What a Utah business has to have in writing

Investigate promptly and in good faith whether personal information has been or is likely to be misused. If it has, notify each affected Utah resident without unreasonable delay by mail, email, telephone or, where that is not feasible, publication. At 500 or more affected residents also notify the Utah Attorney General and the Utah Cyber Center; at 1,000 or more also notify the nationwide consumer reporting agencies.

Put reasonable procedures in place to prevent unlawful use or disclosure of personal information collected in the ordinary course of business, and to destroy records containing personal information that are not being kept, by shredding, erasing or otherwise making the information indecipherable.

Create, maintain and reasonably comply with a written cybersecurity program with administrative, technical and physical safeguards scaled to the business, including written protocols for responding to a breach and for notifying affected individuals. Doing so is an affirmative defense to Utah claims that the business failed to use reasonable security controls, failed to respond to a breach, or failed to notify. A program that conforms to a recognized framework (NIST 800-171 or 800-53, FedRAMP, the CIS Controls or the ISO/IEC 27000 family), or to HIPAA, the Gramm-Leach-Bliley Act or PCI DSS, qualifies under section 78B-4-703. The defense is lost if the business had actual notice of a threat and did not act on it (section 78B-4-702(5)). The act creates no private cause of action for failing to comply (section 78B-4-704).

Publish a clear, reasonably accessible privacy notice covering the categories of personal data processed, the purposes, how consumers exercise their rights, and the categories of data shared with third parties and the categories of those third parties. Keep reasonable administrative, technical and physical data security practices. Give clear notice and an opt-out before processing sensitive data, disclose data sales and targeted advertising with an opt-out, and answer consumer requests within 45 days.

Report any work-related fatality, any disabling, serious or significant injury and any occupational disease incident to UOSH within 8 hours, which is broader than the federal rule, and leave the scene undisturbed until UOSH clears it. Investigate every work-related injury and occupational disease. Keep the federal 29 CFR 1904 injury and illness records. Post a conspicuous emergency contact list (supervisor, doctor, hospital, ambulance, fire, police). Utah does not impose a general written safety program, but individual adopted standards such as hazard communication and lockout/tagout do.

Display the Utah Occupational Safety and Health poster and the Workers' Compensation notice continuously in a public, conspicuous place at the workplace, or at the location where employees report each day if the work is physically dispersed. The Labor Commission treats these two as the state-required set and supplies both free, flagging that federal and industry posters may also apply.

File formation or foreign registration documents with the Division of Corporations and Commercial Code, name a registered agent, and file the annual renewal on the entity's registration anniversary to stay active. Assumed business names and trademarks are filed with the same division.

Carry out every test within the terms of a written testing policy that has already been distributed to employees and is available for prospective employees to review. The policy sets the permitted purposes, which the statute limits to investigating suspected impairment, investigating workplace accidents or theft, maintaining safety, and maintaining productivity, quality or security. Sample collection, testing and use of results must follow the statute's procedural sections.

Do not ask an employee or applicant for the username and password to a personal internet account, and do not refuse to hire, discipline or otherwise penalize anyone who declines. Hiring and social-media screening procedures have to be written so recruiters never request account credentials.

Keep Social Security number, date of birth and driver license number off the job application and out of pre-offer screening, unless one of the statute's narrow exceptions applies. In practice this means rewriting application forms and applicant-tracking fields so those items are only collected after a conditional offer.

Hold a DOPL contracting license before doing the work, name a qualifier who has passed the required exams and exercises real authority over the business, register the entity with the Division of Corporations, and file proof of general liability insurance (commonly $1 million per occurrence and $2 million aggregate, with DOPL as certificate holder). Renew every two years with 6 hours of approved continuing education and current liability and workers' compensation certificates or waivers.

Every food handler completes an approved training program and holds a valid food handler permit issued by the local health department, valid three years, before working with food. The establishment also maintains a certified food safety manager. Permits and manager certificates must be available for inspection.

Maintain a comprehensive written information security program with administrative, technical and physical safeguards sized to the licensee's operations, aimed at keeping customer information confidential, protecting against anticipated threats and preventing harmful unauthorized access. The rule sets out risk assessment, staff training, control testing, service-provider due diligence and periodic program adjustment as the expected methods. Utah has not adopted the NAIC insurance data security model, so there is no annual certification filing.