1. (1)

   1. (a) An institution shall adopt policies to protect student data in accordance with this part and board rule, including the standards the board establishes under Subsection 53H-14-502(5).
   2. (b) The policies described in Subsection (1)(a) shall take into account the specific needs and priorities of the institution.
2. (2) The board shall designate a higher education privacy officer.

3. (3) The higher education privacy officer shall:

   1. (a) verify compliance with student privacy laws, rules, and policies throughout the Utah System of Higher Education;
   2. (b) support institutions in developing data governance plans and student data privacy training; and
   3. (c) act as the primary point of contact for the state privacy auditor.

4. (4) An institution shall:

   1. (a) designate an individual to act as the primary contact for the higher education privacy officer;

   2. (b) create and maintain an institution:

      1. (i) data governance plan that complies with the standards the board establishes under Subsection 53H-14-502(5); and
      2. (ii) record of student data privacy training; and
   3. (c) annually publish the institution's data governance plan on the institution's website.

Renumbered and Amended by Chapter 8, 2025 Special Session 1