Law / United States / 
Kansas
Student Data Privacy Act, breach notice for student data
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Immediately notify the affected Kansas student, or the student's parent or guardian, of a breach or unauthorized disclosure of student data if your entity has access to that data.
These lines are LexLint's reading of the law's text. Also read by: Office of the Kansas Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ag.ks.gov/file-a-complaint/student-data-privacy
- Guidance body
- Office of the Kansas Attorney General
- Open questions
- Does 'immediately' in K.S.A. 72-6318 displace the 'most expedient time possible and without unreasonable delay' standard of K.S.A. 50-7a02 for a breach of student data, including the law-enforcement delay in K.S.A. 50-7a02(c)?
What it makes you log
Logging duty
After a security breach or unauthorized disclosure of student data, the school district, department, state board of education, state agency or other entity or third party must immediately notify each affected student or parent or guardian and investigate the causes and consequences. These are duties to notify and investigate; the section states no duty to keep or document a record of the breach, no audit and no access by a regulator or other party. It states no territorial clause.
- Kind
- None
- As of
What this law does
Layers a narrower, immediate breach-notice duty on top of the general Kansas Breach Notification Act: any entity with access to student data must immediately notify the affected student or the student's parent or guardian of a breach or unauthorized disclosure of student data, with no numeric threshold or deadline given beyond "immediately".
When LexLint raises it
When your app profile says your app serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .