Utah Board of Higher Education rule on significant data breaches: risk assessment, exceptions, and written notice to each affected student

Rule R765-1010 of the Utah Administrative Code defines a significant data breach and establishes standards for an education entity to protect student data by notifying students of significant data breaches. Utah Code 53H-14-504(2) requires the Utah Board of Higher Education to make rules to define a significant data breach.

A data breach is significant if the education entity that maintains the personally identifiable student data determines, on a risk assessment of the factors the rule lists, that there is a moderate or high probability of substantial harm to the student.

The factors include the nature and extent of the data involved, the degree to which it could be used for unlawful purposes, the unauthorized person who used it or to whom it was disclosed, the likelihood that an unauthorized person acquired or viewed it, the extent to which the entity has mitigated the harm, and the extent to which prompt notice would let students further mitigate the harm.

A data breach is not significant to the extent that it involves data the entity made unreadable or unusable with safeguards such as encryption, data the entity lawfully published or that was already lawfully in the public domain, or the data of fewer than 25 individuals.

If a significant data breach occurs at an education entity or at a third-party contractor using data the entity disclosed, the education entity must notify in writing each student whose personally identifiable student data was disclosed. The notice must include every component of the model data breach notification, and the entity may send it by any written means it routinely uses for official communications with individual students.

For the rule, personally identifiable student data does not include information designated as directory information under the education entity's directory information policy. The rule took effect on February 14, 2024.