Law / United States / 
New Hampshire
Student data governance: department minimum privacy and security standards, and local education agency plan duties for software review, data access, breach response and service providers
In force.
A sensitive categories rule binding government bodies.
- Obligation class
- Governance, Security, Contract terms
- Audit expectation
- none
What it requires
- If you are the department of education, establish minimum standards for privacy and security of student and employee data, based on best practices, for local education agencies (RSA 189:66, V).
- If you are a local education agency, include in the data and privacy governance plan you present to the school board and update each year a review of all software applications, digital tools and extensions, with an assurance that they meet or exceed the department's standards (RSA 189:66, V(b)).
- Include in the plan policies and procedures for access to data and protection of privacy for students and staff, including an acceptable use policy for applications, digital tools and extensions, and a response plan for any breach of information (RSA 189:66, V(c) and (d)).
- Include in the plan a requirement for a service provider to meet or exceed standards for data protection and privacy (RSA 189:66, V(e)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
RSA 189:66, V and V(b) to (e) require the department to set minimum privacy and security standards and each local education agency to include in its annually updated governance plan a review of its software against those standards, data access policies, a breach response plan and a requirement for service providers to meet or exceed standards for data protection and privacy. A plan and a standard are policies, and the review in V(b) checks software against the department's standards rather than a kept record, so no record duty and no audit are coded. The software inventory and the retained consent copies of V(a) and (f) are in the separate row for RSA 189:66. The cited provisions state no territorial reach, so no hook is taken.
- Kind
- None
- As of
What this law does
The department of education must establish minimum standards for privacy and security of student and employee data, based on best practices, for local education agencies. Each local education agency's data and privacy governance plan, presented to the school board and updated annually, must include a review of all software applications, digital tools and extensions with an assurance that they meet or exceed the department's standards.
The plan must include policies and procedures for access to data and protection of privacy for students and staff, including an acceptable use policy for applications, digital tools and extensions, and a response plan for any breach of information. The plan must also include a requirement for a service provider to meet or exceed standards for data protection and privacy.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .