Policy+ComplianceP+C
Get help →
Home›Obligations›United States›By state›Utah

Obligations  United States  Utah

What a Utah business has to have in writing

Utah pairs a light employment-policy load with an unusually developed data-security layer: the Protection of Personal Information Act makes every business keep reasonable safeguards and a destruction routine, the Cybersecurity Affirmative Defense Act rewards a written cybersecurity program with a litigation defense, and the Utah Consumer Privacy Act adds a privacy notice and sensitive-data opt-out for large data handlers.

UOSH runs a full state OSHA plan whose reporting clock is stricter than the federal one, requiring an 8-hour report for any fatality, disabling or serious injury, or occupational disease. Employers that drug test must publish a written testing policy, and Utah requires a food handler permit for every food employee, not just a manager.

Headcount

Industry  General is always on

Share
Sponsored
Policy  Acknowledgment  Proof
UtahHandbook 2026acknowledged by name
Utah on Recordwith AllyMatter
Cover Utah the Modern WayEvery policy Utah makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Utah on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
See how it works →Pricing →

What applies

Utah rules for a 15–19 person general business

State law only. The federal layer every employer carries sits on the business-type pages below. Each row names what you must write, post, file or certify, who enforces it, and links to the state authority.

Breach Notification 1Who you must tell after a data breach, and how fast

LawProduceWhat it requiresTriggerEnforced by
Protection of Personal Information Act - breach notificationAI-compiledUtah Code § 13-44-202Any person who owns or licenses computerized data containing personal information about a Utah residentDistribute
Notice
Investigate promptly and in good faith whether personal information has been or is likely to be misused. If it has, notify each affected Utah resident without unreasonable delay by mail, email, telephone or, where that is not feasible, publication. At 500 or more affected residents also notify the Utah Attorney General and the Utah Cyber Center; at 1,000 or more also notify the nationwide consumer reporting agencies.
From the first employee
Utah Attorney General; Utah Cyber Center receives the reports
AuthorityUtah State Legislature - Utah Code § 13-44-202Utah Cyber Center - Home (breach reporting duties)

Data Security Program 2A written safeguards program the state requires before anything goes wrong

LawProduceWhat it requiresTriggerEnforced by
Protection of Personal Information Act - safeguards and records destructionAI-compiledUtah Code § 13-44-201Any person who conducts business in Utah and maintains personal informationWrite
Written program
Put reasonable procedures in place to prevent unlawful use or disclosure of personal information collected in the ordinary course of business, and to destroy records containing personal information that are not being kept, by shredding, erasing or otherwise making the information indecipherable.
From the first employee
Utah Attorney General; Utah Division of Consumer Protection
AuthorityUtah State Legislature - Utah Code § 13-44-201Utah State Legislature - Utah Code chapter 13-44, Protection of Personal Information Act
Cybersecurity Affirmative Defense ActAI-compiledUtah Code §§ 78B-4-701 to 78B-4-705Any person that holds personal information and wants the statutory defense; the written program is voluntary, the benefit is a defense to breach claimsWrite
Written program
Create, maintain and actually follow a written cybersecurity program with administrative, technical and physical safeguards scaled to the business, including written protocols for responding to a breach and for notifying affected individuals. Doing so is an affirmative defense to Utah claims that the business failed to use reasonable security controls, failed to respond to a breach, or failed to notify.
From the first employee
Utah courts (defense raised in private litigation)
AuthorityUtah State Legislature - Utah Code § 78B-4-702Utah State Legislature - Part 7, Cybersecurity Affirmative Defense Act

