Utah

Federal Laws

State Laws

Utah Code 53E-9-303

Responsibilities:

• • Serving as the primary contact for USBE's student data privacy team
• • Completing annual compliance checks, including the Privacy Practices Benchmark
• • Overseeing privacy practices in your LEA (policies, DPAs, data sharing)
• • Collaborating with the information security officer
• +1 more...

First Steps:

• 1. Sign up for the Student Data Privacy newsletter
• 2. Schedule one-hour onboarding meeting with USBE specialist
• 3. Complete Data Manager Course on Canvas

Responsibilities:

• • Serving as the primary cybersecurity contact for USBE's Student Data Privacy Team
• • Completing annual compliance checks, including cybersecurity components of Privacy Practices Benchmark
• • Overseeing implementation of a cybersecurity framework (per Board Rule R277-487)
• • Collaborating with data manager to respond to data incidents and breaches
• +1 more...

First Steps:

• 1. Sign up for Student Data Privacy newsletter
• 2. Familiarize with cybersecurity framework your LEA has adopted
• 3. Attend conferences and professional learning opportunities

Responsibilities:

• • Establish and enforce protocols for controlling access to student records
• • Manage and maintain data retention policies
• • Provide guidance and training to LEA staff on record management
• • Act as liaison between LEAs, parents, and state authorities
• +1 more...

First Steps:

• 1. Complete Records Officer Certification Course
• 2. Review Educational Retention Schedule
• 3. Familiarize with Quick Disposition Guide

📄 DPA Templates

• National Data Privacy Agreement (NDPA) v2.2

  Current standard template (released November 2025) with all exhibits. Used by SDPC member states nationwide.

• National Research Student Data Privacy Agreement (NRDPA)

  Template for research partnerships

• Early Interactive Software Provider NDPA (EISP-NDPA)

  Specialized template for early education software

• A Vendor's Guide to Utah DPAs

  Comprehensive guide explaining Utah requirements for vendors

📖 Guides

• Data Manager Onboarding Slides

  Presentation for new data managers

• Privacy Principles One-pager

  Quick reference for core privacy principles

• Cyber Threats vs. Digital Threats One-pager

  Understanding the difference between threat types

• Data Breach Reporting and Notification Requirements

  Step-by-step guide for breach response

• 2024 H.B. 182 Guidance for LEA Leaders on Student Surveys

  Legislative guidance on survey compliance

🎓 Training

• Data Privacy Basics

  Foundation course for all staff

• Handling Employee Data

  Privacy training for HR and administrative staff

• Office Staff Training

  Privacy training for front office personnel

• Sharing Data with Law Enforcement

  Guidelines for legal data disclosure requests

• 2025 Annual Privacy Practices Benchmark Webinar

  Annual compliance training

🔧 Tools

• Utah Vendor Agreement Registry

  Searchable database of 1,200+ vendor and product agreements—DPAs, NDPA exhibits, and statewide contracts

  Access →

• IAMSAFE Framework

  7-step edtech evaluation: Inventory, Appraise, Map, Score, Act, File, Evaluate. Designed for SB 267 compliance.

  Access →

• Academic Effectiveness Rubric

  6-dimension, 5-star scoring system aligned to ESSA evidence tiers. Evaluates pedagogy, engagement, accessibility, data practices, addictive design, and equity.

  Access →

• USPA Application Menu

  Google Sheet tracking approved apps statewide

• Utah DPA Negotiation Tracker Form

  Submit new DPA negotiations

• Utah DPA Negotiation Tracker Sheet

  Dashboard of all ongoing negotiations

• USBE Data Breach Reporting Form

  Official form for reporting breaches to USBE

● Mandatory Designations

• ✓ Data Manager (Utah Code 53E-9-303) - REQUIRED
• ✓ Information Security Officer - REQUESTED
• ✓ Appointed Records Officer - REQUIRED (Annual certification)

● Annual Requirements

• ✓ Privacy Practices Benchmark submission
• ✓ Cybersecurity framework compliance review
• ✓ Records Officer recertification
• ✓ Privacy policy updates
• ✓ Staff training completion

● Ongoing Requirements

• ✓ DPA management with all vendors accessing student data
• ✓ SB 267 edtech product evaluations (effective July 1, 2026)
• ✓ Data breach reporting (within required timelines)
• ✓ GRAMA request responses
• ✓ Participation in USPA
• ✓ Newsletter subscription and monitoring