(1) If a significant data breach occurs at an institution, the institution shall notify each student whose personally-identifiable student data was disclosed.
(2) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the board shall make rules to define a significant data breach described in Subsection (1).