The Utah Consumer Privacy Act (UCPA, Utah Code § 13-61-101) has the simplest DSAR process among current US state privacy laws.

This page covers one piece of the picture. For the full scope of the UCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the UCPA and cookies.

Four rights. No formal appeal process. No special authentication distinction for opt-out requests. And the response deadline is the same for all: 45 days.

But there are particularities worth attention: the deletion right is more restricted than in other laws, and the UCPA has specific rules about fee charging and fraud protection in requests.

This article covers everything.

DSAR stands for Data Subject Access Request. It is any formal request from a Utah resident to exercise the rights the UCPA guarantees over their own data.

Under Utah Code § 13-61-202(1), consumers exercise their rights by submitting a request to the controller, using the means prescribed by the controller, specifying which right they intend to exercise.

If you already know the LGPD data subject portal, the structure is familiar, but simplified. The UCPA has no formal appeal process and the scope of some rights is more limited.

Under Utah Code § 13-61-201, Utah residents have four rights:

The consumer may confirm whether the controller is processing their personal data and access that data (§ 13-61-201(1)).

The response must be provided in an accessible format within 45 days.

The consumer may request deletion of personal data they provided to the controller (§ 13-61-201(2)).

Note on the limited scope: the UCPA limits the deletion right to data the consumer provided to the controller. Data the controller obtained from other sources, such as data brokers, third-party lists, or inferences created from other data, do not need to be deleted under the UCPA.

This is substantially different from laws like the OCPA and CTDPA, which require deletion of data obtained from any source, including derived data.

The consumer may obtain a copy of the personal data they provided to the controller, in a portable format where technically feasible and practicable, for transmission to another controller without impediment, when processing is carried out by automated means (§ 13-61-201(3)).

The scope is also limited to data the consumer provided, not all data the controller holds about the consumer.

The consumer may refuse processing of their personal data for targeted advertising or sale of personal data (§ 13-61-201(4)).

What the UCPA does not include in opt-out: profiling. The UCPA does not guarantee opt-out of profiling for decisions with legal or significant effects, unlike the OCPA, VCDPA, and CTDPA. The opt-out covers only targeted advertising and data sales.

For businesses already processing DSARs for other jurisdictions, it is worth noting what the UCPA does not provide:

No right to correct. The UCPA does not guarantee the right to correct inaccurate data. Laws like the CPRA, OCPA, VCDPA, and CTDPA all include this right.

No formal structured appeal process. When the controller denies a request, the UCPA does not require a structured appeal process. The consumer may file a complaint with the Division of Consumer Protection.

No opt-out of profiling. The UCPA covers only targeted advertising and data sales in the opt-out, excluding profiling for decisions with legal effects.

Deletion limited to data provided by the consumer. Third-party data and derived data do not need to be deleted.

Under Utah Code § 13-61-203:

45 days to respond from receipt of the request (§ 13-61-203(2)(a)).

Extension of +45 days when reasonably necessary due to complexity or volume, with notification before the initial period expires (§ 13-61-203(2)(b)(c)).

If the controller reasonably suspects the request is fraudulent and cannot authenticate before the deadline expires, the 45-day period does not apply until authentication is completed (§ 13-61-203(2)(d)).

Free for the first request from each consumer per 12-month period (§ 13-61-203(4)(a)).

Utah Code § 13-61-203(4)(b) allows the controller to charge a reasonable fee or refuse to act if the request:

Is excessive, repetitive, technically infeasible, or manifestly unfounded.

The controller reasonably believes the primary purpose in submitting the request is something other than exercising a right.

The request, individually or as part of an organized effort, harasses, disrupts, or imposes undue burden on the business's resources.

The controller that charges a fee or refuses to act based on these criteria bears the burden of demonstrating that the request satisfies one or more of the listed criteria.

One important difference from the OCPA: the UCPA has no special authentication rule for opt-out requests. Under § 13-61-203(5), if the controller cannot authenticate the request using commercially reasonable efforts, it is not required to comply, but may request additional information reasonably necessary to authenticate.

This rule applies equally to all types of requests, including opt-out. This differs from the OCPA, which prohibits requiring authentication for opt-out from targeted advertising.

Under Utah Code § 13-61-203(1) and 302(1)(a)(iii), the controller must establish means by which consumers can submit requests, and describe those means in the privacy notice.

The controller cannot require the consumer to create a new account solely to exercise a right. The law allows use of an existing account (§ 13-61-202(1) refers to using "means prescribed by the controller").

A well-structured Privacy Portal for the UCPA includes:

A form with the four rights categories.

A proportionate identity verification process.

Receipt confirmation.

Record of the request, action taken, and response sent.

The site consent mechanism and the Privacy Portal must be integrated so that opt-out preferences are reflected in the business's operational systems.

Under Utah Code § 13-61-202(2), in the case of processing personal data of a known child, the parent or legal guardian must exercise rights on the child's behalf.

Under § 13-61-202(3), in the case of processing data of a consumer subject to guardianship, conservatorship, or other protective arrangement, the guardian or conservator exercises rights on the consumer's behalf.

For data of known children, the business must comply with COPPA (§ 13-61-102(3)), including verifiable parental consent before any data collection.

