53E-9-304. Student data ownership and access -- Notification in case of significant data breach.
(1) A student owns the student's personally identifiable student data. An education entity shall allow the following individuals to access a student's student data that is maintained by the education entity: the student's parent; the student; and in accordance with the education entity's internal policy described in Sectionand in the absence of a parent, an individual acting as a parent to the student. 53E-9-303
(2) If a significant data breach occurs at an education entity, the education entity shall notify: the student, if the student is an adult student; or the student's parent, if the student is not an adult student. In accordance with, the state board shall make rules to define a significant data breach described in Subsection. Title 63G, Chapter 3, Utah Administrative Rulemaking Act (2)(a)