63A-19-401.2. Training requirements.

255 words·~1 min read·/ut/title-63a/chapter-19/63a-19-401-2

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

Effective 5/6/2026

(1)An employee of a governmental entity shall complete data privacy training that includes instruction on:

(a)data privacy best practices, obligations, and responsibilities;

(b)the relationship between privacy, records management, and security;

(c)the privacy interests and requirements of this chapter; and

(d)as applicable, the privacy interests and requirements of Title 63G, Chapter 2, Government Records Access and Management Act.

(2)An employee of a governmental entity shall complete the data privacy training described in Subsection

(1)if the employee:

(a)has access to personal data as part of the employee's assigned duties; or

(b)supervises an employee who has access to personal data.

(3)The training described in Subsection

(1)shall be completed:

(a)within 30 days after the day on which the employee begins employment with a governmental entity; and

(b)at least once in each calendar year.

(4)A governmental entity shall:

(a)ensure that each employee described in Subsection

(2)completes a data privacy training that meets the requirements described in Subsection

(1); and

(b)report the percentage of the governmental entity's employees required to complete the data privacy training under this section that have completed the training as part of the privacy program report described in Section 63A-19-401.3 .

(5)A governmental entity may use the data privacy training created by the office to satisfy the requirements of this section, or may provide separate data privacy training that meets the requirements of this section.

Amended by Chapter 202 , 2026 General Session