DPO SchoolDPO School

Utah Consumer Privacy Act

Utah privacy law (UCPA): processors

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Processors must follow the controller's instructions and help it meet its duties, including security and breach notice. Before processing, the parties must sign a contract setting out instructions, nature and purpose, data types, duration and rights and obligations. The contract must require confidentiality and written flow-down to subcontractors; Utah does not require deletion or return, audit or assessment terms.

Key points

  1. Processor follows instructions and assists with security and breach notification.

    Section: § 13-61-301(1)

  2. Contract before processing: instructions, nature and purpose, data types, duration, rights and obligations.

    Section: § 13-61-301(2)(a)

  3. Contract must require confidentiality for each person processing the data.

    Section: § 13-61-301(2)(b)

  4. Contract must require subcontractors to be bound by a written contract with the same obligations.

    Section: § 13-61-301(2)(c)

  5. Controller or processor status is fact-based.

    Section: § 13-61-301(3)

Sources

Compare processors across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Utah statute

Reference material, not legal advice.