Which of the following must a school or district do once it receives a complaint that an unauthorized release of protected data occurred?
A) Investigate the complaint
B) Ignore the complaint if it seems minor
C) Immediately notify the media
D) Delete all records related to the complaint