Utah SaaS Agreement Review
Utah passed one of the most business-friendly privacy laws in the country. The Utah Consumer Privacy Act, effective December 31, 2023, applies only to companies above $25 million in revenue, offers no opt-out of profiling, and has no private right of action. For a Silicon Slopes software firm buying other vendors' tools, the bigger day-to-day obligations may come from Utah's breach rules, which now involve the state's cyber center.
Consumer privacy law in Utah
Utah Consumer Privacy Act (UCPA)
Data rights in Utah
Utah has enacted the Utah Consumer Privacy Act (UCPA), a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about Utah residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
Who is subject to the Utah Consumer Privacy Act?
Under Utah Code Title 13, Chapter 61, the act applies to a business with annual revenue of $25 million or more that does business in Utah or targets Utah residents and either controls or processes personal data of 100,000 or more Utah consumers in a year, or of 25,000 or more while deriving over 50% of gross revenue from selling personal data. The Division of Consumer Protection investigates complaints, and the attorney general enforces with a 30-day cure period. Nonprofits and institutions of higher education are exempt.
The act still requires a processor contract with instructions, confidentiality, subcontractor flow-down and the nature and duration of processing, so a covered buyer needs one from each SaaS vendor, even though Utah's consumer rights are narrower than its neighbors' laws.
How do breaches work in Utah now?
Utah's Protection of Personal Information Act, Utah Code 13-44-202, requires notice to affected residents in the most expedient time possible without unreasonable delay. Under 2023 amendments (SB 127), a breach affecting 500 or more Utah residents must also be reported to the attorney general and the Utah Cyber Center, and the consumer reporting agencies must be told when 1,000 or more are affected. Your SaaS contract should require the vendor to share what the state reports need, including affected-record counts by state.
Utah sources checked 2026-10-09: Baker Donelson, Utah privacy law guide · Davis Wright Tremaine, Utah breach summary. Laws change; confirm the current rule before relying on it.
Utah SaaS agreement FAQ
Does Utah have a data privacy law that affects SaaS contracts?
Yes. Utah has enacted a comprehensive consumer privacy law, the Utah Consumer Privacy Act (UCPA). It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about Utah residents.
Can a SaaS vendor use my Utah business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Utah law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Utah?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Utah law in about a minute.
Can Utah consumers opt out of profiling by a SaaS vendor?
Not under the Utah Consumer Privacy Act. Unlike Virginia or Colorado, Utah does not give a right to opt out of profiling, though consumers can opt out of targeted advertising and data sales. If your customers live in several states, your vendor terms usually need to support the broader rights anyway.
Who must a Utah business notify after a large SaaS breach?
Affected residents first, and if 500 or more Utahns are involved, the attorney general and the Utah Cyber Center. At 1,000 or more, the consumer reporting agencies too. Require your vendor to report incidents promptly and supply the counts and details those notices need.
Reviewing a SaaS contract in Utah?
Upload it and get the data, liability, and renewal terms checked against Utah law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Utah law when you run your agreement, and you should confirm anything critical with a qualified attorney.