Law / United States / 
Nevada
School service providers: pupil data security plan, successor entities and breach notice
In force since .
A breach notification rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Breach notice, Security
- Audit expectation
- none
What it requires
- If you are a school service provider, establish and carry out a detailed plan for the security of data concerning pupils that includes procedures for protecting the security, privacy, confidentiality and integrity of pupil personally identifiable information and appropriate administrative, technological and physical safeguards (NRS 388.293(1)).
- Before you allow a successor entity to access pupil personally identifiable information, ensure it understands it is subject to NRS 388.281 to 388.296 and agrees to abide by your privacy and security commitments (NRS 388.293(2)).
- Notify the school district, charter school, university school for profoundly gifted pupils or private school of any breach of the security of the system data in violation of your plan and of the actions you are taking, as soon as practicable and without unreasonable delay (NRS 388.293(3)).
- If you are a school district, charter school, university school for profoundly gifted pupils or private school that receives a provider's breach notice, give the notice to each affected pupil or, for a pupil under 18 years of age, the parent or legal guardian, as soon as practicable and without unreasonable delay (NRS 388.293(4)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
NRS 388.293 requires a security plan and notice of a breach to the school and onward to affected pupils or parents. The section names no duty to create, keep or produce a log or record of the breach, and gives no regulator access to one.
- Kind
- None
- As of
What this law does
A school service provider must establish and carry out a detailed plan for the security of any data concerning pupils that it collects or maintains. The plan must include procedures for protecting the security, privacy, confidentiality and integrity of personally identifiable information concerning a pupil and appropriate administrative, technological and physical safeguards to ensure the security of data concerning pupils.
A school service provider must ensure that any successor entity understands that it is subject to NRS 388.281 to 388.296 and agrees to abide by the provider's privacy and security commitments before allowing the successor to access pupil personally identifiable information.
A school service provider must notify a school district, charter school, university school for profoundly gifted pupils or private school of any breach of the security of the system data in violation of the plan and the actions taken to address it, as soon as practicable and without unreasonable delay.
A school district, charter school, university school for profoundly gifted pupils or private school that receives that notice must give it to each affected pupil or, for a pupil under 18 years of age, to the pupil's parent or legal guardian, as soon as practicable and without unreasonable delay.
A breach of the security of the system data is unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of data concerning pupils collected or maintained by the provider, and does not include good faith acquisition by an employee or agent of the provider for a legitimate purpose of the provider.
Section 2.5 of the 2019 act on school service providers and pupil technology requires the school service provider to inform a school district, charter school or university school for profoundly gifted pupils or a private school if there is a breach of the security of the system data concerning pupils in violation of the plan. That act became effective on for all purposes other than adopting regulations and performing administrative tasks.
Senate Bill 463 of the 2015 session, the act that created the security plan and successor entity requirements, became effective on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .