families must be notified of an unauthorized disclosure of their students' pii within how many days?

Families must be notified of an unauthorized disclosure of their students' personally identifiable information (PII) as soon as possible and no later than 60 calendar days after the discovery of the breach. This notification period can be extended beyond 60 days only if notification would interfere with an ongoing law enforcement investigation or cause further disclosure due to an unfixed security vulnerability; in such cases, notification must occur within 7 days after the investigation or vulnerability is resolved.