations and reduce organizational risk. The information in this document is provided as a resource to assist governmental entities and

Workshop Details This interactive session is designed for governmental employees specializing in data privacy and records management. Participants will learn the legal requirements and best practices for sharing and disclosing personal data under Utah law. The workshop covers: – Legal authority for sharing records, including provisions under GRAMA and other state and federal laws. – Distinctions between internal or external

We are rolling out a new workshop titled: Individual’s Data Privacy Interests and Obligations of Governmental Entities Workshop DetailsThis workshop will discuss individuals’ fundamental interest in and inherent expectation of privacy regarding personal data that individuals provide to a governmental entity. It will also review the data privacy requirements for governmental entities found in the Government Data Privacy Act (GDPA),

Governmental entities are required to provide notice to an individual or the legal guardian of an individual, if the individual’s personal data is affected by a data breach in accordance with Utah Code § 63A-19-406. We have posted a Breach Notification Template to help guide you in these situations. Learn more about this privacy practice.

The Utah Office of Data Privacy has prepared a US State Data Governance Law Tracker that compares privacy laws across all 50 states. The tracker highlights comprehensive governance requirements in areas such as:

The Privacy Program Report Template has been updated based on feedback received. Word and PDF versions are available under Privacy Program Links on the Tools and Resources webpage.

A new micro-training is available for Privacy Notice – Notice to Provider of Information. You can access that training on the practice webpage.

The slide deck used in the virtual workshop titled Privacy Program Overview has been added to the Privacy for Governmental Entities webpage. You can download a static copy of those slides here.

Workshop Details If you are responsible for a government website, it’s important to understand how your site collects, tracks, and shares personal information. Under Utah’s Government Data Privacy Act (GDPA), public websites must now clearly explain these practices to visitors. This free workshop will focus on privacy notices and how to scan your website to identify and disclose tools like cookies or

The Complainant in this matter was concerned that the governmental entity’s application foremployment requires an applicant to provide their Social Security Number (SS#). TheGovernment Data Privacy Act (GDPA) requires government entities to only “obtain and processonly the minimum amount of personal data reasonably necessary to efficiently achieve aspecified purpose”. See Utah Code § 63A-19-401(2)(a)(ii). Representatives from thegovernmental entity said they

The Complainant in this matter was concerned that the governmental entity sent out a survey,which requested or collected personal data, without a privacy notice. The Government DataPrivacy Act (GDPA) at Subsection 63A-19-402(1) requires a governmental entity to provide aprivacy notice to an individual “from whom the governmental entity requests or collectspersonal data”. Representatives from the governmental entity indicated that they

The Practice 9 Inventorying page has two new updates:

The authority links have been updated for privacy practices 1-21. Go to the Tools and Resources page and click on the individual practices to learn more.

The slide deck used in the virtual workshop titled Chief Administrative Officer has been added to Practice 1. You can download a static copy of those slides here.

An updated SCORM file has been added for the 2025 Privacy Awareness Training. The video has been added to the Department of Government Operations YouTube channel and can be streamed from the Practice 8 webpage.  State Agencies: A copy of the 2025 Privacy Awareness Training has been added to KnowBe4. Please contact your KnowBe4 administrator to have them initiate a training campaign. The course can be

A preliminary DRAFT of the Privacy Program Report Template has been added to the Privacy Program Links under Tools and Resources. Note: This version has not yet been finalized by the Utah Office of Data Privacy. It is provided for review and comment purposes only. The Office welcomes and encourages public and stakeholder feedback to inform the finalization of this