Law / United States / 
Pennsylvania
Senate Bill 378, Student Data Privacy and Protection Act, student data governance duties of an educational entity and the Department of Education
Pa. S.B. 378, secs. 512, 515, 522, 523 (PN 1528)
In committee, dated , as of .
A sensitive categories rule binding government bodies.
Where it has got to
The text described here is Printer's Number 1528, as amended in the Senate Education Committee. That print is PN 1528, published .
Locally, this stage is reported as amended from the Senate Education Committee, first consideration, laid on the table.
The stage above is recorded at www.palegis.us.
Referred to the Senate Education Committee on (Printer's No. 240). Reported as amended (Printer's No. 1528) and given first consideration on . Laid on the table pursuant to Senate Rule 9 on . No later action recorded. The 2025-2026 session runs through .
What it requires
- Senate Bill 378 (Printer's No. 1528) is a pending bill and does not currently bind anyone; the lines below describe what it would ask if enacted in that form.
- If you are the Department of Education, create and post on your website a data inventory and dictionary of data elements with definitions of the individual student data fields in the student data system (proposed section 512).
- If you are an educational entity, adopt and implement reasonable security policies and procedures to protect educational records and student data from unauthorized access, destruction, use, modification or disclosure, subject to the approval of the chief data privacy officer (proposed section 515(1)).
- If you are an educational entity, designate a student data manager, create and submit a data governance plan to the chief data privacy officer, establish a review process for requests for data for external research or evaluation, and submit an annual report (proposed section 515(2) to (5)).
- If you are an educational entity, give each student, and each parent or guardian of a student under 18, an annual stand-alone written notice in plain language that lists the necessary and optional student data you collect and each third party with access to student data (proposed section 522).
- If you are an educational entity, state in that notice that student data may not be shared without a written data authorization, include an acknowledgment of receipt for each recipient to sign and return, and keep each signed acknowledgment on file (proposed section 522(c)(2), (c)(5), (d) and (e)).
- If you are an educational entity, disclose student data only with written authorization, as Federal or State law authorizes or requires, in an imminent health or safety emergency, or by court order, and do not disclose it in exchange for anything of measurable value (proposed section 523).
These lines are LexLint's reading of the law's text.
What this law does
As reported from the Senate Education Committee (Printer's No. 1528), Senate Bill 378 would have the Department of Education post a data inventory and dictionary of the data elements in the student data system, and would require each educational entity to adopt security policies for educational records and student data, designate a student data manager, submit a data governance plan to the chief data privacy officer, review requests for external research data and send an annual report.
An educational entity would give each student, and each parent or guardian of a student under 18, an annual stand-alone written notice of the conditions under which student data may be disclosed, listing the data collected and each third party with access, and could disclose student data only with written authorization, as State or Federal law requires, in an imminent health or safety emergency, or by court order.
The notice would state that student data may not be shared without a written data authorization and would carry an acknowledgment that each recipient signs and returns, which the educational entity keeps on file.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .