Skip to main content

Privacy For Contractors & Vendors

Vendor compliance is an important part of Salt Lake County's data privacy strategy under the Utah Government Data Privacy Act (GDPA). As County agencies increasingly rely on contractors and vendors to support operations, our partners are expected to handle personal data to the same standard the County holds itself to — including privacy notice, breach notification, and data destruction obligations under the GDPA.

Your Legal Obligations

Your Obligation — Short Version

  • If your contract with Salt Lake County involves processing or accessing personal data, you are subject to the Utah Government Data Privacy Act (GDPA) to the same extent as the County itself. This is not a courtesy request — it is the law (Utah Code § 63A-19-401.4(1)).

Review your core obligations below. If you have questions about a specific contract or data handling requirement, please reach out to the Salt Lake County Privacy Manager.

Vendor Questions

Please submit your question to Salt Lake County's Privacy Manager here.

Data minimization

  • Process only the minimum personal data necessary to fulfill your contractual duties. Do not retain data beyond what the contract requires.

Privacy notice compliance

  • If you collect personal data directly from individuals on the County's behalf, you must comply with notice requirements.

Breach notification

  • Notify Salt Lake County immediately upon discovering any unauthorized access, disclosure, or loss of County personal data. Do not investigate first — notify immediately.

Data destruction

  • At contract termination, certify the secure destruction or return of all County personal data. This is a required contract provision.

No unauthorized sharing

  • You may not share County personal data with sub-processors or other parties without written authorization from the County.

Cooperation

  • If the County or a regulator initiates an investigation involving data you process, you are required to cooperate fully and promptly.

Important exception:

  • Contractors are not subject to the GDPA's employee training requirements (Utah Code § 63A-19-401.4(4)). All other GDPA obligations apply.

Contracts entered into or renewed with Salt Lake County after July 1, 2027 must contain specific GDPA compliance language (Utah Code § 63A-19-401.4(2)).

If you are providing a system, software, or service that will collect, store, or process personal data on behalf of a County agency, a PIA is required before the system goes live (SLCo Policy CW-2022 § 8.1). The PIA is the County's process, led by the Privacy Manager (ODI), but your cooperation is required.

  • The Agency Data Coordinator triggers the PIA — if your County contact has not mentioned it, ask them before your go-live date.
  • You will be asked to provide information about: what data the system collects, how it is stored and protected, who has access, retention period, and how it is destroyed at contract end.
  • Do not go live with a system involving personal data before the PIA is complete.
  • Questions: reach out to the Salt Lake County Privacy Manager.

How to Report a Breach Immediately

  1. Contact the Salt Lake County Privacy Manager with the subject line: 'Data Breach Notification — [Your Company Name] — [Date].' Include: description of what occurred, what data was involved, estimated number of individuals affected, discovery date, and steps already taken.
  2. Notify your County point of contact and the relevant Agency Data Coordinator. Preserve all logs, communications, and records related to the incident — do not delete anything.

Data Privacy Incident Report

Please submit any Incident Reports here.

Disclose all intended sub-processors in writing before contract execution or before granting access. Sub-processors must be subject to equivalent privacy and security obligations as those in your County contract. If a sub-processor experiences a breach, your notification obligation is immediate.

When your contract ends, you are required to securely destroy or return all County personal data and certify in writing that you have done so. Secure destruction means the data cannot be reconstructed or recovered.


Certificate of destruction timeline: confirm with the Salt Lake County District Attorney's Office.