Consumer Privacy Law 1Rights, notices and assessments for consumer data

LawProduceWhat it requiresTriggerEnforced by
Utah Consumer Privacy Act (UCPA)AI-compiledUtah Code title 13, chapter 61Controllers and processors doing business in Utah or targeting Utah residents with annual revenue of $25 million or more that either control or process personal data of 100,000+ consumers in a year, or derive over 50% of gross revenue from selling personal data and control or process data of 25,000+ consumersWrite
Written policy
Publish a clear, reasonably accessible privacy notice covering the categories of personal data processed, the purposes, how consumers exercise their rights, and the categories of data shared with third parties and the categories of those third parties. Keep reasonable administrative, technical and physical data security practices. Give clear notice and an opt-out before processing sensitive data, disclose data sales and targeted advertising with an opt-out, and answer consumer requests within 45 days.
From the first employee
Utah Attorney General (exclusive) on referral from the Division of Consumer Protection; 30-day written notice and cure period
AuthorityUtah Division of Consumer Protection - Utah Consumer Privacy ActUtah State Legislature - Utah Code § 13-61-402 (enforcement and cure)Utah State Legislature - Utah Code chapter 13-61

Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA

LawProduceWhat it requiresTriggerEnforced by
Utah Occupational Safety and Health Act (UOSH State Plan)AI-compiledUtah Code title 34A, chapter 6; Utah Admin. Code R614-1Every private-sector and state and local government employer covered by the Utah OSH ActWrite
Written program
Report any work-related fatality, any disabling, serious or significant injury and any occupational disease incident to UOSH within 8 hours, which is broader than the federal rule, and leave the scene undisturbed until UOSH clears it. Investigate every work-related injury and occupational disease. Keep the federal 29 CFR 1904 injury and illness records. Post a conspicuous emergency contact list (supervisor, doctor, hospital, ambulance, fire, police). Utah does not impose a general written safety program, but individual adopted standards such as hazard communication and lockout/tagout do.
From the first employee
Utah Occupational Safety and Health Division, Utah Labor Commission
AuthorityUtah Labor Commission - UOSH ComplianceUtah Office of Administrative Rules - R614-1, General ProvisionsOSHA - State Plans

Insurance Data Security 1The written security program insurance licensees must certify

LawProduceWhat it requiresTriggerEnforced by
Standards for Safeguarding Customer Information (insurance licensees)AI-compiledUtah Admin. Code R590-216, under Utah Code §§ 31A-2-201 and 31A-23a-417Any Utah Insurance Department licensee that obtains nonpublic personal financial or health information from a customer; purchasing groups and certain warranty and excess-line providers are excludedWrite
Written program
Maintain a comprehensive written information security program with administrative, technical and physical safeguards sized to the licensee's operations, aimed at keeping customer information confidential, protecting against anticipated threats and preventing harmful unauthorized access. The rule sets out risk assessment, staff training, control testing, service-provider due diligence and periodic program adjustment as the expected methods. Utah has not adopted the NAIC insurance data security model, so there is no annual certification filing.
From the first employee
Utah Insurance Department
AuthorityUtah Office of Administrative Rules - R590-216, Standards for Safeguarding Customer InformationUtah Insurance Department - Information for Licensees

Required Postings 1The notices every workplace in the state must display

LawProduceWhat it requiresTriggerEnforced by
Required state workplace postersAI-compiledUtah Code title 34A, chapters 2 and 6; Utah Admin. Code R614-1-6(B)Every Utah employerPost
Posting
Display the Utah Occupational Safety and Health poster and the Workers' Compensation notice continuously in a public, conspicuous place at the workplace, or at the location where employees report each day if the work is physically dispersed. The Labor Commission treats these two as the state-required set and supplies both free, flagging that federal and industry posters may also apply.
From the first employee
Utah Labor Commission
AuthorityUtah Labor Commission - Utah Occupational Safety and Health PosterUtah Labor Commission - Workers' Compensation PosterUtah Labor Commission - UOSH poster (PDF)

Licensing and Certifications 3Registrations, licences and certifications a business or its staff must hold

