Law / United States / 
North Carolina
North Carolina Longitudinal Data System: privacy, security, and use rules for student data
N.C. Gen. Stat. 116E-4, 116E-5, 116E-6
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Governance, Security, Contract terms, Retention
- Audit expectation
- continuous
- Who audits it
- Self
What it requires
- If you are the Governmental Data Analytics Center, before any individual data in the North Carolina Longitudinal Data System is used, publish an inventory of the data proposed to be accessible, develop policies to comply with FERPA, IDEA, Health Insurance Portability and Accountability Act (HIPAA), CJIS, the Internal Revenue Code and other privacy law, and develop a data security and safeguarding plan covering authorized access and authentication, privacy compliance standards, privacy and security audits, breach notification and procedures, and data retention and disposition (G.S. 116E-4(a)(4)).
- Ensure that any contract governing a System database outsourced to a private vendor includes express provisions that safeguard privacy and security and include penalties for noncompliance (G.S. 116E-4(a)(6)).
- Operate the System with data security that includes the capacity for audit trails, regular audits for compliance with data privacy and security standards, disposition of information no longer needed, and de-identified data in research and reporting (G.S. 116E-5(d)(2)).
- Restrict direct access to System data to authorized System staff, use only de-identified data in the System's analysis, research, and reporting, put only aggregated data in public reports, and report no data that may be identifiable from the size or uniqueness of the population (G.S. 116E-5(e)).
- If you are a public school unit, community college, constituent institution of The University of North Carolina, or State agency, transfer student data and workforce data to the System in accordance with the Center's data security and safeguarding plan (G.S. 116E-6(a)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
The System must provide data security that includes the capacity for audit trails, and regular audits for compliance with data privacy and security standards. The chapter names no log contents, no retention period for an audit trail and no outside reader of one.
- Kind
- Explicit
- As of
- Provision
- 116E-5(d)(2)c. (data security, including the capacity for audit trails)
- Trigger
- personal_data_processing
What this law does
The North Carolina Longitudinal Data System is a statewide data system that contains individual-level student data and workforce data from all levels of education and the State's workforce, and it sits administratively within the Department of Information Technology.
Before any individual data in the System is used, the Governmental Data Analytics Center must publish an inventory of the data proposed to be accessible, develop policies to comply with FERPA and other privacy law, and develop a detailed data security and safeguarding plan covering authorized access and authentication, privacy compliance standards, privacy and security audits, breach notification and procedures, and data retention and disposition policies.
The Center must ensure that any contract governing a database outsourced to a private vendor includes express provisions that safeguard privacy and security and include penalties for noncompliance. The System must provide data security, including the capacity for audit trails, and regular audits for compliance with data privacy and security standards, must require de-identified data in research and reporting, and must require disposition of information no longer needed.
Direct access to data is restricted to authorized staff of the System, only de-identified data may be used in the System's analysis, research, and reporting, and only aggregated data may appear in public reports. Public school units, community colleges, constituent institutions of The University of North Carolina, and State agencies must transfer student data and workforce data to the System in accordance with the Center's data security and safeguarding plan. Session Law 2012-133 enacted the chapter, and section 3(a) of Session Law 2025-62 rewrote it effective .
When LexLint raises it
When your app profile says your app serves schools or universities.
Back to the example · Lint your app
Page updated .