language: en · last checked: 2026-09-29

National

Instruments owned by a country. One folder per country, named by ISO 3166-1 alpha-2 code in lower case (gb/, us/, de/, …), then one legal root folder per instrument, e.g. gb/gdpr/.

Sub-national jurisdictions (US states, German Länder, …) nest under a state folder within their country, using lowercase local codes — keeping them tidily separate from the national instrument folders: e.g. Wisconsin → us/state/wi/…, California → us/state/ca/….

Contents

• gb — United Kingdom
  • gb/gdpr/ — UK General Data Protection Regulation
  • gb/dpa-2018/ — Data Protection Act 2018 (Part 1, Part 2 general processing, s 208 children in Scotland (capacity presumed at 12), Schedule 1 special-category conditions incl. safeguarding of children, Schedule 3 education data)
  • gb/kcsie/ — Keeping children safe in education 2026, online-safety chapter (filtering & monitoring; cyber standards; generative-AI expectations)
  • gb/childrens-code/ — ICO Children's Code, the 15 standards (standard 14 covers connected devices/headsets; high-privacy defaults; DPIA duty)
  • gb/online-safety-act/ — Online Safety Act 2023 scope assessment (ss 3–4 + Schedule 1; the education exemption covers schools, NOT vendors — para 4 limited-functionality is our line)
  • gb/sct/independent-schools-registration/ — Registration of Independent Schools (Scotland) Regulations 2006 + 2021 amendment as made (child protection co-ordinator statement); legislation.gov.uk has not consolidated it
  • gb/sct/girfec-information-sharing/ — GIRFEC Practice Guidance 4, Information sharing (2022), in full: lawful bases (public task for schools), special category data, child protection, children's own rights from 12, information sharing charters
  • gb/sct/child-protection-guidance/ — National Guidance for Child Protection in Scotland 2021 (updated 2023), non-statutory: information sharing, schools' responsibilities (independent schools' Child Protection Co-ordinator), reporting a concern, online safety
  • gb/dfe-digital-standards/ — DfE filtering & monitoring + cyber security core standards, in full (the vendor-questionnaire source)
  • gb/pecr/ — PECR 2003 as restructured by the DUAA 2025 (cookie rules now in Schedule A1 with expanded exceptions; reg 22 marketing opt-in; GDPR-level fines)
  • gb/equality-act/ — Equality Act 2010 ss 20/29/85 (anticipatory reasonable adjustments incl. auxiliary aids; schools duty)
  • gb/prevent-duty/ — CTSA 2015 ss 26/29 (the statutory root of school filtering expectations)
  • gb/psbar/ — PSBAR 2018 regs 3–8 (school sites exempt EXCEPT essential online administrative functions; WCAG/EN 301 549 presumption)
• de — Germany
  • de/bdsg/ — Bundesdatenschutzgesetz (federal; vendors are "nichtöffentliche Stellen", schools answer to Land law)
  • de/state — German Länder
    • de/state/ni/nschg-datenschutz/ — Niedersachsen: NSchG §§ 30–31b (incl. the § 31(5) learning-platform gate)
    • de/state/by/bayeug-datenschutz/ — Bayern: BayEUG Art. 85, 85a (school data + state IT chain)
    • de/state/nw/schulg-datenschutz/ — Nordrhein-Westfalen: SchulG NRW §§ 120–122 (incl. the § 120(5) digital-tools basis)
    • de/state/nw/vo-dv/ — Nordrhein-Westfalen: VO-DV I in full with its three Anlagen, and VO-DV II §§ 1–11 with Anlagen 1–8 — the operative layer under § 122(4). A closed data catalogue (Anlage 1); log data from digital Lehr- und Lernmittel only as far as technically required for operation (§ 2(1)); Art. 28 processors on instruction only (§ 2(3)); teachers' private devices need a written approval and may hold only the Anlage 3 set, kept one year (§ 2(2), § 9(2)); encryption for data carriers and no automated retrieval interfaces (§ 5(2)); retention 50/20/10/5 years (§ 9)
    • de/state/bw/schg-datenschutz/ — Baden-Württemberg: SchG §§ 113a–116 (incl. the § 115b digital-teaching basis and § 115a Digitale Bildungsplattform)
    • de/state/bw/digitale-bildung-vo/ — Baden-Württemberg: DBPVO and DUVO in full, the ordinances under §§ 115a/115b. DUVO § 5 bans advertising through teaching systems and any processing for advertising; § 6 permits adaptive/AI-supported procedures for the individual learning path with advance information to pupils and parents, no unreviewed grading, no Art. 9 data and no training of the procedure on pupil data; § 10(4) bans recording remote lessons. DBPVO: second factor mandatory for teachers, roles per the ministry's concept, joint controllership for shared teachers
    • de/state/sh/schulg-datenschutz/ — Schleswig-Holstein: SchulG §§ 4a, 30–32 (incl. the § 30(1) basis covering data arising during platform use)
    • de/state/sn/schulg-datenschutz/ — Sachsen: SächsSchulG §§ 38b, 50a, 63a, 63b (GDPR-direct regime) and the VwV Schuldatenschutz in full, the operative layer under § 63a. For a vendor it is the VwV that decides: cloud services only where EU law applies, and only clouds the school runs or the Landesamt recommends, checked before deployment and regularly after (III.12); administrative and teaching networks kept separate (III.11); a whole part on private-provider processing including provision of pupil data out of SaxSVS and an inspection right (V); minors consent and exercise their own rights (II.5, IV.2)
    • de/state/he/hschg-datenschutz/ — Hessen: HSchG §§ 83–85 (incl. the § 83a two-route gate for digital applications)
    • de/state/ni/ndsg/ — Niedersachsen: NDSG (special-category safeguards bind processors, § 17; no fines on public bodies, § 20(5))
    • de/state/by/baydsg/ — Bayern: BayDSG (outside maintenance = Art. 28 processing, Art. 5(3); DPO heard before new procedures, Art. 12)
    • de/state/nw/dsg-nrw/ — Nordrhein-Westfalen: DSG NRW (municipal schools are public bodies, § 5(1); no GDPR fines on schools, § 32)
    • de/state/bw/ldsg/ — Baden-Württemberg: LDSG after the 2026 amendment (AI use § 3a, AI training § 11a, biometric-login ban § 17a(2), state processing on behalf § 7a)
    • de/state/bw/schulstatdvv/ — Baden-Württemberg: SchulStatDVV, the § 115(2) SchG ordinance (ASD-BW via BITBW as processor; statistics data catalogue)
    • de/state/bw/vwv-datenschutz-schulen/ — Baden-Württemberg: VwV Datenschutz an öffentlichen Schulen in full (cloud only under Art. 28 inside GDPR territory, 1.14.2; minors' own consent from ~16, image consent from 14)
    • de/state/sh/ldsg/ — Schleswig-Holstein: LDSG (release of automated procedures before use, § 7; no biometric ID from video, § 14; processors support inspections, § 18)
    • de/state/sn/saechsdsdg/ — Sachsen: SächsDSDG (maintenance within the purpose, § 3(2); video deleted within a month, § 13(4))
    • de/state/he/hdsig/ — Hessen: HDSIG (maintenance providers are processors, § 3(2); €50,000 fine on recipients who repurpose, § 38)
    • de/state/hh/hmbsg-datenschutz/ — Hamburg: HmbSG §§ 98–101 (§ 98b learning portals: private operators get only anonymised/pseudonymised data under a no-economic-use contract; § 98c no recording of remote lessons)
    • de/state/st/schulg-datenschutz/ — Sachsen-Anhalt: SchulG LSA §§ 10b, 84a–84g (§ 84a(4) videoconference/platform basis; § 84a(6) digital class books with 2FA and Art. 28 processors)
    • de/state/th/thuerschulg-datenschutz/ — Thüringen: ThürSchulG §§ 45a, 57, 58 (§ 57(1) covers data arising during use; non-state platforms are the school's responsibility)
    • de/state/mv/schulg-datenschutz/ — Mecklenburg-Vorpommern: SchulG M-V §§ 53b, 70–72 (statutory joint controllership; ordinance on processors and Bildungsmedienanbieter)
    • de/state/sl/schulwdsg/ — Saarland: Schulwesen-Datenschutzgesetz 2024 in full (§ 6 profiling ban for digital learning environments and approval for automated assessment; consent from 14; classroom AV-transmission ban)
    • de/state/rp/schulg-datenschutz/ — Rheinland-Pfalz: SchulG § 67 (mandatory state admin program; transfers outside public sector need consent)
    • de/state/be/schulg-datenschutz/ — Berlin: SchulG §§ 64–66 (incl. § 64e AI systems: closed system, internal data only, no model change by personal data; Schulportal and identity management)
    • de/state/hb/bremschuldsg/ — Bremen: BremSchulDSG in full (electronic learning systems; social media only GDPR-compliant with school-leadership consent; secured video/telepresence, no recording)
    • de/state/bb/bbgschulg-datenschutz/ — Brandenburg: BbgSchulG §§ 65, 65a, 66 (digital tools within § 65(2); private-body transfers need consent)
    • Land school-data ordinances: HH SchulDSV (closed data catalogue; administration data kept apart from lesson data) · MV SchulDSVO (§ 5a(7) data a learning product may process — assessments, no grading) · RP SchulDSV 2026 (central digital platform; SSO data minimal; Personen-ID not linkable) · BE SchuldatenV (§ 25 authentication processor gets pseudonymised data only, a separate identifier per service) · BB DSV · HB SchulDVV · SL SchulwDSV (§ 23 educational-media vendors may use data only for licence checks; learning analytics need prior approval) · SL SchoG Lernmittel + Medienausleiheverordnung (Prüfsiegel route for digital learning resources) · SH SchulDSVO (§ 11(4) digital learning systems: pedagogical process data, no grades; no Art. 9 data) · school-regulation data sections: TH ThürSchulO §§ 136–137, ThürASObbS §§ 47–48 (closed admission-data list; digital class books; teachers' own devices need Art. 24/32 measures) · RP ÜSchO, GrSchulO, FöSchulO, BBiSchulO data sections (classroom computers kept off school administration; deletion one year after leaving) · research notes, no ordinance: ST · TH
• pl — Poland
  • pl/uodo/ — Ustawa o ochronie danych osobowych (PUODO, public-sector fine caps; GDPR Art. 8 age not derogated — 16)
  • pl/prawo-oswiatowe/ — Prawo oświatowe art. 44a, 108a, 125a (state platform ZPE, school CCTV, mandatory remote learning)
  • pl/system-oswiaty/ — Ustawa o systemie oświaty art. 22ao (electronic textbooks: accessibility, no ads, no exam-drilling)
  • pl/ksc/ — KSC after the 2026 NIS2 transposition (schools expressly excluded; cloud/DNS vendors covered)
  • pl/pke/ — Prawo komunikacji elektronicznej art. 398–400 (cookie rule, direct-marketing consent)
• cz — Czechia
  • cz/zakon-110-2019/ — data-processing act § 7, § 62 (digital-consent age 15; public-body fine waiver)
  • cz/skolsky-zakon/ — školský zákon § 28, § 184a (školní matrika data catalogue; crisis distance learning)
