Law / United States / 
Pennsylvania
Senate Bill 378, Student Data Privacy and Protection Act, required terms in an educational entity's contract with a third party
Pa. S.B. 378, sec. 528 (PN 1528)
In committee, dated , as of .
A sensitive categories rule binding government bodies.
Where it has got to
The text described here is Printer's Number 1528, as amended in the Senate Education Committee. That print is PN 1528, published .
Locally, this stage is reported as amended from the Senate Education Committee, first consideration, laid on the table.
The stage above is recorded at www.palegis.us.
Referred to the Senate Education Committee on (Printer's No. 240). Reported as amended (Printer's No. 1528) and given first consideration on . Laid on the table pursuant to Senate Rule 9 on . No later action recorded. The 2025-2026 session runs through .
What it requires
- Senate Bill 378 (Printer's No. 1528) is a pending bill and does not currently bind anyone; the lines below describe what it would ask if enacted in that form.
- If you are an educational entity, require in every contract with a third party the restrictions on the collection, use, storage or sharing of student data that are necessary to comply with the chapter and other State law (proposed section 528(1)).
- If you are an educational entity, require the third party to describe the persons, or types of persons, including an affiliate or subcontractor, with whom it may share student data (proposed section 528(2)).
- If you are an educational entity, require the contract to state when and how the third party deletes student data and to prohibit secondary use of personally identifiable student data except for research or legitimate educational interests compatible with the context of collection (proposed section 528(3) and (4)).
- If you are an educational entity, require the third party to agree that you or your designee may audit it to verify compliance with the contract (proposed section 528(5)).
- If you are an educational entity, require the third party and any subcontractor to effect security measures to prevent, detect or mitigate a data breach, and to notify you of a suspected data breach or intrusion (proposed section 528(6) and (7)).
These lines are LexLint's reading of the law's text.
What this law does
As reported from the Senate Education Committee (Printer's No. 1528), Senate Bill 378 would require an educational entity, meaning a public school district, charter school, regional charter school, cyber charter school, intermediate unit or area career and technical school, to put seven terms in any contract with a third party.
The terms cover restrictions on the collection, use, storage and sharing of student data, the persons with whom the third party may share it, when and how to delete it, a prohibition on secondary use of personally identifiable student data, the educational entity's right to audit the third party, security measures against a data breach, and notice of a suspected breach. The duty falls on the educational entity, and the terms bind the third party through the contract.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .