Sectors
Student data privacy for school districts
The laws governing student data, the vendor agreements they require, and the practices districts need.
School districts hold extensive data about children: academic records, health information, special education records, discipline, and increasingly data generated by learning platforms. Multiple laws govern it, and vendor relationships are where compliance most often breaks down.
The legal framework
The Family Educational Rights and Privacy Act governs education records at the federal level. The Children's Online Privacy Protection Act governs online collection from children under thirteen. Many states have student privacy statutes that go further, regulating vendor use of data and requiring specific contract terms. Districts must comply with all that apply.
Vendor agreements
Learning platforms, assessment tools, and classroom apps all receive student data. State laws and district policy typically require written agreements addressing permitted use, prohibition on advertising, security, breach notification, and data deletion. Districts often participate in consortium agreements that standardize these terms.
Practices
Inventory. Know every application that receives student data, including ones teachers adopt on their own.
Approval process. A path for teachers to request tools, with privacy review.
Data minimization. Share only the data a tool needs.
Single sign-on. Rostering and authentication through the district's identity system rather than separate accounts.
Retention. Rules for how long data is kept in each system and how it is deleted.
Security. The same fundamentals as any organization: multi-factor authentication, backups, patching, and awareness, with attention to the ransomware risk districts face.
Technology work
Rostering and identity integration, application inventory tooling, data warehouse design with privacy controls, and secure state reporting pipelines.
What to expect from vendors
Expect a privacy agreement, a security questionnaire, and questions about data location and deletion. Districts that ask are doing their job.