EdLaw
Alabama — student data governance (research note: no dedicated statute)
Alabama has no student-privacy statute of the SOPIPA or SOPPA kind: the Future of Privacy Forum lists none (the finding of 2026-09-06), and nothing found while collecting the instruments below (2026-10-08) contradicts it. What carries Alabama's student-data obligations instead is now in the corpus, instrument by instrument:
- The State Board of Education's Data Use and Governance Policy (approved October 10, 2013) — FERPA as the baseline, one-way data feeds to approved service providers only under executed agreements or Memorandums of Use, and a requirement that every LEA adopt a local student records governance and use policy, monitored by ALSDE: data-use-governance-policy/.
- Ala. Admin. Code r. 290-3-1-.02(3)-(5) — the State Board's rule on student records: the Unique State Student Identifier in all record-keeping systems, and "All schools must observe the Federal Educational Rights and Privacy Act (FERPA)": admin-code-290-3-1/. No other Administrative Code provision on student data privacy was found.
- The Alabama Data Breach Notification Act of 2018 (Code of Ala. 1975 §§8-38-1 to 8-38-12) — the general breach statute, which binds districts as covered entities and their vendors as third-party agents (10 days to notify the district): data-breach-act/.
- The Alabama Student Privacy Alliance's SDPC agreement — the AL NDPA V2 Standard, whose Exhibit G is a single sentence requiring service providers to comply with that breach act: org/sdpc/state-terms/al/.
What was searched
- The Future of Privacy Forum's state student-privacy law listings (no Alabama statute) — the original 2026-09-06 finding.
- The Code of Alabama on the Legislature's ALISON site: the Title 8 (Commercial Law and Consumer Protection) chapter list, 2026-10-08. Title 16 (Education) was not searched section by section; the no-statute finding rests on the FPF listing. Title 8 holds the breach act (Chapter 38) and two child-online chapters that are not student-data law. Chapter 19H (filters on tablets and smartphones activated in Alabama, Act 2025-406) is extracted as the device filter act. Chapter 19K (app store providers and developers, Act 2026-59) is headed "(Effective January 1, 2027)" on ALISON and is not carried until it commences.
- The Alabama Administrative Code (Legislative Services Agency), State Board of Education agency 290: the student-records paragraphs of r. 290-3-1-.02 are the only student-data provisions found.
- ALSDE publications (www.alabamaachieves.org, through the Internet Archive because the host did not resolve on 2026-10-08): the Data Use and Governance Policy; ALSDE's technology-plan and cybersecurity memoranda are guidance to LEAs and are not extracted.
- The SDPC: the national downloads page lists no Alabama template; the Alabama alliance's own agreement page (archived 2024-11-05) lists the AL NDPA V2 Standard and a district-modified variant.
Licence
The corpus reproduces no text here: this README is a research note, and the instruments it points to carry their own Licence sections (the breach act is public-domain; the Board policy, the Administrative Code rule and the SDPC exhibit are restricted). The label describes this README, which is the corpus's own writing.
Conditions: none.
Related
- ALSDE Data Use and Governance Policy
- Ala. Admin. Code r. 290-3-1-.02
- Alabama Data Breach Notification Act
- SDPC state terms — Alabama
- Mississippi — the corpus's other no-statute finding