Under Utah Code § 13-61-203(3), a controller that decides not to act on a consumer's request must inform the consumer within 45 days, with the reasons for not taking action.

The UCPA does not describe a formal appeal process. There is no specific appeal deadline, nor an obligation to inform about how to contact the regulator in case of denial.

The consumer may file a complaint with the Division of Consumer Protection, which may investigate and, if it finds substantial evidence of violation, refer to the Attorney General.

Receive and authenticate with commercially reasonable efforts.

Confirm whether the consumer's data is being processed.

Locate the consumer's personal data in relevant systems.

Prepare response in an accessible format within 45 days.

Receive and authenticate.

Identify which data the consumer directly provided.

Check for a legal exception justifying retention.

Delete the identified data from relevant systems.

Important note: data the controller obtained from sources other than the consumer themselves (data brokers, third-party lists, derived data) does not need to be deleted under the UCPA.

Receive and authenticate.

Identify which data the consumer directly provided.

Prepare response in a portable, usable format.

Deliver to consumer within 45 days.

Receive request via the designated channel.

Authenticate with commercially reasonable efforts.

Cease processing for the indicated purposes.

Update corresponding tracking systems.

Inform the consumer within 45 days.

Utah Code § 13-61-302(4) prohibits discriminating against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs and situations where the consumer opted out of targeted advertising and the business adjusted pricing accordingly, provided the price difference is reasonably related to the value the data provides the business.

Each processed request must be documented. This includes:

Date and time of receipt.

Type of right exercised.

Authentication process conducted.

Action taken.

Date and form of response to the consumer.

If denied: justification recorded.

This documentation is what protects the business when the Division of Consumer Protection investigates complaints or when the case is referred to the Attorney General.

Before initiating any action, the Attorney General must notify the controller and grant 30 days to cure (§ 13-61-402(3)). This deadline is guaranteed permanently.

Businesses without a structured DSAR process find it difficult to implement in 30 days what should have been in place from the start. The cure period is a guarantee, not a compliance strategy.

AdOpt records every consent and opt-out interaction with a timestamp and unique identifier. When the consumer exercises opt-out from targeted advertising, the system automatically updates the corresponding trackers.

AdOpt's auditable log serves as evidence of compliance for the Division of Consumer Protection and the Attorney General. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Portal for your site that complies with the UCPA? Talk to our team.

Request submission channel described in the privacy notice (§ 13-61-302(1)(a)(iii)).

Coverage of the 4 rights: confirm/access, deletion (data provided by consumer), portability, opt-out from targeted advertising and data sales.

No requirement to create a new account to exercise rights.

45-day deadline to respond (+45 ext. with notification) (§ 13-61-203(2)).

Authentication with commercially reasonable efforts for all request types (§ 13-61-203(5)).

Free service for the first request per 12-month period (§ 13-61-203(4)(a)).

Documented record of each request, action taken, and response sent.

Child protection: parents/guardians exercise rights for known children (§ 13-61-202(2)).

COPPA compliance for data of children under 13 (§ 13-61-102(3)).

Protection against discrimination for consumers exercising rights (§ 13-61-302(4)).

1. Why is the UCPA deletion right more restricted than in other state laws?
Utah Code § 13-61-201(2) limits the deletion right to "personal data the consumer provided to the controller." This excludes data the controller obtained from third parties, data inferred or derived from other data, and data obtained from sources other than the consumer themselves. In contrast, laws like the OCPA and CTDPA require deletion of data from any source. The UCPA reflects the Utah legislature's philosophy of protecting consumers without creating excessively burdensome obligations for businesses.

2. Does the UCPA have a formal appeal process when the controller denies a request?
No. Unlike the OCPA (45 days for appeal), CTDPA (60 days), and VCDPA (60 days), the UCPA does not define a structured appeal process. When the controller denies a request, it must inform the consumer of the reasons within 45 days (§ 13-61-203(3)). The consumer may then file a complaint with the Division of Consumer Protection, which may investigate and refer to the Attorney General if it finds substantial evidence of violation.

3. Does the UCPA require opt-out of profiling?
No. The UCPA's opt-out right covers only targeted advertising and data sales (§ 13-61-201(4)). Laws like the VCDPA, OCPA, and CTDPA include opt-out of profiling for decisions with legal or significant effects. The UCPA is the only one among the major US state laws that does not include this right.

4. Does the Privacy Portal need a separate opt-out process from other rights?
Not in any special way. Unlike the OCPA, which prohibits requiring authentication for opt-out, the UCPA uses the same "commercially reasonable efforts" authentication standard for all request types (§ 13-61-203(5)). The opt-out does not need a separate or simpler authentication flow than access or deletion.

5. What happens if the controller suspects a request is fraudulent?
Utah Code § 13-61-203(2)(d) establishes that the 45-day deadline does not apply if the controller reasonably suspects the request is fraudulent and cannot authenticate before the deadline expires. The controller may request additional information for authentication (§ 13-61-203(5)(b)). If the fraud suspicion is reasonable and documented, the controller may charge a fee or refuse to act, bearing the burden of demonstrating the fraudulent nature.

Ready to build a Privacy Portal for your site that complies with the UCPA? Talk to our team.