1. (1)

   1. (a) Except as provided in Subsections (1)(b) and (c), a governmental entity shall comply with the requirements of this part.
   2. (b) If a more specific or more restrictive law governs the treatment of a type of personal data, the more specific or more restrictive law shall control.
   3. (c) A governmental entity that is exempt under Section 63G-2-702, 63G-2-703, or 63G-2-704 from complying with the requirements in Title 63G, Chapter 2, Part 6, Collection of Information and Accuracy of Records, is exempt from complying with the requirements in this chapter.

2. (2)

   1. (a) A governmental entity shall:

      1. (i) initiate a data privacy program before December 31, 2025;
      2. (ii) obtain and process only the minimum amount of personal data reasonably necessary to efficiently achieve a specified purpose;
      3. (iii) meet the requirements of this part for all new processing activities implemented by a governmental entity; and

      4. (iv) for any processing activity implemented before May 7, 2025, as soon as is reasonably practicable, but no later than July 1, 2027:

         1. (A) identify any non-compliant processing activity;
         2. (B) prepare a strategy for bringing the non-compliant processing activity into compliance with this part; and
         3. (C) include the information described in Subsections (2)(a)(iv)(A) and (B) in the privacy program report described in Section 63A-19-401.3.
   2. (b) A governmental entity that fulfills the reporting requirement under Section 63A-19-401.3 satisfies the requirement to initiate a privacy program under Subsection (2)(a)(i).

3. (3) A governmental entity may not:

   1. (a) establish, maintain, or use undisclosed or covert surveillance of individuals unless permitted by law;
   2. (b) sell personal data unless expressly required by law; and
   3. (c) share personal data unless permitted by law.

Amended by Chapter 202, 2026 General Session