DSAR Requirements in Utah (UCPA)

Consumer Rights That Trigger DSARs

Utah consumers can submit requests to:

• Access all personal data you hold about them
• Delete personal data you provided directly
• Port their data in a portable, machine-readable format
• Opt out of the sale of personal data
• Opt out of targeted advertising

Note: Utah does not grant a right to correction or a right to opt out of profiling — making it one of the narrower state privacy laws for DSAR purposes.

Response Deadline

45 days from receipt. You can extend by an additional 45 days if reasonably necessary — but you must notify the consumer of the extension and the reason.

Identity Verification

Required before fulfilling any request. The UCPA does not prescribe a specific verification method.

Appeal Process

Utah does not require a formal appeal process — making it the most business-friendly state privacy law.

Penalties

• $7,500 per violation
• Permanent 30-day cure period (no sunset provision — this is permanent, unlike most states)
• No private right of action — only the Attorney General can enforce

Enforced by the Utah Attorney General and the Division of Consumer Protection.

DSAR-Specific Exemptions

You may decline or limit a request when the data is needed to:

• Comply with a legal obligation
• Detect security incidents or protect against fraud
• Complete a transaction the consumer requested

Sensitive data requires opt-in consent before processing.

Who This Applies To

Businesses meeting both: $25M+ annual revenue and (100K+ Utah consumers or 25K+ consumers with 50%+ revenue from data sales). This is the most restrictive dual threshold among state privacy laws.

For the full Utah privacy law guide, see boringgovernance.com.

Related Guides

• How to Respond to a DSAR — response process
• DSAR Response Deadlines — all deadlines
• DSAR Identity Verification — verification methods
• DSAR Exemptions — when you can refuse