LawProduceWhat it requiresTriggerEnforced by
Business entity registration and annual renewalAI-compiledUtah Code title 16 (corporations and LLCs); title 42 (assumed names)Any corporation, LLC, partnership, nonprofit or DBA operating in UtahFile
Filing / record
File formation or foreign registration documents with the Division of Corporations and Commercial Code, name a registered agent, and file the annual renewal on the entity's registration anniversary to stay active. Assumed business names and trademarks are filed with the same division.
From the first employee
Utah Department of Commerce, Division of Corporations and Commercial Code
AuthorityUtah Division of Corporations and Commercial Code - Business EntitiesUtah Division of Corporations and Commercial Code - Renewal Process
Construction Trades Licensing Act (contractor licensing)AI-compiledUtah Code title 58, chapter 55; Utah Admin. Code R156-55aGeneral contractors and specialty contractors performing construction work in UtahFile
Filing / record
Hold a DOPL contracting license before doing the work, name a qualifier who has passed the required exams and exercises real authority over the business, register the entity with the Division of Corporations, and file proof of general liability insurance (commonly $1 million per occurrence and $2 million aggregate, with DOPL as certificate holder). Renew every two years with 6 hours of approved continuing education and current liability and workers' compensation certificates or waivers.
From the first employee
Utah Department of Commerce, Division of Professional Licensing (DOPL)
AuthorityUtah Division of Professional Licensing - ContractingUtah Division of Professional Licensing - Apply for a Contracting LicenseUtah Division of Professional Licensing - Contracting Laws and Rules
Food handler permit and food safety manager certificationAI-compiledUtah Code § 26B-7-413; Utah Admin. Code R392-103Every food employee working in a food service establishment, plus the establishment's designated food safety manager; limited exemptions for prepackaged-only and non-TCS operationsCertify
Certification
Every food handler completes an approved training program and holds a valid food handler permit issued by the local health department, valid three years, before working with food. The establishment also maintains a certified food safety manager. Permits and manager certificates must be available for inspection.
From the first employee
Utah Department of Health and Human Services and local health departments; Utah Department of Agriculture and Food for retail food establishments
AuthorityUtah Office of Administrative Rules - R392-103, Food Handler Training and CertificateUtah State Legislature - Utah Code § 26B-7-413Utah DHHS - Food Handler Training Providers

Other Written Policies 3Any other document the state makes an employer write or hand out

LawProduceWhat it requiresTriggerEnforced by
Drug and Alcohol Testing Act (written testing policy)AI-compiledUtah Code §§ 34-38-1 to 34-38-16, in particular § 34-38-7Any employer that tests employees or applicants for drugs or alcohol; testing is voluntary but the written policy is mandatory once an employer testsWrite + ack
Written policy
Carry out every test within the terms of a written testing policy that has already been distributed to employees and is available for prospective employees to review. The policy sets the permitted purposes, which the statute limits to investigating suspected impairment, investigating workplace accidents or theft, maintaining safety, and maintaining productivity, quality or security. Sample collection, testing and use of results must follow the statute's procedural sections.
From the first employee
Private civil action; the written policy is the condition for the statute's employer protections
AuthorityUtah State Legislature - Utah Code § 34-38-7Utah State Legislature - Utah Code chapter 34-38, Drug and Alcohol Testing
Internet Employment Privacy ActAI-compiledUtah Code §§ 34-48-101 to 34-48-301Every Utah employerWrite
Written policy
Do not ask an employee or applicant for the username and password to a personal internet account, and do not refuse to hire, discipline or otherwise penalize anyone who declines. Hiring and social-media screening procedures have to be written so recruiters never request account credentials.
From the first employee
Private civil action; Utah Labor Commission
AuthorityUtah State Legislature - Utah Code § 34-48-201Utah State Legislature - Utah Code chapter 34-48, Internet Employment Privacy Act
Employment Selection Procedures ActAI-compiledUtah Code §§ 34-46-101 to 34-46-301Utah employers using job applications and pre-offer screeningWrite
Written policy
Keep Social Security number, date of birth and driver license number off the job application and out of pre-offer screening, unless one of the statute's narrow exceptions applies. In practice this means rewriting application forms and applicant-tracking fields so those items are only collected after a conditional offer.
From the first employee
Utah Labor Commission, Antidiscrimination and Labor Division
AuthorityUtah State Legislature - Utah Code § 34-46-201Utah State Legislature - Utah Code chapter 34-46, Employment Selection Procedures Act

From the publisher

Keep Your Written Policies in One Place

Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.

See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff

Add the federal layer

Your business type, with Utah on top

Small businessFederal + industry, with Utah on topConstruction contractorsFederal + industry, with Utah on topHealthcare practicesFederal + industry, with Utah on topFood and beverage businessesFederal + industry, with Utah on topTax and accounting firmsFederal + industry, with Utah on topRegistered investment advisersFederal + industry, with Utah on topInsurance agenciesFederal + industry, with Utah on topRetail and e-commerceFederal + industry, with Utah on topTrucking and logistics carriersFederal + industry, with Utah on topNonprofitsFederal + industry, with Utah on topFederal contractorsFederal + industry, with Utah on top

Other states

The same index for another state

Alabama12Alaska12Arizona11Arkansas14California20Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine14Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13

Need a hand implementing it?

Find a Consultant Who Does This Work

Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.

Get help →Consultants: advertise here

Sources

Utah State Legislature - Utah Code § 13-44-202Utah Cyber Center - Home (breach reporting duties)Utah State Legislature - Utah Code § 13-44-201Utah State Legislature - Utah Code chapter 13-44, Protection of Personal Information ActUtah State Legislature - Utah Code § 78B-4-702Utah State Legislature - Part 7, Cybersecurity Affirmative Defense ActUtah Division of Consumer Protection - Utah Consumer Privacy ActUtah State Legislature - Utah Code § 13-61-402 (enforcement and cure)Utah State Legislature - Utah Code chapter 13-61Utah Office of Administrative Rules - R590-216, Standards for Safeguarding Customer InformationUtah Insurance Department - Information for LicenseesUtah Labor Commission - UOSH ComplianceUtah Office of Administrative Rules - R614-1, General ProvisionsOSHA - State PlansUtah Labor Commission - Utah Occupational Safety and Health PosterUtah Labor Commission - Workers' Compensation PosterUtah Labor Commission - UOSH poster (PDF)Utah State Legislature - Utah Code § 34-38-7Utah State Legislature - Utah Code chapter 34-38, Drug and Alcohol TestingUtah State Legislature - Utah Code § 34-48-201Utah State Legislature - Utah Code chapter 34-48, Internet Employment Privacy ActUtah State Legislature - Utah Code § 34-46-201Utah State Legislature - Utah Code chapter 34-46, Employment Selection Procedures ActUtah Division of Corporations and Commercial Code - Business EntitiesUtah Division of Corporations and Commercial Code - Renewal ProcessUtah Division of Professional Licensing - ContractingUtah Division of Professional Licensing - Apply for a Contracting LicenseUtah Division of Professional Licensing - Contracting Laws and RulesUtah Office of Administrative Rules - R392-103, Food Handler Training and CertificateUtah State Legislature - Utah Code § 26B-7-413Utah DHHS - Food Handler Training Providers

About this data

Pages on this site are compiled with AI from two or more linked sources, rewritten in our words, and reviewed by people in stages. Each record shows its stage and date. Nothing here is legal, audit or tax advice, and policyandcompliance.com accepts no responsibility for errors or for decisions made on it. Read the source, then decide.
How we compile and verify →

Think something is wrong?

corrections@policyandcompliance.com
Tell us the page and what you found. We check it against the source and fix it.
Corrections log →

Want to advertise here?

ads@policyandcompliance.com
A primary ad and a secondary placement, flat fee. Buying one changes nothing else on the page.