# Utah Code § 53E-9-311: Disclosure of educational data -- Informed consent -- Access and disclosure > Utah · Statutes · In force URL: https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_311 ## Section - **Citation:** Utah Code § 53E-9-311 - **Heading:** Disclosure of educational data -- Informed consent -- Access and disclosure - **Jurisdiction:** Utah - **Kind:** Statutes - **Status:** In force - **Text as of:** August 14, 2026 - **Source:** Compiled text - **Location:** Utah Code / Title 53E / Chapter 53E-9 / § 53E-9-311 ## Text 7/1/2026 (1) As used in this section: (a) "Educational data" means a student's: (i) transcript data; (ii) enrollment information; (iii) course history; and (iv) academic credentials. (b) "Informed consent" means the same as that term is defined in Section 53H-7-1001. (2) In accordance with the Family Educational Rights and Privacy Act, 20 U.S.C. Sec. 1232g, this chapter, and other relevant state and federal privacy laws, a student who is currently enrolled in, or has previously been enrolled in, an education entity, or a parent if the student is under 18 years old, has the right to: (a) access the student's educational data; and (b) authorize access to the student's educational data in accordance with this section. (3) An education entity shall: (a) subject to Subsection (9), disclose a student's educational data; (b) beginning July 1, 2027, offer a secure digital or electronic mechanism as the primary method for obtaining informed consent under this section; (c) allow informed consent in written form if a digital or electronic mechanism is not reasonably available to the student; (d) when obtaining a student's consent through a digital or electronic consent mechanism: (i) allow the student to review all consent information before authorization; and (ii) prohibit the bundling of unrelated terms or conditions with the consent request; and (e) regarding a limitation imposed under Subsection (5)(b): (i) clearly disclose the limitation at the time the entity grants access; and (ii) provide a reasonable mechanism that allows a student to re-access educational data after the expiration of a time-based or session-based limitation. (4) An education entity may impose reasonable time-based or session-based limitations on a student's technical method of access to educational data. (5) An education entity may not: (a) deny, delay, or restrict a student's ability to grant informed consent that complies with this section; (b) require a student to waive unrelated rights or agree to unrelated terms as a condition of granting informed consent; and (c) impose a limitation under Subsection (5)(b) that: (i) restricts the student's underlying right to access the student's educational data; (ii) prevents the student from requesting renewed access; or (iii) limits the student's ability to provide informed consent for disclosure of the student's educational data. (6) (a) If a student is under 18 years old and the disclosure is to a party other than the student, an education entity shall obtain the parent's consent in accordance with this section. (b) The restrictions described in Subsection (5) apply to a parent of a student if the student is under 18 years old. (7) This section does not alter, limit, or supersede any right or obligation under: (a) the Family Educational Rights and Privacy Act, 20 U.S.C. Sec. 1232g; (b) this chapter; or (c) any other applicable state or federal privacy law. (8) The state board may issue nonbinding guidance regarding best practices for consent mechanisms that comply with the requirements of this section. (9) Except as provided in the Family Educational Rights and Privacy Act, 20 U.S.C. Sec. 1232g, an education entity shall disclose a student's educational data to a third party under this section only: (a) with the informed consent of the student; (b) according to the terms of the document expressing the student's informed consent; and (c) subject to the agreement of the third party receiving the student's educational data: (i) to use the student's educational data only as provided in the document expressing the student's informed consent to the disclosure; and (ii) to not redisclose the student's educational data to any other party. (10) A third party that receives the educational data of more than 10 students is subject to: (a) the data privacy requirements described in Title 53E, Chapter 9, Part 3, Student Data Protection; and (b) policies and administrative rules the state board adopts to protect student data. (11) (a) A student whose educational data is shared as a result of a violation of a third party's failure to comply with the requirements of this section has a private right of action against the third party. (b) A student described in Subsection (11)(a) does not have a private right of action against the education entity. ## Nearby sections - [Utah Code § 53E-9-101 § 53E-9-101. Title.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_101.md) - [Utah Code § 53E-9-202 § 53E-9-202. Application of state and federal law to the administration and operation of public schools -- Local school board and charter school governing board policies.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_202.md) - [Utah Code § 53E-9-203 § 53E-9-203. Activities prohibited without prior written consent -- Validity of consent -- Qualifications -- Training on implementation.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_203.md) - [Utah Code § 53E-9-204 § 53E-9-204. Access to education records -- Training requirement -- Certification.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_204.md) - [Utah Code § 53E-9-205 § 53E-9-205. Parental right to student information.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_205.md) - [Utah Code § 53E-9-301 § 53E-9-301. Definitions.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_301.md) - [Utah Code § 53E-9-302 § 53E-9-302. State student data protection governance.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_302.md) - [Utah Code § 53E-9-303 § 53E-9-303. Local student data protection governance.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_303.md) - [Utah Code § 53E-9-304 § 53E-9-304. Student data ownership and access -- Notification in case of significant data breach.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_304.md) - [Utah Code § 53E-9-305 § 53E-9-305. Collecting student data -- Prohibition -- Student data collection notice -- Written consent.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_305.md) - [Utah Code § 53E-9-306 § 53E-9-306. Using and expunging student data -- Rulemaking -- Disciplinary records.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_306.md) - [Utah Code § 53E-9-307 § 53E-9-307. Securing and cataloguing student data.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_307.md) - [Utah Code § 53E-9-308 § 53E-9-308. Sharing student data -- Prohibition -- Requirements for student data manager -- Authorized student data sharing.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_308.md) - [Utah Code § 53E-9-309 § 53E-9-309. Third-party contractors.](https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_309.md) --- Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/STATE_UT_T53E_S53E_9_311. Check the current official text before relying on it. Not legal advice.