  • cz/zkb/ — cybersecurity act 264/2025 §§ 1, 3–6 (NIS2; education is an enumerated sector)
• it — Italy
  • it/codice-privacy/ — Codice privacy art. 2-quinquies, 2-sexies, 96 (digital-consent age 14; education as public-interest ground; student data)
  • it/legge-stanca/ — Legge Stanca art. 1–4 (ICT accessibility; €500m private-scope threshold; procurement lever)
  • it/garante-scuola/ — Garante provvedimenti on schools: DaD platforms (supplier is the school's art. 28 processor; only teaching services on by default, no geolocation or social login), the opinion on AI in schools, the 2025 fingerprint sanction
  • it/garante-vademecum-scuola/ — "La scuola a prova di privacy" (2025 edition), the Garante's school guide
  • it/agid-linee-guida-accessibilita/ — AGID Linee guida accessibilità (IT service contractors are bound; EN 301 549 for hardware, software and apps)
  • it/acn-regolamento-cloud/ — ACN Regolamento cloud n. 21007/24 with Allegati 1–4 (1-hour incident notice to the administration; data processed in the EU; SaaS for public administrations must be ACN-qualified QC1–QC4; qualification lasts at most 36 months)
• ro — Romania
  • ro/legea-190-2018/ — GDPR implementing act in full, in Romanian (biometrics/profiling art. 3; employee monitoring art. 5 with a 30-day retention cap; public authorities get a remediation plan before any fine)
  • ro/legea-198-2023/ — Legea învățământului preuniversitar, articolele 18, 66, 132 și 133 in full, in Romanian (classroom audio-video surveillance art. 66: majority agreement of parents and staff, closed-circuit cameras only, 30-day retention, no use for teacher appraisal; art. 132 the statutory minimum IT standard and the Minister's list of approved platforms, with the Ministry jointly liable for confidentiality; art. 133 the cloud-based electronic catalogue and once-only interoperability)
  • ro/legea-506-2004/ — ePrivacy transposition in full, in Romanian (terminal-equipment rule art. 4 alin. (5) — any client-side storage or read, not only cookies; opt-in marketing art. 12)
• at — Austria
  • at/dsg/ — Datenschutzgesetz (constitutional Grundrecht Art. 1 § 1; digital-consent age 14; § 30(5) no fines against public bodies)
  • at/schug/ — SchUG §§ 14a, 70a (IKT-gestützter Unterricht incl. platform definition; electronic communication + contact-data basis)
  • at/bildokg/ — Bildungsdokumentationsgesetz 2020 (Schulleiter as controller; student Evidenzen; Datenverbund der Schulen with retention periods)
• ae — United Arab Emirates
  • ae/pdpl/ — Federal Decree-Law 45/2021 (PDPL), whole decree-law in Arabic (31 articles; no minors provision and no fines in the statute itself)
  • ae/state/az/adek-school-digital-policies/ — Abu Dhabi: ADEK School Digital Policy and Records Policy v1.1 (third-party risk assessment; vendors bound by the PDPL; no sharing in or outside the UAE without ADEK consent)
  • ae/state/az/adek-student-protection-policies/ — Abu Dhabi: ADEK Student Protection and Safeguarding policies (24-hour mandatory reporting reaches "any person who … provides services to students or the school"; vetting; CCTV and digital-incident rules)
  • ae/state/az/adek-eei-child-protection-policy/ — Abu Dhabi: ADEK Early Education Institutions Child Protection & Safeguarding Policy (supplier staff are mandated reporters; photos only on nursery devices that stay on site; unscheduled vendor visits barred)
  • ae/state/az/adek-eei-surveillance-and-care-policies/ — Abu Dhabi: ADEK Early Education Institutions Surveillance, Duty of Care and Behavior Management policies (any camera or live-streaming system is surveillance, run only by MCC-licensed providers as PDPL Data Processor; explicit consent, no covert recording; footage access logged, copying punishable, 180-day retention)
  • ae/state/du/khda-school-data/ — Dubai: research note (KHDA publishes no data or technology instrument for private schools)
• au — Australia
  • au/privacy-act/ — Privacy Act 1988: s 26GC Children's Online Privacy Code (binds services likely accessed by children, due Dec 2026), APP 8 (cross-border), APP 11 (security + destruction)
  • au/state/nsw/doe-cyber-security-procedures/ — NSW Department of Education cyber security procedures (apps outside the approved lists need a cyber assessment and parental consent)
  • au/state/vic/software-administration-systems/ — Victoria: software and administration systems policy (ST4S non-compliant or high-risk products may not be used)
  • au/state/qld/non-departmental-ict-service-providers/ — Queensland: non-departmental ICT service providers procedure (no SENSITIVE or PROTECTED data offshore)
  • au/state/nsw/doe-privacy-standards/ — NSW Department of Education Privacy standards (contractors in scope; every suspected breach reported)
  • au/state/vic/schools-privacy-policy/ — Victoria: Schools' privacy policy
  • au/state/vic/privacy-information-sharing/ — Victoria: Privacy and Information Sharing policy and guidance (no personal information into generative AI tools, parent opt-out; opt-in consent for photos/health data; PIA for high-risk software)
  • au/state/qld/student-consent-procedure/ — Queensland: student consent procedure and online-services consent guideline (per-service consent covering offshore transfer)
