Skip to content

Cyber Liability by state

Utah data breach notification law and cyber insurance

Direct answer

What is Utah's data breach notification law?

Utah's breach notification law (Utah Code sect. 13-44-101 et seq.) requires businesses to notify affected residents in the most expedient time possible and without unreasonable delay after a breach of personal information. Cyber liability insurance generally funds the forensics, notification, and legal review behind that analysis.

Reviewed by Cornerstone Staff28 years of financial services state licensing experienceLast verified July 29, 2026

What the statute requires

Utah requires businesses to notify affected residents of breaches of unencrypted personal information without unreasonable delay once misuse becomes reasonably likely, with notice to the Attorney General and the Utah Cyber Center when 500 or more residents are affected. Cyber liability insurance generally funds the forensics, notification, and legal review behind that analysis.

Consumer notification deadline
In the most expedient time possible and without unreasonable delay
Regulator notice
Notify the Utah Attorney General and the Utah Cyber Center when a breach affects 500 or more Utah residents.
Credit bureau notice
Notify nationwide consumer reporting agencies when a breach affects 1,000 or more Utah residents.
Safe harbor
Notification is not required if the compromised data was encrypted, or where an investigation finds misuse of the information has not occurred and is not reasonably likely to occur.
Enforcement
Violations are enforceable by the Attorney General, who may seek civil penalties subject to a statutory per-breach cap.

Statutes and sources

  • Utah Protection of Personal Information Act

    Utah Code sect. 13-44-101 et seq.

Regulator: Utah Attorney General . Last verified 2026-07-29 from the official source .

Get Utah coverage handled

Share a few details and an agent will respond within one business day.