Data Privacy Agreement

What Is a Data Privacy Agreement?

A Data Privacy Agreement (DPA) is a legal contract between a school district (or other LEA) and a vendor that defines how student data will be collected, used, stored, shared, and protected. DPAs are increasingly required before any EdTech vendor can access student information.

Many states have enacted laws requiring DPAs for technology vendors serving K-12 schools. Some states have standardized DPA templates through organizations like the Student Data Privacy Consortium (SDPC), which provides a nationally recognized framework.

What a DPA Covers

• Data collected. What student data the vendor will access and collect.
• Purpose limitations. How the data can be used (educational purposes only, no marketing, no sale).
• Security requirements. Encryption, access controls, audit logging, and incident response.
• Data retention and deletion. How long data is kept and how it is deleted when the contract ends.
• Breach notification. How quickly and through what channels the vendor must notify the district of a data breach.
• Subprocessor controls. Whether the vendor can share data with third parties and under what conditions.
• FERPA and COPPA compliance. Vendor attestations to federal privacy law compliance.

Why DPAs Matter for Vendors

• Required for sales. Many districts will not evaluate your product until a DPA is signed. Having DPA templates ready accelerates the sales process.
• State mandates. States including California, New York, Illinois, Colorado, and Connecticut require signed DPAs for EdTech vendors. The list is growing.
• Competitive advantage. Vendors with clean, ready-to-sign DPAs close faster than those who negotiate from scratch.

SDPC National DPA

The Student Data Privacy Consortium has developed a standardized DPA that has been adopted by many states. Signing the SDPC National DPA streamlines the process because districts in participating states accept the standard form rather than requiring custom negotiations.

Preparing for DPA Requirements

1. Adopt the SDPC National DPA template. Pre-sign it so districts can execute quickly.
2. Complete a security assessment. Districts will ask about encryption, access controls, SOC 2 compliance, and data handling procedures.
3. Document your data practices. Map what student data you collect, how it flows through your systems, who has access, and how it is deleted.
4. Designate a privacy contact. Districts need a named individual they can reach for data privacy questions and breach notifications.
5. Review state-specific requirements. Each state may add requirements on top of the national template. Know the rules in your target states.