Nonpublic Personal Information Amendments

SB 150 amends Utah's law governing nonpublic personal information, directly affecting businesses that collect consumer data and individuals whose data is handled. It clarifies that violations must be addressed through individual lawsuits (not group lawsuits), requires claims to be filed within one year of a transaction, and confirms the class action ban is a substantive legal rule. The bill updates definitions of terms like "commercial entity" and "nonpublic personal information" to better define what data is protected. It does not change the $500 penalty for failing to provide required notices or add new financial obligations. This bill takes effect May 7, 2025.