Newsroom

The Privacy Impact Assessment (PIA) has been updated. There are two notable changes: Access the PIA on Privacy for Government or Tools & Resources under Privacy Program Links.

New micro-trainings are available in Tools & Resources for:

We have added a new icon to our Privacy Program Links for ‘Privacy Awareness Training‘ Privacy Awareness Training links previously located under Tools & Resources are now available in Practice #8 – Statewide Privacy Awareness Training

An updated SCORM file has been added for the Privacy Awareness Training. The new file includes: Downloadable links can be found on the Practice 8 webpage

We’ve implemented an automated response for individuals who join the Utah Office of Data Privacy mailing list. Additionally, instructions for unsubscribing have been included in our Notice of Collection. Both the mailing list information and the Notice of Collection are available at the bottom of our homepage.

The Utah Office of Data Privacy has formally partnered with the Gary R. Herbert Institute for Public Policy to support its statutory responsibilities. This partnership includes co-hosting data governance workshops and summits, as well as conducting academic research that informs whitepapers used by ODP. Find out more on our Tools and Resources webpage.

The 2025 Data Privacy Awareness Training will be a short 8 minute video. This should be viewed by all employees of a governmental entity who: Training shall be completed: Links for local governments to access the statewide Data Privacy Awareness Training have been added to the Tools and Resources page. This includes download files for MP4, MOV, and a Transcript

Workshop Details This workshop provides a practical introduction to conducting Privacy Impact Assessments (PIAs) for government entities. You’ll learn how to use the PIA as a tool to identify privacy risks, determine the impact on individuals, and outline safeguards to reduce those risks. The content aligns with Utah’s Privacy Program Framework and supports compliance with GDPA, GRAMA, and DARS. The

We have updated the icons for our Privacy Program Links and added a placeholder for the upcoming Privacy Program Report (Coming Soon).

The Complainant in this matter was concerned that the contact form on the governmentalentity’s website did not include a privacy notice as required by the Government Data PrivacyAct (GDPA). Subsection 63A-19-402(1) requires a governmental entity to provide a privacynotice to an individual “from whom the governmental entity requests or collects personal data”.The Complainant also pointed out that to file a

The Complainant in this matter was concerned that their photo was released by aschool employee in August 2020 without complying with the requirements in the GovernmentRecords Access and Management Act (GRAMA). Subsection 63G-2-204(1)(a) provides that aperson seeking to obtain a record in the possession of a governmental entity must submit awritten request to the governmental entity containing the person’s name,

Under Utah law (Utah Code § 63A-19-402.5), government agencies have to let you—or your legal guardian— know when they’re asking for or collecting your personal information. We have posted a template that contains a format for simple processing and another for more complex processing. This template can be found under Tool and Resources.

The Complainant in this matter expressed concerns regarding the use of automatic licenseplate reader systems (ALPR) by two law enforcement agencies (LEAs). The Complainant wasalso concerned with the LEAs’ use, sharing, and retention of the license plate data (Data)obtained from these ALPRs. Specifically, the Complainant was worried that the LEAs mayretain Data, either in databases that are currently in use

The Complainant in this matter was concerned with the amount of personal data contained on their private investigator identification card. The personal data displayed on the identification card includes: The Complainant believed this was an issue given that a licensee may face discipline for refusing to display the identification card to any person having reasonable cause to verify the validity

Stay in the Loop with the Utah Office of Data PrivacySubscribe to our mailing list and get notified by email whenever new content is published on privacy.utah.gov. Don’t miss out on updates, resources, and important announcements. You can find the mailing list at the bottom of the Home page.

This complaint was related to several issues, the first was regarding the Age Verification Program which requires establishments licensed by the governmental entity to verify an individual’s age before the individual can enter a bar or purchase alcohol. The Complainant was concerned that although the statute only requires a licensee to verify age if a patron appears to be 35

Under Utah law (Utah Code § 63A-19-402), government agencies have to let you—or your legal guardian—know when they’re asking for or collecting your personal information. We have posted a template that contains a format for simple processing and another for more complex processing. This template can be found under Tool and Resources.

New micro-trainings are available in Tools & Resources for Practice #7 Appointed Records Officer Training Practice #13 Minimum Data Necessary

In today’s digital government, data governance and privacy are no longer back-office functions — they are foundational to public trust, operational efficiency, and ethical service delivery. The Data Governance Summit brings together leaders from every level of government to align around a shared vision— protecting the privacy of Utahns while making data work better for them. Over a lifetime, individuals

The complaint in this matter was related to a request for records made pursuant to the Government Records Access and Management Act (GRAMA). The original request was submitted through the governmental entity’s online records request portal. In order to submit a request through this system, an individual must submit the information required by GRAMA in Subsection 63G-2-204(1)(a). This includes the