Utah officials outline multi‑year rollout to implement Government Data Privacy Act

Utah policymakers and the Office of Data Privacy outlined a phased, multi‑year program to implement the Government Data Privacy Act at the Data Governance Summit hosted by the Gary R. Herbert Institute at Utah Valley University.

The plan responds to the 2024 enactment of the Government Data Privacy Act and aims to help state agencies, colleges, cities and counties bring systems and practices into compliance using standardized templates, training and technical tools. Christopher Bramwell, Utah’s chief privacy officer and director of the Office of Data Privacy, said the law recognizes current gaps: “we were dealing with decades of noncompliance.”

Why it matters: the state says many government systems were designed before modern data risks and cannot comply immediately. Officials described the new approach as a “startup” model: require new systems to meet privacy standards now, document legacy noncompliance, and use annual reporting to set priorities and allocate limited resources over time.

Key details and resources

- A forward‑looking implementation strategy. Bramwell said the law deliberately acknowledges that full compliance will take years and that the state will “prove it and then scale it.” He said agencies should expect up to a decade to remediate older systems and that everything new must comply.

- Annual privacy program reports. The Office of Data Privacy is producing report templates to standardize how jurisdictions describe privacy practices, noncompliant activities and improvement plans. Bramwell said the first reports this year are meant to be internal to establish baselines.

- Practical templates and services. Bramwell and Marvin Dodge, executive director of the Utah Department of Government Operations, described templates for privacy policies, privacy‑impact assessments and ordinance language for cities and counties; statewide privacy awareness training; and a web‑site scanning service (procured with ObservePoint) to identify trackers and tags on government sites.

- Centralized procurement and vendor guidance. Dodge said GovOps is working to provide cooperative contracts and vendor specifications that meet the law’s standards so agencies can “grab it and go,” and to negotiate software behavior that supports data deletion and retention schedules.

Panelists emphasized coordination and support

Governor Spencer Cox said the state has a long legal tradition of protecting communications and records, and called trust “the currency of governing.” Senator Kirk Cullimore and Representative Jefferson Moss described strong bipartisan and stakeholder engagement in crafting the law; Moss said the effort included numerous interim meetings with local governments, agencies and private‑sector groups to build buy‑in.

Marvin Dodge said his office recognizes concerns about unfunded mandates and pledged centralized help: “We are here to help.” He highlighted technical challenges such as legacy IT systems that are not designed to delete data and the need for retention schedules.

What remains unresolved

Panelists repeatedly said funding and staffing are limited. Bramwell and Dodge said the Office of Data Privacy and GovOps will prioritize resources based on annual reports, but specific funding allocations and timelines for every agency were not specified at the conference.

Ending

Officials framed the work as a long‑term program that balances privacy, transparency and responsible use. The state is releasing tools and trainings this year to help entities initiate privacy programs and will use standardized reporting to target assistance and funding over coming years.