1. (1) Any person who conducts business in the state and maintains personal information shall implement and maintain reasonable procedures to:

   1. (a) prevent unlawful use or disclosure of personal information collected or maintained in the regular course of business; and
   2. (b) destroy, or arrange for the destruction of, records containing personal information that are not to be retained by the person.

2. (2) The destruction of records under Subsection (1)(b) shall be by:

   1. (a) shredding;
   2. (b) erasing; or
   3. (c) otherwise modifying the personal information to make the information indecipherable.

Amended by Chapter 348, 2019 General Session