Requirements for contractors

(1) Except as provided in Subsection (4), a contractor that processes or has access to personal data as a part of the contractor's duties under a contract with a governmental entity is subject to the requirements of this chapter to the same extent as the governmental entity for any personal data the contractor processes or has access to under a contract with the governmental entity. (2) A contract entered into or renewed between a contractor and a governmental entity after July 1, 2027, shall contain specific language that requires a contractor to comply with the requirements of this chapter with regard to the personal data processed or accessed by the contractor as a part of the contractor's duties under a contract to the same extent as required of the governmental entity. (3) The requirements under this section are in addition to and do not replace any other requirements or liability that may be imposed for the contractor's violation of other laws protecting privacy rights or government records. (4) A contractor is not subject to the data privacy training program requirements described in Section 63A-19-401.2.