Law / United States / 
New Hampshire
Student data governance: department data security plan, breach notice to affected students, teachers and state officials, and publication of FERPA rights
In force.
A breach notification rule binding government bodies.
- Obligation class
- Governance, Breach notice, Disclosure, Security
- Audit expectation
- continuous
What it requires
- If you are the department of education, develop a detailed data security plan, present it to the state board and the commissioner of the department of information technology, and include in it privacy compliance standards, privacy and security audits, breach planning, notification and procedures, and data retention and disposition policies (RSA 189:66, II).
- If you are the department of education, require in the security plan notification as soon as practicable to any teacher or student whose personally identifiable information could reasonably be assumed to have been part of a data security breach, and to the governor, the state board, the senate president, the speaker of the house of representatives, the chairpersons of the senate and house committees with primary jurisdiction over education and the commissioner of the department of information technology, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the integrity of the data system (RSA 189:66, III(a)).
- If you are the department of education or a local education agency, make publicly available the rights of students and parents under the Family Educational Rights and Privacy Act and applicable state law, including the right to inspect and review education records within 14 days after the school receives a request (RSA 189:66, IV).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
RSA 189:66, II, III(a) and IV require a department data security plan, notice of a breach to affected students and teachers and to named state officials, and publication of FERPA rights. A notice and a plan are not records of processing that the text requires anyone to keep or produce on demand; the data element index, the annual breach report, the software inventory and the retained consent copies are in the separate row for RSA 189:66, and the local education agency plan duties of V(b) to (e) are in their own row. The plan must include privacy and security audits (II(b)) and names no cadence, performer or report recipient, so the audits are coded as a standing element of the plan. The cited provisions state no territorial reach, so no hook is taken.
- Kind
- None
- As of
What this law does
The department of education must develop a detailed data security plan, presented to the state board and the commissioner of the department of information technology, that includes privacy compliance standards, privacy and security audits, breach planning, notification and procedures, and data retention and disposition policies.
The security plan must require notification as soon as practicable to any teacher or student whose personally identifiable information could reasonably be assumed to have been part of a data security breach, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the integrity of the data system.
It must also require notification as soon as practicable to the governor, the state board, the senate president, the speaker of the house of representatives, the chairpersons of the senate and house committees with primary jurisdiction over education, and the commissioner of the department of information technology.
The department and each local education agency must make publicly available the rights of students and parents under the Family Educational Rights and Privacy Act and applicable state law, including the right to inspect and review education records within 14 days after the school receives a request.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .