ut-20261015-R765-1002: R765-1002. UDRC Participating State Agency Access

1. Agency Information

Title catchline: Higher Education (Utah Board of), Administration Building: Utah Board of Higher Education Building, The Gateway Street address: 60 S 400 W City, state: Salt Lake City, UT 84101

2. Contact Persons

Name: Phone: Email: Hilary Renshaw 801-646-4784 Hilary.renshaw@ushe.edu Alison Adams 801-646-4784 Alison.adams@ushe.edu Geoffrey T. Landward 801-646-4784 Glandward@ushe.edu Please address questions regarding information on this notice to the persons listed above.

A. Rule or section catchline:

R765-1002. UDRC Participating State Agency Access

B. Purpose of the new rule or reason for the change:

This new proposed administrative rule, R765-1002, is being enacted to provide for the administration of the Utah Data Research Center (UDRC) participating state agency access program established under Section 53H-13-305. This new rule establishes the requirements for participation agreements between the UDRC and participating state agencies before data may be collected for the state agency access program and outlines the procedures for data protection and data exchange.

C. Summary of the new rule or change:

New administrative Rule R765-1002 establishes the requirements for participation agreements between the UDRC and participating state agencies before data may be collected for the state agency access program and outlines the procedures for data protection and data exchange. This rule also sets out the minimum elements that must be included in the participation agreements, the required minimum end user term provisions, necessary data protection procedures, and the requirements for an accessing agency to complete a data exchange service request. 5. Fiscal Information Provide an estimate and written explanation of the aggregate anticipated cost or savings to:

A. State budget:

New Rule R765-1002 will not have any fiscal impact on the state budget. There is no fiscal impact on the state budget because this new rule provides for the administration of the UDRC participating state agency access program established under Section 53H-13-305. This rule does not impose any requirements that would create either any cost to or savings for the state budget. UTAH STATE BULLETIN, October 15, 2026, Vol. 2026, No. 20 163 NOTICES OF PROPOSED RULES

B. Local governments:

New Rule R765-1002 will not have any fiscal impact on local governments. There is no fiscal impact on local governments because this new rule provides for the administration of the UDRC participating state agency access program established under Section 53H-13-305. This rule does not impose any requirements that would create either any cost to or savings for local governments.

C. Small businesses ("small business" means a business employing 1-49 persons):

New Rule R765-1002 will not have any fiscal impact on small businesses. There is no fiscal impact on small businesses because this new rule provides for the administration of the UDRC participating state agency access program established under Section 53H-13-305. This rule does not impose any requirements that would create either any cost to or savings for small businesses.

D. Non-small businesses ("non-small business" means a business employing 50 or more persons):

New Rule R765-1002 will not have any fiscal impact on non-small businesses. There is no fiscal impact on non-small businesses because this new rule provides for the administration of the UDRC participating state agency access program established under Section 53H-13-305. This rule does not impose any requirements that would create either any cost to or savings for non-small businesses. E. Persons other than small businesses, non-small businesses, state, or local government entities ("person" means any individual, partnership, corporation, association, governmental entity, or public or private organization of any character other than an agency): New Rule R765-1002 will not have any fiscal impact on persons other than small businesses, non-small businesses, state, or local government entities. There is no fiscal impact on persons other than small businesses, non-small businesses, state, or local government entities because this new rule provides for the administration of the UDRC participating state agency access program established under Section 53H-13-305. This rule does not impose any requirements that would create either any cost to or savings for persons other than small businesses, non-small businesses, state, or local government entities.

F. Compliance costs for affected persons:

This rule does not impose any compliance costs for affected persons because this new rule provides for the administration of the UDRC participating state agency access program established under Section 53H-13-305 and the rule's requirements do not impose or create any compliance costs. 6. Regulatory Impact Summary Table Enter the cost or savings in the relevant cell. If there is no cost or savings, enter, "$0." If a cost or savings is inestimable, enter, "inestimable." Fiscal Cost FY2027 FY2028 FY2029 FY2030 FY2031 State Budget $0 $0 $0 $0 $0 Local Governments $0 $0 $0 $0 $0 Small Businesses $0 $0 $0 $0 $0 Non-Small Businesses $0 $0 $0 $0 $0 Other Persons $0 $0 $0 $0 $0 Total Fiscal Cost $0 $0 $0 $0 $0 Fiscal Benefits FY2027 FY2028 FY2029 FY2030 FY2031 164 UTAH STATE BULLETIN, October 15, 2026, Vol. 2026, No. 20 NOTICES OF PROPOSED RULES State Budget $0 $0 $0 $0 $0 Local Governments $0 $0 $0 $0 $0 Small Businesses $0 $0 $0 $0 $0 Non-Small Businesses $0 $0 $0 $0 $0 Other Persons $0 $0 $0 $0 $0 Total Fiscal Benefits $0 $0 $0 $0 $0 Net Fiscal Benefits $0 $0 $0 $0 $0 7. Regulatory Impact Analysis Approval The Utah Commissioner of Higher Education, Geoffrey Landward, has reviewed and approved this regulatory impact analysis. 8. Family Impact Information

B. Summary of reasonable alternatives or modifications:

The Utah Board of Higher Education does not expect that the implementation of new proposed Rule R765-1002 will have a measurable negative impact on family health, stability, or formation, and as such, no alternatives or modifications are necessary. 9. Citation Information Provide citations to the statutory authority for the rule. If there is also a federal requirement for the rule, provide a citation to that requirement: Subsection 53H-15-305(6) 11. Public Notice Information The public may submit written or oral comments to the agency identified in box 1.

A. Comments will be accepted until: 11/16/2026

12. Effective Date Information This rule change MAY become effective on: 11/23/2026 (NOTE: This is the date the agency anticipates making the filing effective. It is NOT the effective date) 13. Agency Authorization Information Agency head or Alison Adams, Board Secretary and Date: 09/21/2026 designee and title: Designee R765. Higher Education (Utah Board of),Administration. R765-1002. UDRC Participating StateAgencyAccess. R765-1002-1. Purpose. To provide for the administration of the Utah Data Research Center (UDRC) participating state agency access program established under Section 53H-15-305. R765-1002-2. Authority. This rule is authorized by Subsection 53H-15-305(6). R765-1002-3. Definitions. Except as provided in Subsection R765-1002-3(7), the definitions in Sections 53H-1-101, 53H-15-101, and 63A-19-101 apply to this rule. (1) "Accessing agency" means a department, division, office, entity, agency, or other unit of state government that requests access to, or receives, data through the UDRC state agency access program. (2) "Agency data" means program data associated with a specific participating state agency by being: (a) provided by the participating state agency; or (b) derived from data provided by the participating state agency. UTAH STATE BULLETIN, October 15, 2026, Vol. 2026, No. 20 165 NOTICES OF PROPOSED RULES (3) "Aggregate data" has the meaning given in Section 53H-14-101. (4) "Data exchange service" means a technical service administered by the UDRC state agency access program that makes specific agency data available to an accessing agency. (5) "Data exchange service request" means a request by an accessing agency for access to a data exchange service that meets the requirements under Subsection (2). (6) "Data subject" means the person about whom information is stored by the UDRC state agency access program in a physical or electronic record. (7) "De-identified data" has the meaning given in Section 53H-15-101. (8) "Exchanged data" means data made available to an accessing agency by the UDRC state agency access program through a data exchange service. (9) "Operational transactional purpose" means the processing of data regarding an individual by an accessing agency to provide goods or services to the individual. (10) "Participation agreement" means a written agreement establishing the terms and conditions under which a participating state agency provides data to the UDRC state agency access program. (11) "Program data" means data that the UDRC processes under the state agency access program. (12) "Providing state agency" means the participating state agency associated with the agency data made available to accessing agencies as exchanged data through a data exchange service. (13) "State agency access program" means the participating state agency access program established under Section 53H-15-305. R765-1002-4. ParticipationAgreements. (1) The UDRC shall enter into a participation agreement with a participating state agency before collecting data for use in the state agency access program. (2) Aparticipation agreement shall include the following minimum elements: (a) specifying the personal data that the participating state agency will share with the UDRC; (b) defining the purposes for which the UDRC may use the personal data contributed by the participating state agency; (c) identifying the data exchange services that the UDRC will administer using the participating state agency's data; (d) stating which accessing agencies may access the participating state agency's data; (e) requiring the UDRC to inform a participating state agency of each accessing agency's access to a data exchange service before the UDRC grants the accessing agency access to the data exchange service; (f) permitting a participating state agency to suspend or terminate: (i) a data exchange service; or (ii) an accessing agency's access to a data exchange service. (g) establishing data disposition requirements and timelines for disposing of personal data the participating state agency discloses when the personal data is no longer needed for the state agency access program in compliance with state and federal law; (h) specifying the end user terms applicable to the agency data; and (i) prohibiting the UDRC from disclosing agency data to any party unless the party agrees to comply with the end user terms applicable to the agency data. (3) End user terms shall include the following minimum provisions: (a) licensing the accessing agency to process agency data subject to the requirements of the data exchange service request, end user terms, applicable federal and state laws including Section 53H-15-305, and this rule; (b) requiring the accessing agency to limit the accessing