Law / United States / 
New Hampshire
Student data governance: data element index, annual breach report, software inventory and retained parental consent
In force.
A breach notification rule binding government bodies.
- Obligation class
- Governance, Breach notice, Reporting
- Audit expectation
- none
As of .
What it requires
- If you are the department of education, create, maintain and publish each year an index of the data elements that define individual student personally identifiable data fields held in the statewide longitudinal data system or any other department database, or proposed for it (RSA 189:66, I).
- If you are the department of education, issue each year a data security breach report to the governor, the state board and the other officials RSA 189:66, III(b) names, post it on the department's public website, and omit any information that would itself pose a security threat (RSA 189:66, III(b)).
- If you are a local education agency, develop a data and privacy governance plan, present it to the school board for review and approval, update it annually, and include an inventory of all software applications, digital tools and extensions with their users, provider, purpose, publisher, privacy statement and terms of use (RSA 189:66, V(a)).
- Retain copies of written parental consent for a student's registration on a technology platform that requires personally identifiable information as part of the student's educational record (RSA 189:66, V(f)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Public
Logging duty
RSA 189:66 binds the department of education and each local education agency. The department keeps and publishes an annually updated index of student data elements (I) and issues an annual data security breach report, posted on its public website, listing the reporting organization, the types of information, the date or range, a general description, the estimated number of students and teachers affected and the protective steps taken (III(b)). Each local education agency keeps a data and privacy governance plan with an inventory of its software applications, digital tools and extensions (V(a)), and copies of written parental consent for career exploration or career technical platforms are retained as part of a student's educational record (V(f)). The section sets no retention period for any of these records. The department's data security plan must include privacy and security audits (II(b)); the section gives that audit no cadence, no performer and no report recipient, so no audit is coded. The index and the breach report are public, which is the reader coded. The text does not state a first effective date for the provisions as they now read, which reflect amendments in 2018, 2020 and 2023. The section states no territorial reach, so no hook is taken.
- Kind
- Explicit
- As of
- Provision
- RSA 189:66, I, III(b) and V (data element index, annual breach report, software inventory, retained consent copies)
- Trigger
- personal_data_processing
- security_incident
What this law does
The department of education must create, maintain and make publicly available an annually updated index of data elements containing definitions of the individual student personally identifiable data fields it holds or proposes to collect. The security plan must require the department to issue an annual data security breach report, which is posted to the department's public website.
Each local education agency must develop a data and privacy governance plan, updated annually and presented to the school board, that includes an inventory of all software applications, digital tools and extensions. Copies of written parental consent for a student's registration on a technology platform must be retained as part of the student's educational record.
When LexLint raises it
When your app profile says your app serves under-18s.