Law / United States / 
Pennsylvania
Senate Bill 378, Student Data Privacy and Protection Act, data breach notice for student data
Pa. S.B. 378, secs. 541, 543 (PN 1528)
In committee, dated , as of .
A breach notification rule binding public and private bodies.
Where it has got to
The text described here is Printer's Number 1528, as amended in the Senate Education Committee. That print is PN 1528, published .
Locally, this stage is reported as amended from the Senate Education Committee, first consideration, laid on the table.
The stage above is recorded at www.palegis.us.
Referred to the Senate Education Committee on (Printer's No. 240). Reported as amended (Printer's No. 1528) and given first consideration on . Laid on the table pursuant to Senate Rule 9 on . No later action recorded. The 2025-2026 session runs through .
What it requires
- Senate Bill 378 (Printer's No. 1528) is a pending bill and does not currently bind anyone; the lines below describe what it would ask if enacted in that form.
- If you are an educational entity, notify the chief data privacy officer within the Department of Education of a suspected or confirmed data breach or security compromise within 24 hours of becoming aware of it (proposed section 541(a)).
- If you are an educational entity, notify each affected student, and each affected student's parent or guardian if the student is under 18, within three business days of verification of an unauthorized release or compromise of student data (proposed section 541(b)).
- If you are a third party holding student data and a suspected or confirmed breach occurs, notify the contracting educational entity within 24 hours of becoming aware of it, take action to determine the scope of the data compromised, update the educational entity once the full scope is known, and take all reasonable steps to notify the affected individuals (proposed section 541(c)).
These lines are LexLint's reading of the law's text.
What this law does
As reported from the Senate Education Committee (Printer's No. 1528), Senate Bill 378 would require an educational entity to notify the chief data privacy officer within the Department of Education of a suspected or confirmed data breach or security compromise within 24 hours of becoming aware of it, and to notify each affected student, and each parent or guardian of an affected student under 18, within three business days of verification.
A third party holding student data would have to notify the educational entity within 24 hours of becoming aware of a suspected or confirmed breach, determine its scope, update the educational entity, and take all reasonable steps to notify the affected individuals.
An educational entity or third party that fails to comply with a duty under the chapter, resulting in an intentional, knowing, reckless or negligent data breach or security compromise, would face civil penalties, which include the costs of identity protection and the legal fees and costs of each affected individual and any other penalty the court deems reasonable or appropriate, and administrative fines by the Department of Education of not less than $1,000 nor more than $5,000 for each offense, with an aggregate cap of $1,000,000 in any calendar year.
Section 544 provides that nothing in the subchapter limits, precludes or supersedes criminal liability.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .