State auditor finds Nebo School District not fully compliant with data privacy law
A privacy audit identified four findings, including gaps in the district's breach-notification plan.
Based on reporting by Utah State Auditor reports. Read the original story →
The Utah State Auditor's office found that Nebo School District is not in full compliance with state data privacy requirements, according to a privacy audit report dated Oct. 13 and addressed to the school board and Superintendent Rick Nielsen. The audit covered the year ended Dec. 31, 2025, and assessed the district against the Utah Government Data Privacy Act. [1]
The auditors said the district has started a privacy program but that elements related to incident response, public disclosures, reporting and student rights remain incomplete. They reported four findings: the incident and breach methodology, privacy notices, the annual privacy program report, and the process for amending and correcting student records. [1]
On the first finding, the auditors said the district's incident response plan does not include notification requirements set by Utah law. Its notification appendix mainly references frameworks such as HIPAA and GDPR, and does not clearly document procedures for notifying the Utah Cyber Center, the Attorney General's office, affected individuals or the state superintendent over significant student-data breaches. The auditors recommended adding a Utah-specific notification section. [1]
The report states that the audit did not examine every form, system or record and does not express an opinion on compliance. [1]
Sources
This story was written by AI from the report by Utah State Auditor reports, which has the full story. How we write stories.