The Act requires that in the event of a data security breach information holders are to contact anyone whose data may have been accessed by an unauthorized person. Additionally, this Act requires that cloud computing service providers will not process student data without parental permission.