Serves K-12 schools, in Delaware

Del. Code Ann. tit. 14, §§ 8101A to 8106A · Read the law's page

• If you operate a website, online or cloud computing service, online application or mobile application with actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for them, or you collect, maintain or use student data in a digital or electronic format for K-12 school purposes, implement and maintain reasonable security procedures and practices appropriate to the nature of the student data, which at a minimum comply with the Department of Technology and Information's Cloud and Offsite Hosting Policy and include the terms of its Cloud and Offsite Hosting Template for Non-Public Data.
• Delete a student's data within a reasonable timeframe, not to exceed 45 calendar days, if a school district or school requests deletion of data under its control.
• Do not knowingly engage in targeted advertising, on your service or any other, based on student data, state-assigned student identifiers or other persistent unique identifiers acquired because of the use of your covered service.
• Do not knowingly use information created or gathered by your covered service, including state-assigned student identifiers or other persistent unique identifiers, to amass a profile about a student except in furtherance of K-12 school purposes.
• Do not knowingly sell student data. The bar does not apply to the purchase, merger or other acquisition of the operator by another entity that continues to be subject to the chapter for previously acquired student data.
• Do not knowingly disclose student data unless the disclosure is for a reason section 8105A(4) lists: furthering the K-12 school purposes of the service (the recipient may not further disclose it except to allow or improve operability and functionality within the student's classroom or school), legal or regulatory compliance, judicial process, protecting the security or integrity of the service, protecting the safety of users or others, or a service provider you bind by contract to use the data only to provide the contracted service, not to disclose it to subsequent third parties, and to comply with the chapter's security and use limits.

Del. Code Ann. tit. 14, § 4111 · Read the law's page

• If you are a public or private school in Delaware, treat the educational records of your students as confidential, and release them or disclose the personally identifiable information in them only in accordance with the Family Educational Rights and Privacy Act (20 U.S.C. 1232g) and its implementing regulations (34 C.F.R. Part 99) and, for students with disabilities, chapter 31 of title 14 (section 4111(a)).
• If you are an educational institution or program operating in Delaware, including a local education agency or a postsecondary institution or program regulated by a state agency, disclose to the Department of Education the education records, and the personally identifiable information in them, that it needs for the audit or evaluation of state and federal education programs, in accordance with the Family Educational Rights and Privacy Act and its implementing regulations (section 4111(b)(1)).
• If you are a public or private school in Delaware, allow parents and eligible students to inspect and review the education records of their children or themselves, in accordance with the rules and regulations of the Department of Education (section 4111(c)).
• If you are a local education agency or other educational institution or program that outsources data exchange and federal and state reporting to the Department of Education and discloses education records to it without parental consent as a school official, do so only where you would otherwise use your own employees to collect the data, you directly control the Department's use and maintenance of your records, the Department is subject to the Family Educational Rights and Privacy Act's rules on use and redisclosure, and you use reasonable methods to ensure the Department obtains access only to the records necessary for data exchange and federal or state reporting required by law (section 4111(b)(2)).
• If you are the Department of Education, use, compile, maintain, protect, distribute, redisclose and destroy education records, and the personally identifiable information in them, only in compliance with the Family Educational Rights and Privacy Act and its implementing regulations and any other pertinent federal or state privacy statute (section 4111(b)(4)).for a public body