• bg — Bulgaria
  • bg/zzld/ — Закон за защита на личните данни (digital-consent age 14; КЗЛД; санкции чл. 85–86)
  • bg/zpuo/ — Закон за предучилищното и училищното образование (ОРЕС remote learning чл. 115а; free e-readable textbooks чл. 164; НЕИСПУО чл. 250)
• nl — Netherlands
  • nl/uavg/ — Uitvoeringswet AVG (consent 16 with 12+ withdrawal right; AP fines public bodies; narrow biometrics exception; BSN restriction)
  • nl/privacyconvenant-onderwijs/ — Privacyconvenant 4.0 / Edu-K (mandatory-in-practice sector agreement; exclusive Model Verwerkersovereenkomst, now in full with Modelbijlagen 4.0.1: no advertising, 6-week sub-processor objection, non-EEA transfer only with the school's written consent)
• pt — Portugal
  • pt/lei-58-2019/ — Lei 58/2019, execução do RGPD (digital-consent age 13 — the corpus floor; contraordenação tiers; public-entity coima question)
  • pt/lei-41-2004/ — Lei 41/2004, ePrivacy (cookie rule art. 5.º; marketing opt-in art. 13.º-A)
  • pt/dl-83-2018/ — web accessibility transposition (DL 83/2018 in full; names pre-school, school and higher-education establishments, public and publicly funded private)
• cn — China
  • cn/pipl/ — 个人信息保护法 (under-14 data = sensitive + guardian consent + dedicated rules; no legitimate-interest ground; cross-border gates)
  • cn/cybersecurity-law/ — 网络安全法 2025修正 (MLPS 第二十三条; CII localisation 第三十九条 — renumbered)
  • cn/minors-online-protection/ — 未成年人网络保护条例 (minors data minimisation; ANNUAL compliance audit 第三十七条; anti-addiction design duty)
• es — Spain
  • es/lopdgdd/ — LOPDGDD (consent 14; art. 92 school publication rule; art. 77 public bodies unfineable but vendors fully exposed; derecho a la educación digital)
• il — Israel
  • il/protection-of-privacy-law/ — חוק הגנת הפרטיות incl. Amendment 13 (GDPR-style definitions; collection-notice UI duty §11; DPO duty §17ב1; EU adequacy preserved; enforcement and supervision chapters ד'1–ד'5 and the Third to Fifth Schedules: the holder is fined directly, and the controller can be fined for its holder's security breach, §23כו(י))
  • il/data-security-regulations/ — תקנות הגנת הפרטיות (אבטחת מידע) 2017 in full — the security code under §17: basic/medium/high tiers (medium = public bodies or sensitive data incl. biometric; high = ≥100,000 subjects or >100 users); duties bind the holder (processor) directly except regs 2 and 15(א) (reg. 19); the reg. 15 outsourcing contract (flow-down, annual compliance report, incident notice to the owner); access logs kept 24 months, physical second factor and ≤6-month passwords at medium/high; serious incidents to the Registrar immediately; audits every 24 months, penetration tests every 18 months at high
• kr — South Korea
  • kr/pipa/ — 개인정보 보호법 and its 시행령 (Enforcement Decree) (child consent under 14 needs verified guardian consent; lawful-basis catalogue 제15조). The Decree is where the buildable detail is: seven permitted methods of verifying a legal representative's consent (SMS confirmation, card details, mobile identity verification, signed paper, email exchange, a two-call telephone process, or an equivalent) — none of them a self-declared age gate; prescribed outsourcing terms (제28조); and an itemised security standard (제30조) including an audited internal management plan and retention of tamper-proof access logs
  • kr/framework-act-on-education/ — 교육기본법 제23조의3 (student data: educational purposes only; parental access; consent for third-party provision)
  • kr/elementary-secondary-education-act/ — 초·중등교육법 제30조의4–6 (NEIS; FERPA-style record-provision limits)
  • kr/network-act/ — 정보통신망법 제50조 (commercial-message opt-in)
  • kr/distance-education-act/ — 원격교육법 제19–20조 (remote-education data; pseudonymisation gate for re-use)
• us — United States
  • us/ferpa/ — Family Educational Rights and Privacy Act
  • us/coppa/ — Children's Online Privacy Protection Act
  • us/cipa/ — Children's Internet Protection Act
  • us/ada-title-ii-web/ — ADA Title II web & mobile accessibility rule (28 CFR Part 35, Subpart H)
  • us/section-504-508/ — Rehabilitation Act §504 (29 U.S.C. §794) and §508 (29 U.S.C. §794d), with ED's §504 regulations 34 CFR §§104.1–104.10 and 104.31–104.39 (the duty reaches a district's software "directly or through contractual, licensing, or other arrangements", §104.4(b)(1); "equally effective" means equal opportunity in the most integrated setting, not feature parity; an IEP is only one means of meeting the appropriate-education standard, so a 504 plan can exist without one), and the Access Board's Revised 508 Standards, 36 CFR Part 1194 Appendices A and C — the thing a "508 compliant" RFP actually points at, and it incorporates WCAG 2.0 AA, one version behind the WCAG 2.1 AA the ADA Title II web rule imposes on the district itself). Part 1194 is complete: Appendix D, the original 2000 standards, is the legacy safe harbour E202.2 keeps alive for ICT unaltered since 18 Jan 2018 (its §1194.22(a)–(p) is the pre-WCAG web checklist old VPATs were written against), and Appendix B is the Section 255 telecommunications guidelines — a "readily achievable" duty on equipment manufacturers, not on districts or their software vendors
  • us/ppra/ — Protection of Pupil Rights Amendment (20 U.S.C. §1232h)
  • us/idea/ — Individuals with Disabilities Education Act (20 U.S.C. §1400 et seq.), with ED's Part B confidentiality regulations 34 CFR §§300.610–300.627 in full (heavier than FERPA: an access log with no school-official exemption, a named responsible official and a publicly inspectable list of who has access, consent before disclosure outside participating agencies, destruction on parental request)
  • us/essa/ — Every Student Succeeds Act (ESEA; incl. the §7801(21) evidence tiers)
  • us/nist-csf/ — NIST Cybersecurity Framework (voluntary)
  • us/cisa-cpg/ — CISA Cross-Sector Cybersecurity Performance Goals (voluntary)
  • us/state — US states
    • us/state/ca/sopipa/ — Student Online Personal Information Protection Act (California)
    • us/state/ca/ed-code-49073-1/ — Pupil records: contracts with third parties (Cal. Ed. Code §49073.1)
    • us/state/ca/ed-code-49073-6/ — Social media monitoring of pupils (Cal. Ed. Code §49073.6)
    • us/state/ca/ed-code-49076-7/ — Pupil SSN collection ban (Cal. Ed. Code §49076.7)
    • us/state/ca/ccpa-minors/ — CCPA §1798.120 (no sale/sharing of under-16 data without opt-in)
    • us/state/ca/caadca/ — CAADCA duties §1798.99.31 (enforcement enjoined — NetChoice v. Bonta)
    • us/state/ga/student-data-privacy/ — O.C.G.A. §§20-2-660 to 20-2-668 in full (operator regime §20-2-666: 45-day deletion, consent from a student over 13 or a parent; outright collection bans on political affiliation, voting history, income, religion) (text third-party sourced from Justia — the primary code is not machine-readable)
    • us/state/tn/data-accessibility/ — Tenn. Code Ann. §§49-1-701 to 49-1-708 in full (operator regime §49-1-708 enforced via the Consumer Protection Act; written consent before biometric collection §49-1-706, and no grant or assessment may require it) (text third-party sourced from Justia)
    • us/state/tx/ed-code-32-151/ — Texas student information protection, Educ. Code ch. 32 Subchapter D in full (§32.155(b) TSDS unique-identifier masking; 60-day deletion)
    • us/state/tx/cubi/ — CUBI, Tex. Bus. & Com. Code §503.001 (retina/iris scans and hand/face geometry; notice + consent; $25,000 per violation; TRAIGA-amended text in force 2026-01-01)
    • us/state/tx/tdpsa/ — Texas Data Privacy and Security Act, ch. 541 in full (FERPA exemption is data-level; sensitive-data consent; §541.104 processor terms)
    • us/state/tx/scope-act/ — SCOPE Act, ch. 509 in full (§509.002(b)(7) expressly excludes operators regulated by Educ. Code ch. 32 Subchapter D)
    • us/state/tx/traiga/ — TRAIGA, ch. 551–552 in full (intent-based, not risk-tiered; §552.054(c) makes a CUBI violation a violation of ch. 552)
    • us/state/tx/school-cybersecurity/ — Tex. Educ. Code §11.175 (district cybersecurity policy, coordinator, breach reporting)
    • us/state/wi/pupil-records/ — Wis. Stat. §118.125 in full (pupil records confidential in the school's hands; behavioral records limited to one year after enrolment ends; transfer by the next working day)
    • us/state/va/school-service-providers/ — Va. Code §22.1-289.01 (binds providers directly; machine-readable copy duty)
    • us/state/va/student-records/ — Va. Code §22.1-287 and §22.1-79.3 in full (§22.1-287's access list is closed and has no vendor or school-official category; §22.1-79.3 is a state PPRA analogue — written consent where a survey may lead to a commercial sale, 30 days' notice naming who will have access and how privacy is protected, and an absolute bar on sexual-information surveys in K–6)
    • us/state/fl/student-records/ — Fla. Stat. §§1002.22/1002.222 (biometric ban incl. retina/iris scans)
    • us/state/fl/soppa-fl/ — Fla. Stat. §1006.1494 in full (operator statute: no targeted advertising/profiling/sale; deletion at course end or 90 days after un-enrolment)
    • us/state/fl/hb3-minors-online/ — HB 3 (2024), Fla. Stat. §§501.1736–501.1738 in full (a consumer statute with no school relationship in it: "social media platform" is a four-part test whose addictive-feature limb lists infinite scrolling, push notifications, reaction/share counts, auto-play and live-streaming; termination clocks of 90 days, 5 and 10 business days then permanent deletion; anonymous age verification binds the third-party verifier directly; AG penalty $50,000/violation plus a $10,000 private claim by the minor; First Amendment challenge pending)
    • us/state/il/soppa/ — Illinois SOPPA (105 ILCS 85) in full (operator and school duties; every school–operator agreement is published; parent breach notice within 30 days)
    • us/state/il/bipa/ — Illinois BIPA (740 ILCS 14) in full (private right of action, liquidated damages $1,000/$5,000; P.A. 103-769 caps repeated collection of the same identifier at one recovery)
    • us/state/il/pipa/ — Illinois PIPA (815 ILCS 530) in full (breach notice to residents and, above 500 residents, to the Attorney General; §45 security duty flows down by contract)
    • us/state/ny/ed-law-2d/ — N.Y. Educ. Law §2-d in full (third-party contractor duties incl. encryption in motion and at rest; contractor penalties and exclusion from state student data)
    • us/state/ny/part-121/ — 8 NYCRR Part 121 in full, the Commissioner's regulations under §2-d (NIST CSF v1.1 mandatory; contractor data security and privacy plan in the contract; breach chain 7 days contractor → agency, 10 agency → Chief Privacy Officer, 60 to those affected; exclusion from every NY agency's student data for up to 5 years)
    • us/state/nc/student-online-protection/ — N.C.G.S. §§115C-401.2, 115C-402.5 in full (operator regime; 45-day deletion; biometrics/politics/religion/voting barred from the state data system)
    • us/state/oh/school-device-monitoring/ — Ohio R.C. §§3319.325–3319.327 in full (H.B. 432: technology-provider duties, and a default prohibition on monitoring a school-issued device's location, camera/mic or keystrokes)
    • us/state/ok/student-data-act/ — 70 O.S. §§3-168, 24-114 in full (Student DATA Act governance; transcripts kept 80 years)
    • us/state/la/student-privacy/ — La. R.S. 17:3913/3914 (criminal penalties for unlawful disclosure)
    • us/state/la/personal-online-accounts/ — La. R.S. 51:1951–1955 in full (no educational institution may require a student's personal account credentials or penalise refusal; the school's own account is outside it; the employer limb reaches staff-facing products; and §51:1955 disclaims any duty to monitor)
    • us/state/wv/student-data-act/ — W. Va. Code §18-2-5h
    • us/state/sc/data-use-governance/ — S.C. Code §59-1-490 (biometric collection prohibited)
    • us/state/wa/biometric-identifiers/ — RCW 19.375 (risk-weighted: biometric identifiers incl. irises/retinas; commercial-purpose gate)
    • us/state/wa/my-health-my-data/ — My Health My Data Act, RCW 19.373 in full (no threshold; consumer health data expressly includes biometric data and anything inferred from non-health data by algorithm or ML; separate consents to collect and to share; geofence ban binding any person; enforced through the Consumer Protection Act, so a private right of action — but a vendor processing on a school district's behalf is outside "regulated entity" for that processing)
    • us/state/pa/breach-notification/ — Pennsylvania Breach of Personal Information Notification Act in full (vendor notice runs from discovery, §3(c); seven business days for a public school, §3(a.2))
    • us/state/ky/cloud-computing-students/ — KRS 365.734 (binds a cloud computing service provider; written compliance certification; parental permission is the only escape)
    • us/state/ky/personal-information-security/ — KRS 61.931–61.933 (a school district is an "agency", its supplier a "nonaffiliated third party"; 72-hour notice; contract must apportion response cost)
    • us/state/ms/protecting-children-online/ — Walker Montgomery Protecting Children Online Act (Miss. Code §§45-38-1 to 45-38-13) in full (binds digital service providers directly, not schools: age registration, parental consent with no school-agent route, no precise geolocation, no sharing of a known minor's data; enforceability contested in NetChoice v. Fitch)
    • us/state/in/student-records/ — IC 20-33-7 in full plus IC 20-19-3-9.4 (no Indiana SOPIPA: a records chapter on top of FERPA — equal access for custodial and non-custodial parents, disclosure without consent to a juvenile justice agency and in a health/safety emergency, the statewide student test number)
    • us/state/nj/student-records/ — N.J.A.C. 6A:32 Subchapters 7 and 13 in full (no NJ SOPIPA: the records duties are regulatory — 10-day access, health records kept separately, no PII on a district website, annual deletion that must leave no record of the deletion, and a 100-year mandated record)
    • us/state/co/privacy-act/ — Colorado Privacy Act, C.R.S. §§ 6-1-1301 to 6-1-1314 in full, 17 sections from the legislature's own compiled title 6. FERPA-regulated data and state higher-education data are exempt (§ 6-1-1304(2)(j)(V), (2)(o)) — do the exemption analysis before the 100,000-consumer threshold. "Minor" is under 18, "child" under 13: §§ 6-1-1308.5 (duty of care, rebuttable presumption) and 6-1-1309.5 (minors DPIA) from 1 Oct 2025 reach the 14–17 band that COPPA does not, and § 6-1-1305.5 puts assist duties on processors directly. § 6-1-1314 catches any amount of biometric identifiers regardless of threshold
    • us/state/co/privacy-act-rules/ — Colorado Privacy Act Rules, 4 CCR 904-3 in full, 72 rules (the operative detail layer). Rule 6.12 makes the biometric-identifier notice a build spec — homepage and app-store link, and a link in the app's settings menu; Rule 6.14 lists the safe harbours for an engagement feature that would otherwise need a minor's consent; Rule 8.05(C) requires a profiling DPA to be re-done annually with a fresh disparate-impact evaluation)
    • us/state/mt/consumer-data-privacy/ — Montana Consumer Data Privacy Act (MCA 30-14-2801 to 30-14-2820) in full (comprehensive act, AG-only, no private right of action; §30-14-2803(2) lifts the volume thresholds entirely for the three minors sections, and §30-14-2811(4)'s educational carve-out covers only targeted advertising and sale — an LMS still owes the duty of care, the geolocation rules and the consent regime)
    • us/state/or/consumer-privacy/ — Oregon Consumer Privacy Act, ORS 646A.570 to 646A.589 in full (AG-only, no private right of action; threshold counts consumers only, no small-business escape; access right reaches named third parties, not categories; a child's personal data is sensitive outright; 15 days to stop processing after consent is revoked; the notice-and-cure right is uncodified session law and is repealed 2026-07-01)
    • us/state/al/data-breach-act/ — Alabama Data Breach Notification Act of 2018, Code of Ala. §§8-38-1 to 8-38-12 in full (no Alabama student-privacy statute; vendors are third-party agents with 10 days to notify the district, §8-38-8; the one statute the AL SDPC Exhibit G names)
    • us/state/al/admin-code-290-3-1/ — Ala. Admin. Code r. 290-3-1-.02(3)–(5): student records, SSID, FERPA observance
    • us/state/al/data-use-governance-policy/ — Alabama State Board Data Use and Governance Policy (2013): every LEA adopts a local student records governance policy; ALSDE data to providers only under executed agreements
    • us/state/nv/school-service-providers/ — NRS 388.281–388.296 in full (binds the school service provider; disclosure + security plan before use; 30-day deletion; $5,000/violation; waivers void)
    • us/state/nv/pupil-data-privacy/ — NRS 388.267–388.278 in full (PII-disclosing contracts must carry privacy/security terms and a penalty; freemium-software policy)
    • us/state/az/student-data-privacy/ — A.R.S. §15-1046 (operator statute; covered information includes biometrics, voice, geolocation; Consumer Fraud Act)
    • us/state/az/biometric-and-recording-consent/ — A.R.S. §15-109, §1-602 (written parental consent for pupil biometrics incl. voice, and for school voice/video recording unless an exception such as regular classroom instruction applies)
    • us/state/mn/educational-data/ — Minn. Stat. §13.32 subds. 1, 3, 13–15; §13.05 subd. 11 (technology providers; 90-day return/destroy; no remote mic/camera/location access to school-issued devices)
    • us/state/ar/student-online-personal-information/ — Ark. Code §6-18-109 (SOPIPA model; Justia-sourced, 2023 Code)
    • us/state/ar/student-data-vendor-security/ — Act 754 of 2023, §§6-18-2601–2608 (enrolled act; contract terms, provider lists, security programme, destruction)
    • us/state/md/student-data-privacy/ — Md. Educ. §4-131 in full (operator = FERPA school official under contract; device IDs and voice recordings covered)
    • us/state/nm/data-breach-notification/ — NMSA §§57-12C-1 to 57-12C-12 (voice-print biometrics; 45-day notice to the data owner; school districts exempt, vendors not)
    • us/state/ne/student-online-personal-protection/ — Neb. Rev. Stat. §§79-2,153 to 79-2,155 in full (covered information includes biometrics, voice, geolocation; no enforcement provision)
    • us/state/nd/student-data-protection/ — N.D.C.C. §15.1-07-25.3 (no operator statute; board permission before student data goes to any other entity)
    • us/state/id/student-data-accountability/ — Idaho Code §33-133 in full (vendor contracts restrict secondary use; civil penalty up to $50,000 per violation against any person)
    • us/state/me/student-information-privacy/ — Student Information Privacy Act, 20-A M.R.S. §§951–953 in full (operator test is "used for" K–12; contextual advertising counts as targeted; 45-day deletion)
    • us/state/ks/student-data-privacy/ — Student Data Privacy Act, K.S.A. 72-6312 to 72-6320 in full (72-6315: no biometric collection or device assessing a student's physiological or emotional state without written consent; vendor breach notice)
    • us/state/ks/student-online-personal-protection/ — K.S.A. 72-6331 to 72-6334 in full (SOPIPA model; attorney general or district attorney enforcement)
    • us/state/hi/student-online-personal-information/ — HRS §§302A-499 to 302A-500 (SOPIPA model, public K-12 only; no penalty provision)
    • us/state/nh/student-teacher-information-protection/ — RSA 189:65 to 189:68-a in full (every app inventoried in the LEA privacy plan; operator duties name cloud services; no remote camera/microphone software on school devices without board approval and parental consent)
    • us/state/dc/students-digital-privacy/ — Protecting Students Digital Privacy Act of 2016, D.C. Code §§ 38-831.01–38-831.06 in full (PII expressly includes photos, video and audio recordings of the student's image or voice; school staff barred from remotely activating camera/microphone on 1-to-1 devices)
    • us/state/sd/student-records-privacy/ — SDCL 13-3-51 to 13-3-51.6 (binds the Department of Education; no operator statute)
    • us/state/sd/data-breach/ — SDCL 22-40-19 to 22-40-26 (any "information holder"; account credentials are protected information; 60-day notice)
    • us/state/de/student-data-privacy-protection-act/ — Student Data Privacy Protection Act, 14 Del. C. §§ 8101A–8106A in full (operator definition wider than SOPIPA; security must meet the DTI Cloud and Offsite Hosting Policy; 45-day deletion on request)
    • us/state/ri/student-data-cloud-computing/ — R.I. Gen. Laws § 16-104-1 in full (sole-purpose processing, no product-improvement exception; written compliance certification on contracting)
