1. (1) There is created within the department the Utah Office of Data Privacy.
2. (2) The office shall coordinate with the governing board and the commission to perform the duties in this section.

3. (3) The office shall:

   1. (a) create and maintain a data privacy framework designed to:

      1. (i) assist governmental entities to identify and implement effective and efficient data privacy practices, tools, and systems that:

         1. (A) protect the privacy of personal data;
         2. (B) comply with data privacy laws and regulations specific to the governmental entity, program, or data;
         3. (C) empower individuals to protect and control their personal data; and
         4. (D) enable information use and sharing among governmental entities, as allowed by law; and
      2. (ii) account for differences in a governmental entity's resources, capabilities, populations served, data types, and maturity level regarding data privacy practices;

   2. (b) review statutory provisions related to governmental data privacy and records management to:

      1. (i) identify conflicts and gaps in data privacy law; and
      2. (ii) standardize language;

   3. (c) work with governmental entities to study, research, and identify:

      1. (i) additional data privacy practices that are feasible for governmental entities;
      2. (ii) potential remedies and accountability mechanisms for non-compliance of a governmental entity;
      3. (iii) ways to expand an individual's control over the individual's personal data processed by a governmental entity;
      4. (iv) resources needed to develop, implement, and improve data privacy programs; and

      5. (v) best practices regarding:

         1. (A) automated decision making;
         2. (B) the creation and use of synthetic, de-identified, or anonymized data; and
         3. (C) the use of website tracking technology;
   4. (d) monitor high-risk data processing activities within governmental entities;
   5. (e) coordinate with the Cyber Center to develop an incident response plan for data breaches affecting governmental entities;

   6. (f) coordinate with the state archivist to:

      1. (i) incorporate data privacy practices into records management; and
      2. (ii) include data privacy content in the trainings described in Section 63A-12-110; and
   7. (g) develop, maintain, and make available data privacy training, education, and awareness materials that meet the requirements of Section 63A-19-401.2.

4. (4) The office may:

   1. (a) provide expertise and assistance to governmental entities for high-risk data processing activities;

   2. (b) create assessment tools and resources that a governmental entity may use to:

      1. (i) review, evaluate, and mature the governmental entity's privacy program, practices, and processing activities; and
      2. (ii) evaluate the privacy impact, privacy risk, and privacy compliance of the governmental entity's privacy program, practices, and processing activities;
   3. (c) charge a governmental entity a service fee, established in accordance with Section 63J-1-504, for providing services that enable a governmental entity to perform the governmental entity's duties under Section 63A-19-401, if the governmental entity requests the office provide those services;
   4. (d) bill a state agency, as provided in Section 63J-1-410, for any services the office provides to a state agency;

   5. (e) provide funding to assist a governmental entity in complying with:

      1. (i) this chapter; and
      2. (ii) Title 63G, Chapter 2, Part 3, Classification, and Title 63G, Chapter 2, Part 6, Collection of Information and Accuracy of Records;
   6. (f) advise the governing board about widespread or systemic data privacy matters or alleged violations;
   7. (g) work with the Division of Purchasing and General Services to develop cooperative contracts that a governmental entity may choose to use to support the governmental entity's data privacy compliance;
   8. (h) make available to governmental entities privacy compliance assessment tools that may be used by governmental entities to assess the governmental entity's reasonable compliance of processing activities described in this chapter;

   9. (i) upon request of a governmental entity or on the office's own initiative, issue guidance or recommendations regarding:

      1. (i) compliance with this chapter; and
      2. (ii) best practices for data privacy and data governance;

   10. (j) contract with an institute, component, or department at a state institution of higher education to support the office in:

       1. (i) conducting research and prepare reports regarding data privacy and data governance;
       2. (ii) providing support to the commission;
       3. (iii) holding data governance summits and educational programs;
       4. (iv) developing systems and tools to support data privacy and data governance; and
       5. (v) providing other services in support of the office's duties under this chapter;
   11. (k) create data governance models that may be used by governmental entities; and
   12. (l) make rules in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, to administer this chapter.

5. (5)

   1. (a) Upon application by a governmental entity, the office may grant, for a limited period of time, a governmental entity with an:

      1. (i) extension of time to comply with certain requirements of Part 4, Duties of Governmental Entities; or
      2. (ii) exemption from complying with certain requirements of Part 4, Duties of Governmental Entities.
   2. (b) On the office's own initiative, the office may issue a one-time extension to a category or group of governmental entities to comply with certain requirements of Part 4, Duties of Governmental Entities.

   3. (c) An extension issued under Subsection (5)(b):

      1. (i) shall:

         1. (A) identify the specific duty for which the extension is granted and the section that imposes the duty; and
         2. (B) specify the category or group of governmental entities to which the extension applies; and
      2. (ii) may not be longer than 12 months.

   4. (d) An application for an extension or exemption submitted under Subsection (5)(a) shall:

      1. (i) identify the specific duty from which the governmental entity seeks an extension or exemption and the section that imposes that duty; and
      2. (ii) include a justification for the requested extension or exemption.

   5. (e) If the office grants an exemption under Subsection (5)(a), the office shall report at the next board meeting:

      1. (i) the name of the governmental entity that received an exemption; and
      2. (ii) the nature of the exemption.

Amended by Chapter 202, 2026 General Session