The goal is to protect student data with the same intention that schools protect students from physical harm. Per FERPA, if a district is sharing student PII with a third party, the district is to utilize one of the FERPA exceptions or parental consent is required.
While tools are available to provide a grade or highlight a provider’s data security posture, this is only one of the initial steps in developing a student data governance program. An agreement provides your district with assurances that the provider is aware of your requirements and responsibilities, and you are aware of theirs. This process creates community trust and confidence that your district is following best practices in securing their child’s data.
Typical DPA Provisions Are:
- Lists the specific resources that are covered.
- Includes language that districts have direct control over the student records, so the district is FERPA compliant.
- Binds successors to the same agreement when a company is bought/sold.
- Prohibits targeted advertising.
- States the provider’s data security and data breach requirements.
- Identifies what data the provider collects and how they protect the data.
- Contains provisions for data sharing, data storing, data de-identification, and deletion of data.
- Includes a request for data deletion form.
- The provider will include what security framework/practices they use.
- Includes any state law requirements.
- If data is breached by either party, the agreement outlines the district and provider’s responsibilities.
Missouri National Data Privacy Agreement (MO-NDPA) Provisions
- The MO-NDPA uses the school official exception, designating the provider as a school official so the district is FERPA compliant.
- Includes the Missouri state laws on data privacy.
- Streamlines the process by allowing other districts to subscribe to another MO district’s signed agreement.
Included in the MOSPA service is the MO National Data Privacy Agreement (MO-NDPA) which is an agreement for student data privacy language only and is signed between the district and provider. It is used in parallel with the terms of service agreement and explains the responsibilities of the district and the provider pertaining to shared student data.
To learn more about MOREnet can assist your district with student data privacy, please go to: