Privacy Program Report

Summary

The CAO of a governmental entity must prepare a privacy program report each year by December 31st. This report must include all of the information described in Utah Code § 63A-19-401.3. The report is a protected record under Utah Code § 63G-2-305. A governmental entity must retain the report for no less than five years and share the report with the Office. By completing a privacy program report a governmental entity has satisfied the requirement to initiate a privacy program. 

The report must be shared with the Utah Office of Data Privacy on or before December 31 of each year and the governmental entity must retain the report for no less than five years. Instructions for sharing the report will be given later this year.