1. (1) An individual who makes a data privacy complaint shall first submit the complaint to the chief administrative officer of the governmental entity that is the subject of the complaint.
2. (2) Upon receipt of a data privacy complaint under Subsection (1), the chief administrative officer shall attempt to resolve the complaint with the individual.
3. (3) If the chief administrative officer is unable to resolve a data privacy complaint with the individual under Subsection (2), the individual or the governmental entity may request mediation with the ombudsperson in accordance with Section 63A-19-501.

4. (4) If an individual submits a data privacy complaint directly to the ombudsperson, the ombudsperson shall:

   1. (a) notify the individual and the governmental entity that the complaint will be referred to the chief administrative officer of the governmental entity; and
   2. (b) refer the complaint to the chief administrative officer.

5. (5) This section does not apply to a complaint about data privacy that is within the authority of:

   1. (a) the Government Records Office created in Section 63A-12-202; or
   2. (b) the government records ombudsman established in Section 63A-12-204.
6. (6) An employee of a governmental entity may submit a confidential and anonymous data privacy complaint directly to the attorney general.
7. (7) An employee of a governmental entity who submits a complaint under Subsection (6) is entitled to the protections described in Title 67, Chapter 21, Utah Protection of Public Employees Act.

Enacted by Chapter 202, 2026 General Session