Utah Code Title 53B. State System of Higher Education § 53B-28-501. Definitions

(a) are totaled and reported at the group, cohort, class, course, institution, region, or state level, with at least 10 individuals in the level; and

(b) do not reveal personally identifiable student data.

(a) incorporates reasonable data industry best practices to maintain and protect student data and other education-related data;

(b) describes the role, responsibility, and authority of the board or an institution privacy officer;

(c) provides for necessary technical assistance, training, support, and auditing;

(d) describes the process for sharing student data between the education entity and another person;

(e) describes the education entity's data expungement process, including how to respond to requests for expungement;

(f) describes the data breach response process; and

(g) is published annually and available on the institution's website or the Utah System of Higher Education's website.

(9)(a) “Personally identifiable student data” means student data that identifies or is used by the holder to identify a student.

(b) “Personally identifiable student data” includes:

(12)(a) “Student data” means information about a student at the individual student level.

(b) “Student data” does not include aggregate or de-identified data.

(a) is not an institution or an employee of an institution; and

(b) pursuant to a contract with an education entity, collects or receives student data in order to provide a product or service, as described in the contract, if the product or service is not related to school photography, yearbooks, graduation announcements, or a similar product or service.