Serves K-12 schools, in Connecticut

Conn. Gen. Stat. § 10-10a · Read the law's page

• If you are the Department of Education, develop and implement a state-wide public school information system designed to establish a standardized electronic data collection and reporting protocol and to maintain the confidentiality of individual student and staff data (section 10-10a(b)).when it serves a public body
• Assign a unique student identifier to each student before tracking the student's performance in the system (section 10-10a(b)).when it serves a public body
• Track and report the student, teacher, school and district data elements section 10-10a(c) lists, including for students the primary language spoken at the home of a student, student transcripts, and student attendance and student mobility, and from July 1, 2026 the data section 10-17m requires on the academic progress of students in bilingual education programs (section 10-10a(c)(1), as replaced by Public Act 26-1, section 22).when it serves a public body
• If you are the Department of Education, provide data maintained under section 10-10a to a full-time permanent employee of an educational nonprofit organization exempt under Section 501(c)(3) who requests it in writing, not later than sixty days after the request and at the requesting party's reasonable cost (section 10-10a(h)).for a public body
• If you are a school district, participate in the system and report all necessary information it requires (section 10-10a(f)).for a public body
• If you are a local or regional board of education or a preschool program that receives state or federal funding, participate in the system in the manner the Commissioner of Education prescribes (section 10-10a(g)).

Conn. Gen. Stat. §§ 10-234aa to 10-234dd · Read the law's page

• If you are an operator of an Internet web site, online service or mobile application used for school purposes, implement and maintain security procedures and practices that meet or exceed industry standards to protect student information, student records and student-generated content (section 10-234cc(a)(1)).
• Delete student information, student records or student-generated content within a reasonable time when a student, parent, legal guardian or local or regional board of education with the right to control it requests deletion, unless state or federal law bars deletion or requires retention, or the data sits in an inaccessible disaster recovery copy (section 10-234cc(a)(2)).
• Do not knowingly engage in targeted advertising based on student information or persistent unique identifiers acquired through school use, collect, store or use student information for purposes other than school purposes, or sell, rent or trade it except in an acquisition where the successor stays bound, and disclose it only on the grounds section 10-234cc(b)(4) lists (section 10-234cc(b)).
• If you are a contractor of a local or regional board of education, sign a written contract that carries the statements section 10-234bb(a) requires, including that the data is not the contractor's property, may be used only as the contract authorizes, is deleted on request and is not retained after the contract expires (section 10-234bb(a)).
• As a contractor, implement and maintain security procedures and practices designed to protect student information, student records and student-generated content, using technologies consistent with federal guidance under section 13402(h)(2) of Public Law 111-5, technical safeguards consistent with 45 CFR 164.312, and otherwise meeting or exceeding industry standards. Do not use the data for purposes other than the contract, or use personally identifiable information in it for targeted advertising (section 10-234bb(c) and (d)).
• After discovering a breach of security that results in unauthorized release, disclosure or acquisition of student information, notify the local or regional board of education without unreasonable delay and within thirty days, or within sixty days where the data is directory information, student records or student-generated content (section 10-234dd(a)).
• If you are an operator holding student data from a student's use of your service, notify the student or the student's parents or guardians of such a breach without unreasonable delay and within thirty days, or sixty days for directory information, student records or student-generated content (section 10-234dd(b)).