Davis County reports full staff training, no reportable breaches and stronger privacy maturity

Davis County presented its 2025 annual data privacy program report during a Jan. 6 work session, saying the county completed a countywide inventory of personal-data collection points, achieved mandatory training for active staff, recorded no reportable data breaches, and improved its statewide compliance score.

Brian McKenzie, a county staff member who led the update, told the Davis County Commission the inventory identified "a little over 900" collection points and documented the statutory authority and retention requirements for those records. "We we achieved 100% training, in our first year. 100% of our employees took the mandatory training," McKenzie said, adding that three nonactive employees (deployed or on temporary assignment) were excluded from the active count.

McKenzie also reported there were "0 reportable data breaches" during the year, crediting coordinated efforts by the IT team and employee awareness. He described a new public transparency portal that centralizes privacy notices, state resources and a one-page QR-code fact sheet to be posted in public offices so residents can see how the county collects and uses personal data.

The report summarized Davis County's performance on the state's 1-to-5 maturity matrix: "When we began ... we started at a 2.1" and "Today, we're at a 3.95," McKenzie said, citing an existing records-management program (GRAMA-related practices) as a factor in the county's progress.

Looking ahead, McKenzie said the county will focus on three goals for 2026' 2027: deploy privacy notices for all collection processes (and provide QR-code one-pagers for public offices); conduct data-minimization reviews with departments to limit collection to necessary fields; and ensure vendor and contract compliance by adding GDPR/ GDPA-specific contract language and tightening procurement/IT evaluation procedures, with plans to have GDPA contract language included across contracts by a July deadline.

Commissioners and staff largely praised the report's thoroughness. A commissioner said the county had been "thorough" in its approach and noted the implementation burden new state laws sometimes impose on local governments; Scott Park, the county controller, said he was "very happy" the program was housed in the clerk's office and credited that office's process expertise for the program's progress.

McKenzie proposed a recurring schedule: finalize the comprehensive report in December and provide a legislative-body summary each January. The commission accepted the update, and the work session adjourned at 9:05 a.m.

Next steps noted by presenters include completing the privacy-notice rollouts across departments, data-minimization reviews with department leads, and incorporation of GDPA contract language in procurement templates by the July target.