In the event of a security breach or unauthorized disclosure of student data or personally identifiable information of any student, whether by a school district, the department, the state board of education, state agency, or other entity or third party given access to student data or personally identifiable information of any student, the school district, department, state board of education, state agency, or other entity or third party shall immediately notify each affected student, if an adult, or the parent or legal guardian of the student, if a minor, of the breach or unauthorized disclosure and investigate the causes and consequences of the breach or unauthorized disclosure.