ShareAndGoShareAndGo

Data breach notification

Utah data breach notification law

Utah's Protection of Personal Information Act puts its definitions in Utah Code § 13-44-102 and the breach duty in § 13-44-202.

Investigate first

Utah starts with an investigation. The notice duty follows only "If an investigation under Subsection (1)(a) reveals that the misuse of personal information for identity theft or fraud purposes has occurred, or is reasonably likely to occur."

The text we checked describes that investigation as reasonable and prompt. Where it finds misuse neither happened nor is reasonably likely, no notice is owed.

When notice is owed, it goes out "in the most expedient time possible without unreasonable delay". Utah sets no day count.

Two state bodies at 500 residents

If misuse relating to 500 or more Utah residents has occurred or is reasonably likely, the business must also notify "(i) the Office of the Attorney General; and (ii) the Utah Cyber Center".

That is on top of the notice to residents, as the statute's "in addition to the notification required in Subsection (1)(b)" makes clear.

Personal information in Utah

The definition is a person's first name or first initial and last name, combined with one or more data elements, "when either the name or date element is unencrypted or not protected by another method that renders the data unreadable or unusable."

The data elements are a Social Security number; a financial account or card number with any required code or password; and a driver license or state identification number.

Because the definition reaches data that is unencrypted or unprotected, data rendered unreadable or unusable falls outside it.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

In Salt Lake City and Provo, finance teams sharing card statements or license copies with auditors can keep them in a room where each group sees only its own folders.

The watermark is a per-room setting, on by default. Auditors confirm a six-digit code sent to their email and need no account, and the chained log exports as CSV when someone needs the list of readers and dates.

Utah questions answered

Does Utah set a number of days?
No. Notice goes out in the most expedient time possible without unreasonable delay.
Who besides residents is told?
The Office of the Attorney General and the Utah Cyber Center, where 500 or more Utah residents are involved.
Is notice automatic after any breach?
No. It follows when an investigation reveals misuse for identity theft or fraud has occurred or is reasonably likely.
Which data elements does Utah list?
A Social Security number, a financial account or card number with any required code or password, and a driver license or state identification number, each combined with a name.
Does data protected another way still count?
Not if the method renders the data unreadable or unusable; the definition covers data that is unencrypted or not so protected.

Page details

Checked against Utah's published law on November 2, 2026. This is general information, not legal advice.

Keep reading

Breach notification laws by state

The breach law list for all jurisdictions.

ShareAndGo vs DataRooms.com

ShareAndGo vs DataRooms.com.

ShareAndGo home

ShareAndGo home.