Law / United States / 
Utah
Student Data Protection: notice to parents and adult students of a significant data breach at an education entity
In force since .
A breach notification rule binding government bodies.
- Obligation class
- Breach notice, Reporting
What it requires
- If you are an education entity and a significant data breach occurs, notify the student if the student is an adult student, or the student's parent if the student is not an adult student (Utah Code 53E-9-304(2)(a)).
- If you are a local education agency, report every significant data breach of student data, whether by you or by a third party, to the Superintendent within ten business days of initial discovery (Utah Admin. Code R277-487-3(3)).
These lines are LexLint's reading of the law's text.
What this law does
If a significant data breach occurs at an education entity, the education entity must notify the student, if the student is an adult student, or the student's parent, if the student is not an adult student. The state board must make rules to define a significant data breach. A data breach is an unauthorized release of or unauthorized access to personally identifiable student data that is maintained by an education entity.
Under rule R277-487 a significant data breach is one where an intentional data breach successfully compromises student records, a large number of student records are compromised, sensitive records are compromised regardless of number, or a local education agency deems the breach significant based on the surrounding circumstances.
A local education agency must report all significant data breaches of student data, whether by the agency or by third parties, to the Superintendent within ten business days of the initial discovery.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .