Serves K-12 schools, in Utah

Utah Code 53E-9-202 · Read the law's page

• If you are a third party contractor or other agent of a Utah education entity, protect the privacy of a student, the student's parents, and the student's family by complying with the family and student privacy protections of the Student Privacy part and the Family Educational Rights and Privacy Act and related provisions under 20 U.S.C. 1232g and 1232h, in the administration and operation of all public school programs (Utah Code 53E-9-202(2)).
• If you are a local school board or charter school governing board, enact policies governing the protection of family and student privacy as the Student Privacy part requires (Utah Code 53E-9-202(3)).for a public body

Utah Code 53E-9-302 and 53E-9-307 · Read the law's page

• If you are an education entity or a third-party contractor that collects, uses, stores, shares, or deletes student data, protect the student data as the Student Data Protection part requires (Utah Code 53E-9-302(1)(a)).
• If you are the state board, make rules to administer the Student Data Protection part, including student data protection standards for public education employees, student aides, and volunteers, and rules that prescribe the maintenance and protection of stored student data by an education entity and a third-party contractor (Utah Code 53E-9-302(1)(b) and 53E-9-307(1)).for a public body

Utah Code 53E-9-203 · Read the law's page

• If you are a school district, charter school, or the Utah Schools for the Deaf and the Blind, require prior written consent from the student's parent, in all grades from kindergarten through grade 12, before administering a psychological or psychiatric examination, test, or treatment, or a survey, analysis, or evaluation whose purpose or effect is to cause the student to reveal information on the subjects Utah Code 53E-9-203(1)(a)(ii) lists (Utah Code 53E-9-203(1) and (2)).for a public body
• At the time a student registers, annually obtain prior written consent for surveys related to an early warning system, surveys that include social emotional learning questions, and the school climate survey (Utah Code 53E-9-203(1)(b)).for a public body
• Before seeking the information, give the parent written notice, at least two weeks ahead except in an emergency, under a court order or for the annual registration consent, including that a copy of the survey questions is available at the school, the purposes and uses of the data, and who will have access to the personally identifiable information; a general consent to admission, special or remedial education, or a school activity is not written consent (Utah Code 53E-9-203(5) and (6)(a) and (e)).for a public body
• Do not give a student a reward for participating in, or a consequence for not participating in, such an examination, test, treatment, survey, analysis, or evaluation (Utah Code 53E-9-203(4)(b)).for a public body
• Treat data collected from such a survey as a private record, share it only as the Family Educational Rights and Privacy Act allows, use it only for the purposes identified in the notice, and keep it out of the student's Student Achievement Backpack (Utah Code 53E-9-203(11)).for a public body
• If you are an individual or organization that uses data collected from such a survey, use it only for the purposes identified in the parent notice, and share it only as the Family Educational Rights and Privacy Act allows (Utah Code 53E-9-203(11)(b) and (c)).

Utah Admin. Code R277-487-7 · Read the law's page

• If you are a third-party contractor with a contract with a Utah education entity, protect student personally identifiable information against unauthorized access and redisclosure, both physical and digital (R277-487-7(1)).
• Have policies in place that follow reasonably industry best practices and adequately address the protection of student personally identifiable information (R277-487-7(2)).
• Develop and document an information security program, and make sure your contract informs the local education agency or the Superintendent of the precautions taken to maintain and protect student personally identifiable information (R277-487-7(3) and (4)).
• Meet the contractual audit right with a self-assessment, questionnaire responses, an SOC2 or SOC3 report, or an agreed onsite audit (R277-487-7(5)).

Utah Code 53E-9-308 · Read the law's page

• If you are an education entity, do not share personally identifiable student data without written consent, and do not share student data with a federal agency, except as Utah Code 53E-9-308(1)(b) and the Family Educational Rights and Privacy Act allow (Utah Code 53E-9-308(1)).for a public body
• Have your student data manager authorize and manage the sharing of personally identifiable student data outside your education entity (Utah Code 53E-9-308(2)(a)).for a public body
• Share student data for research or evaluation only after verifying that the request meets the requirements of 34 CFR 99.31(a)(6), submitting it to your research review process, and fulfilling the instructions that result (Utah Code 53E-9-308(6)(a)).for a public body
• If you receive personally identifiable student data in response to a court subpoena, use it only for the use described in the subpoena (Utah Code 53E-9-308(5)(b)).

Utah Code 53E-9-309, as amended by Laws of Utah 2026, ch. 18 (HB 55) · Read the law's page

• If you are a third-party contractor that receives personally identifiable student data under a contract with a Utah education entity, use that data strictly to provide the contracted product or service within the negotiated contract terms.
• Do not sell student data, use it for targeted advertising, or collect, use, or share it in a way that is inconsistent with your contract with the education entity.
• Accept contract terms that describe the education entity's statutory duty to terminate the contract after an uncured privacy violation and that prohibit any fee or financial liability for the termination.
• Do not impose a fee, seek damages, or assert financial liability against an education entity that terminates your contract for unauthorized use of student data in violation of state or federal privacy law.
• At the completion of a contract with a Utah education entity that is not renewed, return or delete all personally identifiable student data under the control of the education entity, unless the student's parent gives written consent to your keeping it (Utah Code 53E-9-309(5)).
• Where authorized by law or court order, share student data as requested by law enforcement (Utah Code 53E-9-309(3)).
• If you use student data to identify nonprofit higher-education institutions or scholarship providers seeking students who meet specific criteria, do so only where the criteria include no personal identity characteristic and you hold written authorization from the student's parent through the student's school or LEA, or from an adult student, whether or not the institution or provider pays you (Utah Code 53E-9-309(4)(e)).

Utah Code 53E-9-311 · Read the law's page

• If you are an education entity, let a currently or previously enrolled student, or a parent if the student is under 18, access the student's educational data and authorize access to it (Utah Code 53E-9-311(2)).for a public body
• Disclose a student's educational data to a third party only with the student's informed consent, according to the terms of the consent document, and subject to the third party's agreement to use the data only as the document provides and not to redisclose it (Utah Code 53E-9-311(9)).for a public body
• Beginning July 1, 2027, offer a secure digital or electronic mechanism as the primary method for obtaining informed consent, and allow informed consent in written form if a digital or electronic mechanism is not reasonably available to the student (Utah Code 53E-9-311(3)(b) and (c)).when it serves a public body
• When you obtain a student's consent through a digital or electronic consent mechanism, let the student review all consent information before authorizing, and do not bundle unrelated terms or conditions with the consent request (Utah Code 53E-9-311(3)(d)).when it serves a public body
• Do not deny, delay, or restrict a student's ability to grant informed consent that complies with the section, and do not require a student to waive unrelated rights or agree to unrelated terms as a condition of granting informed consent (Utah Code 53E-9-311(5)(a) and (b)).for a public body
• If the student is under 18 years old and the disclosure is to a party other than the student, obtain the parent's consent (Utah Code 53E-9-311(6)(a)).for a public body
• If you are a third party that receives the educational data of more than 10 students, meet the data privacy requirements of the Student Data Protection part and the policies and administrative rules the state board adopts to protect student data (Utah Code 53E-9-311(10)).

Utah Admin. Code R277-469-3(4) and (5), R277-469-6(2), R277-469-7(2) and R277-469-10(6)(d) · Read the law's page

• If you are a local education agency, include a requirement in all publisher contracts for instructional materials that the publisher prepare and provide electronic files of all instructional materials in the NIMAS format to NIMAC on or before delivery of print instructional materials, or provide instructional materials that are produced in, or may be made in, specialized formats, and provide materials consistent with the Utah Code and administrative rules (Utah Admin. Code R277-469-3(4)).for a public body
• If you are a local education agency, give all publishers with whom you contract for instructional materials timely notice, with a copy of the rule, that all materials must be provided consistent with that contract requirement (Utah Admin. Code R277-469-3(5)).for a public body
• If you are a local education agency, as part of any materials adoption process or procurement contract for instructional materials, provide instructional materials to all students, including blind students and other students with disabilities, in a timely manner, and include NIMAS contract language in all contracts with publishers for Core materials (Utah Admin. Code R277-469-7(2)).for a public body
• If you are a publisher submitting new primary material to be evaluated by the Superintendent, submit an electronic version of that material in NIMAS file format to NIMAC for use in conversion into Braille, large print, and other formats for students with print disabilities (Utah Admin. Code R277-469-6(2)).
• If you are a publisher and the Superintendent approves your request to substitute a revised edition of recommended materials, submit the revised electronic edition in NIMAS file format to the NIMAC (Utah Admin. Code R277-469-10(6)(d)).