Law / United States / 
Arkansas
Student Data Vendor Security Act: duties of a local education agency
Student Data Vendor Security Act (Act 754 of 2023), local education agency duties
In force since .
A sensitive categories rule binding government bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Contract terms, Disclosure, Governance
- Audit expectation
- none
What it requires
- If you are a local education agency (a public school district or an open-enrollment public charter school), ensure that every contract that discloses or makes available student personally identifiable information to a vendor, including a school service contract provider, a school service on-demand provider or a subcontractor, includes express provisions that safeguard the privacy and security of that information (Act 754 of 2023, Sec. 1, local education agency section, subsection (a)).
- Maintain a list of the school service contract providers you contract with for school services that include or make available student personally identifiable information, update it at the beginning and mid-point of each school year, give a parent a copy on request, and keep a copy of each contract (local education agency section, subsection (b)(1)).
- Ensure that each contract you enter or renew with a school service contract provider on or after requires the provider to comply with the Act's data transparency and its data security and destruction requirements (local education agency section, subsection (b)(2)(A)).
- Do not enter into or renew a contract with a school service contract provider that refuses those terms or has substantially failed to comply with those requirements (local education agency section, subsection (b)(3)).
- When a school service contract provider commits a material breach that involves misuse or unauthorized release of student personally identifiable information, investigate it, give the provider an opportunity to respond, obtain the advice and direction of your governing body, and determine whether to terminate or continue the contract (local education agency section, subsection (b)(2)(B)).
- Maintain a list of the school service on-demand providers you or your employees use for school services that include or make available student personally identifiable information, update it at the beginning and mid-point of each school year, and give a parent a copy on request and help the parent obtain the provider's data privacy policy (local education agency section, subsection (c)(1)).
- If you cease using a school service on-demand provider because it does not substantially comply with its privacy policy or the Act's use-of-data and security requirements, notify the provider that it may respond in writing, notify the Department of Education, and give the Department a copy of any written response (local education agency section, subsection (c)(3)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
The subchapter requires a local education agency to keep lists of the vendors it uses and a copy of each contract with a school service contract provider. Those are records of vendors and contracts, kept for parents and for oversight of the contracts, and the subchapter names no log of events and no reader of one other than a parent's request for the list.
- Kind
- None
- As of
What this law does
A local education agency is a public school district or an open-enrollment public charter school. Each local education agency must ensure that all contracts that disclose or make available student personally identifiable information to vendors, including subcontractors, include express provisions that safeguard its privacy and security.
Each local education agency must maintain a list of the school service contract providers it contracts with for school services that include or make available student personally identifiable information, and update the list at the beginning and mid-point of each school year. A local education agency must give a parent a copy of that list on request and maintain a copy of each contract with a school service contract provider.
A local education agency must ensure that the terms of a contract it enters or renews with a school service contract provider on and after require the provider to comply with the data transparency and the data security and destruction requirements.
When a school service contract provider commits a material breach of a contract involving misuse or unauthorized release of student personally identifiable information, the local education agency must investigate, give the provider an opportunity to respond, obtain the advice and direction of its governing body, and determine whether to terminate or continue the contract.
A local education agency may not enter into or renew a contract with a school service contract provider that refuses the required contract terms or has substantially failed to comply with the data transparency and the data security and destruction requirements.
A local education agency must maintain a list of the school service on-demand providers that it or its employees use for school services that include or make available student personally identifiable information, and update the list at the beginning and mid-point of each school year.
A local education agency that has evidence a school service on-demand provider does not substantially comply with its privacy policy or does not meet the use-of-data and security requirements may cease or refuse to use that provider and prohibit its employees from using it.
On a parent's request, a local education agency must provide a copy of the list of school service on-demand providers and, on the parent's further request, assist the parent in obtaining the data privacy policy of those providers.
A local education agency that ceases or refuses to use a school service on-demand provider for those reasons must notify the provider that it may submit a written response, notify the Department of Education if it ceases using the provider, and provide a copy of any written response the provider submits.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .