Notification of significant data breach.

(1) If a significant data breach occurs at an institution, the institution shall notify each student whose personally-identifiable student data was disclosed. (2) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the board shall make rules to define a significant data breach described in Subsection (1).