Data Security Practices for Education

NYS Education Law Section 2-d Part 121.5 addresses new Data Security and Privacy Standards that took effect in July 2020.

These new standards  require educational institutions and their third-party contractors to take a variety of steps to protect both institutional data and student data from potential outside cyber-threats, such as stealing data, holding information systems hostage and causing system disruptions.

The Law §2-d requires that each educational agency shall publish a parent’s bill of rights for data privacy and security. The law also requires that with each contract an educational agency enters with a third-party contractor, that receives personally identifiable information (PII), must contain a signed bill of rights and supplemental information. In turn, each educational agency will have to publish, on its website, the signed parent’s bill of rights and supplemental information to the bill of rights for each software contract.

Data Protection Officer (DPO)
Name: Greg Thom
Email: [email protected]
Phone: 607-263-6100
Mailing Address 65 W. Main Street, Morris, NY 13808

The NYSPA is a collaboration of New York school districts that share common concerns around student privacy. The goal of the NYSPA is to set standards of both practice and expectations around student privacy such that all parties involved have a common understanding of expectations.

To this end, the first outcome of the NYSPA is the adoption and implementation of a common Student Data Privacy Agreement to be used by all member schools when implementing any online application. By adopting such a contract all vendors and schools have common expectations when entering into a relationship or implementation without having to renegotiate terms in every new instance.

This site will be used to communicate both the districts and vendors that have signed the contract. This will enable all NYSPA member districts to leverage vendor relationships with other member schools to smoothly develop a new relationship.

Note: Information posted in the data privacy inventory tool is continually updated.