Utah Consumer Privacy Act C-304: Be able to prove that processing under an exemption qualifies

Controllers relying on the Act's permitted purposes (legal compliance, investigations, legal claims, requested services and contracts, safety, security and fraud, research, internal analytics and operations) bear the burden of showing the processing qualifies.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Controller and processor duties (Part 3) – Utah Consumer Privacy Act

C-301 Bind processors by contract and have them assist with security and breach notification
C-302-1 Publish a clear privacy notice and disclose how to opt out of sale and targeted advertising
C-302-2 Maintain reasonable administrative, technical and physical data security
C-302-3 Give clear notice and an opportunity to opt out before processing sensitive data; follow COPPA for known children
C-302-4 Do not discriminate against consumers for exercising rights or use contract terms that waive them
C-303 Keep pseudonymous and deidentified data protected and honour contractual commitments on it

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Utah Consumer Privacy Act controls