Privacy for Individuals

As a resident of Utah, you have certain rights regarding your personal data that is collected and processed by a governmental entity. Personal data includes any information that is linked to you or can be reasonably linked to you. The personal data you provide to a governmental entity may be subject to various privacy laws and regulations. Depending on the governmental entity and type of data, your data privacy rights may be governed by:

• Government Data Privacy Act (GDPA)
• Government Records Access and Management Act (GRAMA)
• Health Insurance Portability and Accountability Act (HIPAA)
• Family Educational Rights and Privacy Act (FERPA)
• Protection of Pupil Rights Amendment (PPRA)
• Student Privacy and Data Protection Act
• Higher Education Student Data Protection Act
• Payment Card Industry Data Security Standards (PCI DSS)
• Freedom of Information Act (FOIA)
• Privacy Act of 1974
• Drivers Privacy Protection Act (DPPA)

You have the right to request access to your personal data that is in the possession of a governmental entity.GRAMAopens in a new tab, opens in a new tab, opens in a new tab describes how you can access your records held by a governmental entity in the State of Utah. You may request access to your personal data by:

• submitting a formal request using a formopens in a new tab, opens in a new tab, opens in a new tab provided by Archives or the governmental entity; or
• emailing the governmental entity directly with your name, mailing address, daytime telephone number, and a description of the record requested that identifies the record with reasonable specificity.

Upon receipt, the governmental entity will review your request and either provide you with the records requested or issue you a denial. If your request is denied, the governmental entity will provide you with a written explanation of the reason for the denial. You have a right to appeal the denial and may submit a request to appeal to the chief administrative officer.

You have the right to request that your personal data be amended or corrected by a governmental entity under the GDPAopens in a new tab, opens in a new tab, opens in a new tab and GRAMAopens in a new tab, opens in a new tab, opens in a new tab . You may contest the accuracy or completeness of your personal records by contacting the governmental entity directly. If your request is approved, the governmental entity will update the governmental entity’s relevant records. If your request is denied, you may submit a written statement contesting the information in the record. This statement will then be attached to the record. **Please note that per UCA 63A-19-4, a governmental entity is not obligated to make the requested amendment or correction.**

You have a right to receive a privacy notice under GDPA  and GRAMA when a governmental entity collects personal data from you. The privacy notice must include the:

• Reasons you are asked to provide the personal data;
• Intended purposes and uses of the personal data;
• Consequences of not providing the personal data;
• Classes of persons and entities that:
  • Share the personal data with the governmental entity; or
  • Receive the personal data from the governmental entity on a regular or contractual basis; and
• Rhe record series in which the personal data.

In addition, you have a right to request a privacy notice for the personal data you previously provided to a governmental entity. You may exercise this right by contacting the governmental entity and requesting a copy of a privacy notice.

You also have a right to have a governmental entity explain the information contained in the privacy notice under GRAMAopens in a new tab, opens in a new tab, opens in a new tab . You may request an explanation by contacting the specific DPS section here or the methods listed above.

If you are an at-risk employee, you may submit a request to a governmental entity to have your personal information classified as a private record under GRAMA. An at-risk employee includes:

• Peace officers;
• Judges;
• Prosecutors;
• Members of the Board of Pardons;
• State or local government employees who, because of the unique nature of the employee's regular work assignments or because of one or more recent credible threats directed to or against the employee, would be at immediate and substantial risk of physical harm; and
• Family members of at-risk-employees who live with the at-risk employee.
  
  **As of May 2026- the DPS at-risk designation application is undergoing changes. Please contact the DPS Privacy Officer with any questions or concerns via the methods listed above.***