Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Privacy topic
No spam. Unsubscribe anytime.
Davis County staff report completion of 2025 data privacy inventory, 100% training and no reportable breaches
Summary
County staff told the commission that a yearlong data privacy program identified more than 900 collection processes, completed mandatory training for all active employees, recorded zero reportable breaches and launched a public transparency portal; staff outlined 2026 goals including data minimization and vendor compliance.
Brian McKenzie presented Davis County's 2025 data privacy program report at a Jan. 6 work session, telling commissioners the county completed a countywide inventory of data-collection points, completed staff training and recorded no reportable breaches.
McKenzie said the county identified "a little over 900" collection points across departments and documented what personal data are collected, the statutory authority for collection and how that information is managed. "That's a lot of work, to identify those ... and that was successfully completed this year," he said.
The report credited a centralized approach that assigns responsibilities to McKenzie's office and to designated privacy representatives in each department. McKenzie said the county achieved mandatory privacy training completion for all active employees in 2025: "We achieved 100% training ... 100% of our employees took the mandatory training," he said, while noting three non-active employees (on military deployment or temporary leave) did not complete it.
Staff and commissioners also noted security outcomes. McKenzie said there were zero reportable data breaches in 2025, and he credited the county's IT team and employee awareness for that result: "It's a great thing ... it's also from significant efforts from our IT department," he said.
As part of transparency efforts, McKenzie demonstrated a new public portal that centralizes privacy notices, resources and links to departmental processes. He said each privacy notice will be tied to a specific collection process and posted both on the portal and in the relevant public office; staff are producing a one-page information sheet with a QR code for public display.
On compliance measures, McKenzie described the maturity matrix the state uses to evaluate GDPA implementation; he said Davis County's score rose from an initial baseline of 2.1 to 3.95, crediting the county's existing records management systems and recently adopted ordinance and policies.
Looking ahead, McKenzie outlined strategic goals for 2026'27: (1) deploy privacy notices for all collecting processes, (2) perform data-minimization reviews with departments to collect only the minimum necessary personal data, and (3) update vendor and contract language to ensure GDPA compliance by a July deadline and incorporate GDPA review into procurement and IT system evaluations.
Commissioners and committee members praised the work and said other counties have reached out to learn from Davis County's approach. McKenzie said staff plan to finalize the comprehensive report in December and return with the legislative summary in January each year. The work session adjourned at 9:05 a.m.
