Law / United States / 
New York
Regulations of the Commissioner of Education Part 121, breach notice by a third-party contractor
8 NYCRR § 121.10(a), (c) and (f)
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- If you are a third-party contractor that receives student data or teacher or principal data from a New York educational agency, notify each educational agency you contract with of any breach or unauthorized release of personally identifiable information in the most expedient way possible and without unreasonable delay, and no more than seven calendar days after you discover it (8 NYCRR 121.10(a)).
- Cooperate with educational agencies and law enforcement to protect the integrity of investigations into the breach or unauthorized release (8 NYCRR 121.10(c)).
- Where a breach or unauthorized release is attributed to you, pay for or promptly reimburse the educational agency for the full cost of the notification it must give (8 NYCRR 121.10(f)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 121.10(a), (c) and (f) set a notice to the educational agency, cooperation with investigations and payment for notification, and name no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Section 121.10(a) requires a third-party contractor to notify each educational agency with which it has a contract of any breach or unauthorized release of personally identifiable information in the most expedient way possible and without unreasonable delay, and no more than seven calendar days after discovering the breach.
Section 121.1(a) defines a breach as the unauthorized acquisition, access, use or disclosure of student data or teacher or principal data by or to a person not authorized to acquire, access, use or receive it. Under section 121.10(c) the contractor must cooperate with educational agencies and law enforcement to protect the integrity of investigations into the breach or unauthorized release.
Where a breach or unauthorized release is attributed to the contractor, section 121.10(f) requires it to pay for or promptly reimburse the educational agency for the full cost of the notification. Each educational agency in turn must notify the Chief Privacy Officer no more than 10 calendar days after it receives the contractor's notification.
The agency must notify affected parents, eligible students, teachers and principals no more than 60 calendar days after it receives the contractor's notification, unless that notice would interfere with an ongoing law enforcement investigation or disclose an unfixed security vulnerability, in which case it must notify them within seven calendar days after the vulnerability is remedied or the risk of interference with the investigation ends. Part 121 of the Regulations of the Commissioner of Education took effect on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .