Utah UCPA

Utah Consumer Privacy Act - consumer rights, opt-out, controller duties.


Short name	UT UCPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers UT UCPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for UT UCPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for UT UCPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`UT-UCPA-302-SEC` Reasonable and Appropriate Safeguards	Controllers must establish and maintain reasonable administrative, technical and physical safeguards designed to protect the confidentiality and integrity of personal data; integrity evidence for the processing software supports that duty (Utah Code § 13-61-302 controller security duty)	Scan
`UT-UCPA-INV` Processing System Accountability	Safeguards must be appropriate to the amount and nature of the data processed, which presumes the controller can enumerate the software systems that store or process consumer data (Utah Code § 13-61-302 controller security duty)	Scan
`UT-UCPA-301-PROC` Processor Contract Duties	Processors must process personal data only under a contract setting out instructions, duration and duties, and must assist controllers in meeting their obligations; the vendor behind each processing component should therefore be identified (Utah Code ch. 13-61 processor provisions)	Scan
`UT-UCPA-201-RIGHTS` Consumer Rights Response Readiness	Consumers may access and delete personal data, obtain a portable copy, and opt out of targeted advertising and sale; locating a consumer's data requires the processing components to be unambiguously identifiable (Utah Code § 13-61-201)	Scan
`UT-UCPA-BREACH` Breach Impact Assessment Readiness	Utah's security-breach notification regime obliges organisations to determine scope and affected systems quickly after an incident; recorded component versions make that impact analysis possible (Utah Code § 13-44-202 breach notification, read with UCPA safeguards)	Scan
`UT-UCPA-NOTICE` Privacy Notice Documentation	Controllers must provide consumers a reasonably accessible and clear privacy notice describing categories processed, purposes and sharing; supporting documentation should carry document identity and a creation timestamp (Utah Code ch. 13-61 transparency provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`UCA-13-61-202`	Consumer Rights: Access & Portability
`UCA-13-61-203`	Consumer Right to Delete
`UCA-13-61-201`	Opt-Out of Sale & Targeted Advertising
`UCA-13-61-204`	Sensitive Data Opt-Out
`UCA-13-61-301`	Privacy Notice Disclosure
`UCA-13-61-302`	Processor Agreements
`UCA-13-61-303`	Security & Data Minimization
`UCA-13-61-101`	Children's Data: COPPA Alignment

Policy templates

Written for UT UCPA:

Utah UCPA State Privacy Notice
Utah UCPA Consumer Rights Request Handling Procedure

And 22 from the standard set, adapted to UT UCPA.