1. (1) A consumer has the right to:

   1. (a) confirm whether a controller is processing the consumer's personal data; and
   2. (b) access the consumer's personal data.
2. (2) A consumer has the right to delete the consumer's personal data that the consumer provided to the controller.

3. (3) A consumer has the right to obtain a copy of the consumer's personal data, that the consumer previously provided to the controller, in a format that:

   1. (a) to the extent technically feasible, is portable;
   2. (b) to the extent practicable, is readily usable; and
   3. (c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.
4. (4) A consumer has the right to request that a controller correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data.

5. (5) A consumer has the right to opt out of the processing of the consumer's personal data for purposes of:

   1. (a) targeted advertising; or
   2. (b) the sale of personal data.
6. (6) Nothing in this section requires a person to cause a breach of security system as defined in Section 13-44-102.

Amended by Chapter 468, 2025 General Session