agency's processing of exchanged data for the purposes specified in the data exchange service request; (c) requiring the accessing agency to limit access to exchanged data to authorized accessing agency personnel, data subjects or their representatives, or as otherwise required by law; (d) acknowledging that the UDRC or the participating state agency whose agency data is made available to the accessing agency as exchanged data through the data exchange service may suspend or terminate the data exchange service or the accessing agency's access to the data exchange service; and (e) requiring the accessing agency to comply with: (i) applicable federal and state laws to which access to agency data through the data exchange service is subject; (ii) data security requirements applicable to the exchanged data; (iii) conditions under which the accessing agency may redisclose exchanged data; (iv) data disposition timelines and procedures applicable to the exchanged data; and (v) any other terms or conditions required by the UDRC or the participating state agency to which the accessing agency's access to exchanged data through the data exchange service is subject. R765-10002-5. Data Protection Procedures. (1) The UDRC shall process personal data in a manner that is consistent with an individual's fundamental interest in and inherent expectation of privacy regarding the individual's personal data that the individual provides to a governmental entity in accordance with Subsection 63A-19-102(1). (2) The UDRC shall adopt and implement reasonable physical, technical, or administrative controls that protect against unauthorized access, use, or redisclosure of data in possession of the UDRC by: (a) limiting access to program data to: 166 UTAH STATE BULLETIN, October 15, 2026, Vol. 2026, No. 20 NOTICES OF PROPOSED RULES (i) authorized UDRC personnel; (ii) participating state agency personnel authorized to access the participating state agency's agency data; and (iii) accessing agency personnel authorized to access exchanged data through a data exchange service; (b) limiting the redisclosure of data to accessing agencies for purposes permitted under Section 53H-15-305, this rule, and the participation agreement governing the data; and (c) ensuring that all data environments and systems in which the UDRC processes program data are protected in accordance with: (i) if the environment or system is operated by the UDRC, an industry-recognized system of security standards and requirements for protecting personal data; or (ii) if the environment or system is a cloud service offering, the FedRAMP Moderate Impact Baseline Security Controls standard. (3) The UDRC shall adopt and maintain a data incident response plan that: (a) is consistent with the requirements of: (i) Board Policies R345, Information Technology Resource Security; R1010, Data Breaches; and R1013, Scope of the Data Breach Requirements in the Utah Government PrivacyAct; and (ii) FedRAMP Moderate Impact Baseline Security Controls; and (b) requires: (i) prompt notification of and cooperation with affected participating state agencies; (ii) compliance with the data breach notification requirements of Sections 53H-14-504, 63A-19-405, and 63A-19-406 to the extent applicable; (iii) compliancewithanyrequirementsspecifiedinaparticipationagreementapplicabletotheagencydataaffectedbyadataincident; and (iv) compliance with any additional relevant laws, regulations, or policies. (4) The UDRC shall not: (a) process data from any party that is not a participating state agency; or (b) make program data available to any party that is not an accessing agency. R765-1002-6. Data Exchange ServiceAccess. (1) An accessing agency shall complete a data exchange service request before accessing agency data through a data exchange service. (2) An accessing agency making a data exchange request shall: (a) specify the purpose for which the accessing agency will use the exchanged data; (b) acknowledge that the UDRC or the providing state agency may suspend or terminate the data exchange service or the accessing agency's access to the data exchange service at any time; and (c) accept and comply with the terms and conditions established by the UDRC and the providing state agency to which access to exchanged data through a data exchange service is subject. (3) The UDRC shall only make agency data available to an accessing agency under a data exchange service request if: (a) the UDRC approves the data exchange service request in accordance with the participation agreement governing the data exchange service; or (b) the UDRC requests review of the data exchange service request by the providing state agency to which the accessing agency has requested access under the data exchange service request and the providing state agency approves the data exchange service request. (4) Nothing in Subsection R765-1002-7(3) shall be construed as requiring the UDRC to request that a providing state agency review or approve a data exchange service where the relevant participation agreement does not otherwise require approval of the data exchange service request by the providing state agency. KEY: higher education, Utah Data Resource Center, state agency access Date of Last Change: 2026 Authorizing, and Implemented or Interpreted Law: 63G-3-402 NOTICE OF SUBSTANTIVE CHANGE TYPE OF FILING: Amendment Filing ID: 58287