Governance, risk & compliance
Utah Consumer Privacy Act (UCPA) Utah Code 13-61-101 to 13-61-404 (2022)
The Utah Consumer Privacy Act (Utah Code 13-61-101 to 13-61-404), effective 31 December 2023.
It applies to a controller or processor that does business in Utah or targets its residents, has annual revenue of at least $25,000,000 and handles the data of 100,000 consumers (or 25,000 consumers while earning more than 50% of gross revenue from sale). Government, tribes, higher education, nonprofit corporations, HIPAA covered entities and GLBA financial institutions are exempt.
It is the lightest of the state laws: consumers can access, delete the data they provided, get a portable copy, correct (from 1 July 2026), and opt out of targeted advertising and sale, but not profiling; sensitive data needs notice and a chance to opt out rather than consent; there is no data protection assessment, no universal opt-out signal and no appeal process in the text read. Controllers still owe a privacy notice, security, no discrimination and processor contracts.
The Attorney General alone enforces after a 30-day cure with no end date; penalties reach $7,500 per violation plus actual damages; there is no private action. Not verified: (1) The Act has no data protection assessment duty, no universal opt-out signal, no appeal process and no teen rule in the text read; rows that recommend those are marked recommended, not required.
(2) The 1 January 2027 version (2026 c. 193) adds motor vehicle manufacturers and in-vehicle privacy controls (model year 2030 and later); only noted, not mapped in detail.
(3) The Utah Code chapter URL was built from the standard Code address; the section pages were read through the version links. General information for compliance work, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses Utah Consumer Privacy Act (UCPA) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Controller | A person that, alone or jointly with others, determines the purpose and means of processing personal data and meets the applicability test in 13-61-102 ($25M revenue and 100,000 consumers (or 25,000 with more than 50% of revenue from sale)). Carries the notice, consumer rights, consent, security and enforcement duties. | — |
| Processor | A person that processes personal data on behalf of a controller (13-61-301). Must follow the controller’s instructions, help with consumer requests and security, bind its people and subcontractors, and delete or return data at the end of the service. A processor that decides purposes and means is treated as a controller. | — |
How Lavawall® helps you get to Utah Consumer Privacy Act (UCPA) compliance
Most of Utah Consumer Privacy Act (UCPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Utah Consumer Privacy Act (UCPA), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Utah Consumer Privacy Act (UCPA) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports Utah Consumer Privacy Act (UCPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- Utah Consumer Privacy Act (UCPA) Utah Code 13-61-101 to 13-61-404 (2022)
- Category
- Privacy
- Region
- USA - Utah
- Levels
- 2 assessment tiers
All Utah, United States frameworks and training →
Map this framework freeTalk to our team