Law / United States / 
Utah
Rule R277-487: local education agency data privacy and security policies, secure handling of student data, employee confidentiality, retention and amendment requests
Utah Admin. Code R277-487-3(1), (2), (5), (8) and R277-487-4
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Security, Governance, Retention, Data subject rights
What it requires
- If you are a local education agency, give the Superintendent each November 15 the name and contact information of your designated data manager and information security officer, and evidence that you have implemented the Utah student privacy and student data protection requirements, the Government Data Privacy Act, FERPA, the Protection of Pupil Rights Amendment, and a cybersecurity framework (R277-487-3(1)).
- Collect, maintain, and transmit enrollment verification data, student performance data, and personally identifiable student data in a secure manner, consistent with sound data collection and storage procedures based on your cyber security framework (R277-487-3(2)).
- Do not share, disclose, or disseminate passwords for electronic maintenance of student performance data or personally identifiable student data, and provide annual confidentiality training to any employee with access to education records (R277-487-3(5) and (8)).
- Retain and dispose of student data under an approved retention schedule, require destruction or expungement of student data after the administrative need has passed unless it requires permanent retention, and process a parent's or adult student's request to amend, expunge, or destroy a record under the amendment procedures of 34 CFR Part 99, Subpart C (R277-487-4(2), (5) to (7)).
These lines are LexLint's reading of the law's text.
What this law does
By November 15 each year, each local education agency must give the Superintendent the name and contact information of its designated data manager and information security officer, and evidence that it has implemented the privacy requirements of the student privacy and student data protection parts, the Government Data Privacy Act, FERPA, and the Protection of Pupil Rights Amendment, and a cybersecurity framework.
A local education agency must ensure that school enrollment verification data, student performance data, and personally identifiable student data are collected, maintained, and transmitted in a secure manner consistent with sound data collection and storage procedures based on its cyber security framework. An employee, aide, or volunteer may not share, disclose, or disseminate passwords for electronic maintenance of student performance data or personally identifiable student data.
Each local education agency must annually provide a training on the confidentiality of student data to any employee with access to education records. A local education agency must retain and dispose of all student data in accordance with an approved retention schedule. Unless the data requires permanent retention, a local education agency's retention schedules must require destruction or expungement of student data after the administrative need for the data has passed.
A parent or adult student may request that a local education agency amend, expunge, or destroy a record not subject to a retention schedule that is believed to be inaccurate, misleading, or in violation of the privacy rights of the student.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .