Law / United States / 
Kentucky
School district data security and breach procedures: annual board acknowledgement and breach notice to the Department of Education
In force since .
A breach notification rule binding government bodies.
- Obligation class
- Security, Breach notice, Governance
- Audit expectation
- none
What it requires
- If you are a public school district, review and consider the Department of Education's most recent best practice guidance for personal information reasonable security, including the Data Security and Breach Notification Best Practice Guide, and acknowledge to your local board at a public board meeting prior to August 31 of each year that you have reviewed it and implemented the best practices that meet your district's needs (702 KAR 1:170 sec. 3).
- If you determine or are notified of a security breach relating to personal information collected, maintained or stored by the district or by a nonaffiliated third party on its behalf, notify the Department of Education as KRS 61.933 requires, following the procedure in the Data Security and Breach Notification Best Practice Guide (702 KAR 1:170 sec. 5).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
A district has to acknowledge its review of the best practice guidance to its local board each year and notify the Department of Education of a breach. The regulation requires no log, no retention period and no territorial hook, and the notice is a notification, not a review of a record.
- Kind
- None
- As of
What this law does
The Kentucky Board of Education promulgated the regulation under KRS 61.932(1)(b), which requires it to establish requirements and standards for the reasonable security and breach investigation procedures and practices of public school districts. Each public school district must review and consider the most recent best practice guidance for personal information reasonable security.
Each district must acknowledge to its own local board during a public board meeting prior to August 31 of each year that the district has reviewed the guidance and implemented the best practices that meet the needs of personal information reasonable security in that district. School districts are not required to adopt the security practices included in the guidance.
A public school district that determines or is notified of a security breach relating to personal information it or a nonaffiliated third party on its behalf collects, maintains, or stores must notify the Department of Education as KRS 61.933 requires. The regulation took effect on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .