Law / United States / 
Virginia
Student data security: model data security plan for school divisions and chief data security officer
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Security, Governance
- Audit expectation
- none
What it requires
- If you are the Department of Education, develop in collaboration with the Virginia Information Technologies Agency, and update regularly and at least annually, a model data security plan for the protection of student data held by school divisions, including guidelines for access to student data and student data systems and for authentication of authorized access, privacy compliance standards, privacy and security audits, procedures to follow in the event of a breach of student data, and data retention and disposition policies, and make the plan and every update available to every school division (Va. Code Ann. 22.1-20.2(A)).
- If you are the Department of Education, designate a chief data security officer, with such state funds as are made available, to assist school divisions on request with developing and implementing their own data security plans and to develop best practice recommendations on the use, retention and protection of student data (Va. Code Ann. 22.1-20.2(B)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 22.1-20.2 requires the Department of Education to develop and update a model data security plan, whose contents include privacy and security audits as a topic, and to designate a chief data security officer. The model plan is made available to school divisions; the section requires no school division to adopt it, no record to be kept and no audit to be performed.
- Kind
- None
- As of
What this law does
The Department of Education must develop, in collaboration with the Virginia Information Technologies Agency, and update regularly but in no case less than annually, a model data security plan for the protection of student data held by school divisions.
The model plan must include guidelines for access to student data and student data systems, including guidelines for authentication of authorized access, privacy compliance standards, privacy and security audits, procedures to follow in the event of a breach of student data, and data retention and disposition policies, and the plan and its updates must be made available to every school division.
The Department of Education must designate a chief data security officer, with such state funds as are made available, to assist school divisions on request with developing and implementing their own data security plans and to develop best practice recommendations on the use, retention and protection of student data. Section 22.1-20.2 was added by Chapter 561 of the 2015 Acts of Assembly, which took effect on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .