Law / United States / Tennessee

Student data governance: duties of the department of education under the Data Accessibility, Transparency and Accountability Act

Tenn. Code Ann. sec. 49-1-703

In force since 1 Jul 2014.

A sensitive categories rule binding government bodies.

Obligation class

Access restriction, Security, Contract terms, Disclosure

Audit expectation

continuous

Who audits it

Self

Where the report goes

Filed with regulator

What it requires

• If you are the Tennessee department of education, create, publish and make publicly available a data inventory and dictionary or index of the data elements in the student data system, with definitions of each individual student data field and the purpose or reason it is included (section 49-1-703(1)).
• Restrict access to student and de-identified data in the student data system to the authorized staff of the department and its contractors, LEA administrators, teachers, school personnel and their contractors, students and their parents, and the other persons the section lists, and let a student or parent reach only that student's individual data (section 49-1-703(2)(A)).
• Within sixty days of giving the authorized staff of another state agency access to student data, notify the state board and the education committees of the senate and the house of representatives of the release and post the notice on the department's website (section 49-1-703(2)(A)(iv)).
• Use only aggregate data in public reports and in responses to public records requests (section 49-1-703(2)(B)).
• Unless the part or the state board approves otherwise, do not transfer confidential student or de-identified data to any federal agency or other organization or entity outside the state except in the cases the section lists, among them a contract with an out-of-state vendor that governs databases, assessments, special education or instructional supports (section 49-1-703(2)(D)).
• Develop a detailed data security plan covering guidelines for authorizing and authenticating access to the teacher and student data systems, privacy compliance standards, privacy and security audits, breach planning, notification and procedures, and data retention and disposition policies (section 49-1-703(3)).
• Ensure routine and ongoing compliance with FERPA, section 10-7-504 and the part's privacy and security policies, including by performing compliance audits (section 49-1-703(4)).
• Ensure that any contract with a private vendor for databases, assessments or instructional supports that include student or de-identified data contains express provisions that safeguard privacy and security and include penalties for noncompliance (section 49-1-703(5)).
• Notify the governor and the general assembly within sixty days of any new student data field in the state student data system, changes to existing data collections, exceptions the state board granted in the past year for the release or out-of-state transfer of student or de-identified data, and the results of privacy compliance and security audits completed in the past year, leaving out any information that would itself pose a security threat to state or local student information systems (section 49-1-703(6)).

These lines are LexLint's reading of the law's text.

What record it asks for

When LexLint raises it

When your app profile says your app serves K-12 schools.

Back to the example  ·  Lint your app

Page updated 9 November 2026.