Law / United States / 
North Dakota
Statewide longitudinal data system: access terms, data protection practices, privacy and security audits and breach notice protocols
In force.
A breach notification rule binding government bodies.
- Obligation class
- Security, Breach notice, Governance, Retention
What it requires
- If you are the information technology department, establish policies and adopt rules on access to and the collection, storage and sharing of statewide longitudinal data system information, subject to federal and state privacy laws and interagency agreements (N.D. Cent. Code 54-59-34(3)).
- Establish the terms and conditions under which a person may be authorized to access data through the statewide longitudinal data system (N.D. Cent. Code 54-59-34(5)(a)).
- Direct every statewide longitudinal data system administrator to implement approved data protection practices for electronic and physical data, including encryption and staff training requirements (N.D. Cent. Code 54-59-34(5)(b)).
- Provide for biennial privacy and security audits of the statewide longitudinal data system (N.D. Cent. Code 54-59-34(5)(c)).
- Establish protocols, including procedures, for notifying students and parents of a data breach involving the statewide longitudinal data system (N.D. Cent. Code 54-59-34(5)(d)).
- Govern data retention and disposition in the statewide longitudinal data system by the department's own policies (N.D. Cent. Code 54-59-34(5)(e)).
- Require annual data protection training for every individual with access to the statewide longitudinal data system, including school district employees (N.D. Cent. Code 54-59-34(5)(f)).
These lines are LexLint's reading of the law's text.
What this law does
The information technology department must manage a statewide longitudinal data system among education, workforce and training entities. The department must establish policies and adopt rules addressing access to and the collection, storage and sharing of system information, subject to federal and state privacy laws. The department must establish the terms and conditions under which a person may be authorized to access data through the system.
The department must direct that all system administrators implement approved data protection practices to ensure the security of electronic and physical data, including requirements for encryption and staff training. The department must provide for biennial privacy and security audits of the system. The department must establish protocols, including procedures, for notifying students and parents in the event of a data breach involving the system.
Data retention and disposition in the system must be governed by the same policies as those of the information technology department. The department must require annual data protection training for any individual with access to the system, including school district employees.
When LexLint raises it
When your app profile says your app serves schools or universities.
Back to the example · Lint your app
Page updated .