Spencer Foster, a local administrative advisor with MAG's LAA program, told the Woodland Hills City Council on Oct. 28 that Utah's Government Data Privacy Act (Utah Code 63A-19) requires local governments to implement a privacy program and submit a privacy program report. "This law was actually passed in 2024... implementation is required by 12/31/2025," he said during a 40-minute presentation that explained the statute, a required data inventory and subsequent annual maturity assessments.

Foster explained the immediate step required for compliance is filing a privacy program report that documents where the city collects personal data, which vendors handle that data, and which municipal officers are responsible for privacy. He recommended the city appoint office-level roles rather than named incumbents so leadership designations survive personnel changes; Woodland Hills already lists the mayor as CAO and the city recorder as records officer.

Council action: After the presentation, the council voted unanimously to adopt a proposed GDPA website compliance policy. Council members moved, seconded and voted "aye" with no opposition. The adopted policy is the website-specific piece of the broader privacy program and staff were instructed to complete the state report and carry out required training for employees who access personal data.

Why it matters: The state will require an annual privacy program report and in later phases will expect more procedural and technical safeguards (for example, data inventories, vendor vetting and staff training). Foster offered resources and templates and said MAG will assist municipalities in the region.

Implementation steps recorded at the meeting: designate CAO and records officer by title; complete a data inventory that lists where personal data is stored (including departments and third-party vendors); ensure staff who handle personal data complete the state's training video; and file the privacy program report before Dec. 31, 2025.

Ending note: Councilors said the policy is straightforward and consistent with the city's existing privacy practice. The city clerk/recorder and mayor were identified as the operational contacts for the privacy program.