Law / United States / 
Georgia
Student Data Privacy, Accessibility, and Transparency Act, chief privacy officer
In force since .
An enforcement supervision rule binding government bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Designate a senior Department of Education employee as the department's chief privacy officer, with primary responsibility for data privacy and security policy (Code Section 20-2-663(a)).
- Have the chief privacy officer establish department-wide privacy policies, conduct privacy impact assessments of the department's legislative proposals, regulations and program initiatives, and ensure that student data in the state data system is handled in compliance with the Act and the Family Educational Rights and Privacy Act (Code Section 20-2-663(a)(1) to (4)).
- Establish and operate a department-wide Privacy Incident Response Program so that incidents involving department data are properly reported, investigated and mitigated (Code Section 20-2-663(a)(8)).
- Prepare an annual report to the General Assembly on department activities that affect privacy, including complaints of privacy violations and internal controls (Code Section 20-2-663(a)(6)).
- Have the chief privacy officer, in consultation with the Attorney General's office, issue a guidance document by , and review and update it by July 1 each year, for regional educational service agencies, local education agencies, schools, the Department of Juvenile Justice school system and the state agencies serving students, on the state and federal law protecting student data, including what may be shared with other schools and with law enforcement and the courts (Code Section 20-2-663(c), added by House Bill 268 of 2025).
These lines are LexLint's reading of the law's text.
What record it asks for
Who may demand the log
Regulator
Logging duty
Code Section 20-2-663 names a chief privacy officer who runs a Privacy Incident Response Program under which incidents involving department data are reported, investigated and mitigated, and who prepares an annual report to the General Assembly. The section states no log, record content or retention period, and the incident program is not described as a record the department keeps.
- Kind
- None
- As of
What this law does
The State School Superintendent must designate a senior Department of Education employee as the department's chief privacy officer, who assumes primary responsibility for data privacy and security policy. The chief privacy officer must establish and operate a department-wide Privacy Incident Response Program so that incidents involving department data are properly reported, investigated and mitigated.
The chief privacy officer must prepare an annual report to the General Assembly on department activities that affect privacy, including complaints of privacy violations, internal controls and other matters. The chief privacy officer may investigate compliance with the Act and with other state data privacy and security laws by the department and local boards of education.
Since House Bill 268 of 2025, the chief privacy officer, in consultation with the Attorney General's office, must promulgate a guidance document for all regional educational service agencies, local education agencies and elementary and secondary schools in the state, the Department of Juvenile Justice school system, the Department of Human Services, the Division of Family and Children Services and the Department of Defense Education Activity.
The guidance document must address the state and federal laws that protect student education records, student health records, student data and the personally identifiable information of students and their families. It also covers what may be shared with other educators, schools and those agencies, and what may be exchanged with law enforcement, judges and courts and other agencies with a legal interest in a student.
The document was due by , must be reviewed and updated by July 1 each year, and is posted on the department's public website with answers to frequently asked questions. The section took effect with the rest of Part I of Senate Bill 89 on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .