1. (1)

   1. (a) Beginning July 1, 2027, a state agency shall make a complete and accurate privacy annotation for each record series containing personal data that the state agency collects, maintains, or uses.
   2. (b) After July 1, 2027, a state agency that has not completed a privacy annotation for a record series containing personal data, may not collect, maintain, or use the personal data in the record series.

2. (2) If a state agency determines that a record series:

   1. (a) does not contain personal data, the privacy annotation shall be limited to a statement indicating that the record series does not include personal data; or

   2. (b) contains personal data, the privacy annotation shall include:

      1. (i) an inventory of all types of personal data included in the record series;
      2. (ii) a description of all purposes for which the state agency collects, keeps, or uses the personal data;
      3. (iii) a citation to the state agency's legal authority for collecting, keeping, or using the personal data; and
      4. (iv) any other information required by the rules created by the office under Section 63A-19-301.

Amended by Chapter 202, 2026 General Session