Law / United States / 
Idaho
Student Data Accessibility, Transparency and Accountability Act (SDATAA)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Data subject rights, Breach notice, Consent, Retention, Transfer, Security, Governance
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Filed with regulator
What it requires
- Do not retain a K-12 student's biometric information, Social Security number, or affective-computing assessment data as part of the student's permanent educational record.NIST Privacy FrameworkCT.PO-P2
- Expect a violation of SDATAA to carry a civil penalty of up to $50,000 per violation in an enforcement action by the State Board of Education or the State Department of Education; the Act grants no cause of action of its own to an injured party.
- If you are a school district or public charter school, adopt, implement, and post your student-data policy; failing to do so carries its own separate civil penalty.NIST Privacy FrameworkGV.PO-P1
- Unless prohibited by law or court order, give a parent or guardian copies of all of their child's educational records upon request, so long as the child has not yet turned eighteen.NIST Privacy FrameworkCT.DM-P1
These lines are LexLint's reading of the law's text. Also read by: Idaho State Board of Education (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.DM-P1Data elements can be accessed for review.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
1 more
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
A civil penalty not to exceed $50,000 per violation, payable to the state general fund, applies equally whether the enforcing action is a civil enforcement action initiated by the State Board of Education or the State Department of Education, or a court action initiated by an injured party. A separate civil penalty, also up to $50,000 and also paid to the general fund, applies to a district or public charter school that fails to adopt, implement, and post its student-data policy; that separate penalty is enforced solely by the State Board with Attorney General assistance, with no private right of action.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
Who enforces it
Enforcement body
Idaho State Board of Education and State Department of Education, either of which may bring a civil enforcement action; for the separate district or charter-school policy-adoption penalty, the State Board proceeds with the assistance of the Idaho Attorney General. The Act refers to a court action initiated by an injured party but creates no cause of action for one, and all civil penalties collected are paid into the state general fund.
Settledness
The Board adopted the model policy with an effective date of .
- As of
- Guidance link
- https://boardofed.idaho.gov/wp-content/uploads/2026/05/Model-Policy-approved-8-14-14-v2-2.pdf
- Guidance body
- Idaho State Board of Education
- Open questions
- Does the model policy's definition of a 'Data Breach' as the unauthorized acquisition of personally identifiable information trigger the Act's notice and penalty provisions, where Idaho Code 33-133(1)(m) defines a 'violation' as an act that materially compromises the security, confidentiality or integrity of personally identifiable data and results in an unauthorized release or disclosure?
What it makes you log
Who may demand the log
Public
Logging duty
The State Board of Education must create and publish a data inventory and dictionary of the student data elements in the longitudinal data system and update it at least annually, must explain to the governor and legislature each year the exceptions it granted to the release or out-of-state transfer of student data, and must report the results of its privacy compliance and security audits for the past year. The Board cannot make those reports without records of the data held, the exceptions granted and the audits done, but the section names no log and lists no contents. It sets no retention period for any record; its data destruction dates and the expiry of an unapproved provisional collection concern the student data, not a record. The Board must ensure routine and ongoing compliance audits and no independence condition is stated, so the audit route is the Board's own. Idaho state and local agencies are the bound parties, defined by the act as bodies of the state of Idaho, and the act has no territorial test, so no hook value is coded.
- Kind
- Implicit
- As of
- Provision
- Idaho Code 33-133(3)(a) and (3)(g)(iii)-(iv) (a published data inventory of the student data fields in the state system, kept current at least annually, and annual reports of exceptions granted and audit results)
- Trigger
- personal_data_processing
What this law does
SDATAA binds the State Board of Education, school districts, public charter schools, and their private vendors on the collection, use, and disclosure of K-12 student data.
A student's permanent educational record may not include, among other exclusions, the student's biometric information, Social Security number, or data collected through statewide-assessment affective computing such as facial-expression, EEG, or eye-tracking analysis (with a carve-out for special needs and exceptional students).
A person found, in a civil enforcement action by the State Board or the Department of Education or in a court action initiated by an injured party, to have violated the Act is liable for a civil penalty of up to $50,000 per violation, and all civil penalties collected are paid into the state general fund; the Act refers to a court action initiated by an injured party but grants no cause of action of its own; a district or charter school that fails to adopt, implement, and post its student-data policy faces a separate $50,000 civil penalty enforced by the State Board with Attorney General assistance.
Unless otherwise prohibited by law or court order, a school district must provide a parent or guardian with copies of all of their child's educational records upon request, so long as the child has not yet turned eighteen.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .