Utah’s Consumer Privacy Act (UCPA)

Consumers have the right to access and confirm, the right to delete, the right to data portability, and the right to opt-out. A controller shall comply with a consumer's request to exercise a right within 45 days after the day on which a controller has received that particular request.

Data controllers must honor several requirements such as non-discrimination, consent, privacy notification/privacy policy, security, non-waiver of consumer rights, processing of de-identified data for pseudonymous data, and processor/service provider agreements.

The GDPR applies to any business operating in the EU or handling the collection or processing of the personal data of EU residents. Therefore, the GDPR may apply to you if your company handles such data in the United States.