    • us/state/vt/student-privacy/ — Student Privacy, 9 V.S.A. §§ 2443–2443f in full (SOPIPA model; covered information includes biometrics, photos, voice)
    • us/state/wy/student-data-security/ — W.S. 21-2-202(a)(xxxiv), (xxxvii) and 21-3-110(a)(xxxv) (no vendor statute; district student-data policies reach vendors by contract)
    • us/state/mi/student-online-personal-protection/ — Michigan Student Online Personal Protection Act, MCL 388.1291–388.1295 (binds operators directly; covered information names biometrics, voice, photos, geolocation; service-provider contract terms)
    • us/state/ma/student-records/ — Massachusetts G.L. c. 71 §34D and 603 CMR 23 (no SOPIPA; provider staff see only what their duties require; other third parties need specific written consent; every access logged)
    • us/state/ma/security-breach/ — G.L. c. 93H (a holder of data it does not own must notify and cooperate with the owner)
    • us/state/mo/student-data-system/ — RSMo 161.096 (no SOPIPA; DESE vendor contracts bar sale and advertising use; the state may not collect student biometrics; vendor civil penalties)
    • us/state/mo/data-breach/ — RSMo 162.1475 and 407.1500 (a holder on behalf of another notifies the owner immediately; districts notify parents, DESE and the state auditor)
    • us/state/ct/student-data-privacy/ — C.G.S. §§10-234aa to 10-234gg in full (written contract with 10 mandatory terms, conflicting terms void; HIPAA-grade security; breach notice within 30/60 days)
    • us/state/ut/student-data-protection/ — Utah Code §§53E-9-301 to 53E-9-311, 2026 text (use strictly for the contracted service; audit right and fee-free termination for privacy violations; penalties up to $25k and a private right of action)
    • us/state/ia/student-online-personal-information/ — Iowa Code §279.71 (operators bound directly; flow-down terms; deletion on request)
    • us/state/ia/personal-information-security-breach/ — Iowa Code ch. 715C §§1–2 (holder on another's behalf notifies the owner immediately; biometrics are personal information)
    • us/state/ar/children-teens-online-privacy/ — Arkansas Act 952 of 2025, §§4-88-1501–1505 (in force 2026-07-01; children and teens 13–16; no targeted-ad collection; voice prints and facial templates are personal information)
    • us/state/md/online-data-privacy/ — Maryland Online Data Privacy Act, Com. Law §§14-4701–14-4714 in full (as in effect 2026-10-01; no targeted ads or sale for under-18s, no consent exception; child data is sensitive; processor contract terms; FERPA data exempt)
    • us/state/md/kids-code/ — Maryland Kids Code, Com. Law §§14-4801–14-4813 in full (in force, not enjoined; DPIA per product; high-privacy defaults; no default profiling or geolocation; no school exemption)
    • us/state/ma/data-security-regulation/ — 201 CMR 17.00 in full (written security program; service-provider contracts; encryption in transit and on portable devices)
    • us/state/de/dti-cloud-services-policy/ — Delaware DTI Terms and Conditions Governing Cloud Services and Data Usage, SE-CLD-001 and agreement (the security floor of 14 Del. C. § 8104A(1); US-only data location; FIPS 140-2 encryption or tiered cyber insurance; 24-hour breach notice to the State)
    • us/state/ak/personal-information-protection-act/ — AS 45.48 Articles 1, 4, 7 (districts are covered persons; an information recipient notifies the owner immediately)
    • us/state/ak/school-surveys-records/ — AS 14.03.110, 14.03.115 (written parental permission and two weeks' notice before school questionnaires/surveys)
    • us/state/al/device-filter-act/ — Code of Ala. ch. 8-19H (manufacturer filter on tablets/smartphones activated in Alabama; ch. 8-19K app-store law not commenced until 2027-01-01)
    • us/state/dc/security-breach-notification/ — D.C. Code §§ 28-3851–28-3853 (holder notifies owner; direct security duty; service-provider contracts must require security; credentials and biometrics covered)
    • us/state/wy/security-breach-notice/ — W.S. 40-12-501, 40-12-502, 6-3-901(b) (holder on another's behalf discloses to it; username/password and biometrics trigger notice)
    • us/state/mn/government-data-breach-remedies/ — Minn. Stat. §13.055 and §13.08 (contractor-held data is the entity's data; damages reach contractors via §13.05 subd. 11)
    • us/state/ri/student-social-media-privacy/ — R.I. Gen. Laws ch. 16-103 (no school demands for students' personal social media access; agents of the school included)
    • Research notes, no dedicated statute: ms · al · nm · ak
  • us/state/pr — Puerto Rico (territory; US federal law applies of its own force, these are the local instruments)
    • us/state/pr/ley-185-2024/ — Ley 185-2024, privacidad cibernética de menores (social-media scope test; minors = 18 or under; NET enforcement)
    • us/state/pr/ley-111-2005/ — Ley 111-2005, breach notification ("entidad" expressly includes every educational institution; 10-day DACO report)
    • us/state/pr/ley-85-2018-expedientes/ — Ley 85-2018 Art. 1.05, expedientes escolares (local FERPA sibling; Sistema de Datos Longitudinal)
    • us/state/pr/ley-40-2024/ — Ley 40-2024, government cybersecurity (binds contractors; 48-h PRITS incident notification, FISMA flow-down)