Arkansas — Student Data Vendor Security Act (Act 754 of 2023)
The Student Data Vendor Security Act, Act 754 of the 2023 Regular Session (HB 1757), approved 12 April 2023 and "effective on and after June 1, 2024" (Section 2). It sets duties for each local education agency (express privacy and security terms in every contract that shares student data, published lists of providers) and for each school service contract provider (transparency, use limits, a comprehensive security programme, destruction). Providers used under standard, non-negotiable terms ("on-demand providers") are covered more lightly. The act numbered its sections 6-18-2501 to 6-18-2508; they are codified as Ark. Code Ann. §§6-18-2601 to 6-18-2608. The text here is the enrolled act (see Meta).
Applicability to EdTech
- Two kinds of provider. A "school service contract provider" "enters into a formal, negotiated contract with a public education entity to provide a school service" (§6-18-2503(9)). A "school service on-demand provider" supplies a school service under "standard, nonnegotiable terms and conditions of service" agreed to by the entity or an employee (§6-18-2503(10)). Which one a vendor is depends on how the district contracted, and the duties differ.
- Every data-sharing contract must carry privacy and security terms, including contracts with on-demand providers and subcontractors (§6-18-2504(a)). Contracts with contract providers entered or renewed from the effective date must require compliance with the transparency and security sections (§6-18-2504(b)(2)(A)). A district may not contract with a provider that refuses those terms or has substantially failed to comply (§6-18-2504(b)(3)).
- Vendors are listed for parents. Districts keep lists of contract providers and of on-demand providers, update them at the start and mid-point of each school year, and give copies to parents on request (§6-18-2504(b)(1), (c)(1)). A district may stop using an on-demand provider that does not follow its own privacy policy, and must then notify the Department of Education (§6-18-2504(c)(3)).
- Transparency. A contract provider must explain to a layperson what student PII it collects, why, and how it is used and shared, covering all PII "regardless of whether it is initially collected or ultimately held individually or in the aggregate" (§6-18-2505(a)). It must give notice before privacy-policy changes that materially reduce protection (§6-18-2505(b)) and notify the contracting entity "as soon as possible" of any misuse or unauthorised release, including by a subcontractor (§6-18-2505, subsection (d)).
- Use limits. Collect, use and share only for contract purposes or with consent (§6-18-2506(a)). No sale, no targeted advertising and no non-school profiling (§6-18-2506(b)(1)). Subcontractors must be bound to the subchapter by contract, down the chain (§6-18-2506(c)(2)). Only a student aged 18 or over, or emancipated, can consent (§6-18-2506(d)).
- Security and destruction. A "comprehensive information security program" with administrative, technological and physical safeguards (§6-18-2507(a)). Destruction on the entity's request during the contract (§6-18-2507(b)), and of all PII at contract end within the contract's period or as soon as practicable, with the date of destruction confirmed on request (§6-18-2507(c)).
Contents
| Document | Covers |
|---|---|
| ACT-754-2023.md | Act 754 of 2023, Sections 1 (the new subchapter, §§6-18-2501 to 6-18-2508 as enacted) and 2 (effective date), as enrolled |
Key obligations at a glance
- Express privacy and security terms in every PII-sharing contract — §6-18-2504(a).
- Layperson-readable data inventory and purposes — §6-18-2505(a).
- No sale, targeted advertising or non-school profiling — §6-18-2506(b)(1).
- Comprehensive security programme; destroy on request and at contract end — §6-18-2507.
Enforcement
The act sets no penalty. Its sanction is contractual: a material breach involving misuse or unauthorised release leads the district to decide whether to terminate (§6-18-2504(b)(2)(B)), and a provider that refuses the terms or has substantially failed to comply cannot be contracted with or renewed (§6-18-2504(b)(3)).
Licence
The corpus reproduces Act 754 of 2023 verbatim from the enrolled act published by the Arkansas General Assembly at arkleg.state.ar.us (read 2026-10-08). The PDF carries no copyright notice (checked in full).
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."
Conditions: none attach to the act's text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (margin line numbers and page furniture dropped, line-break hyphenation rejoined, anchors added, nothing reworded).
Related
- Arkansas Student Online Personal Information Protection Act (§6-18-109) — the 2015 operator statute that sits alongside this act
- SDPC Arkansas state terms — the NDPA exhibit that requires compliance with this act
- Nevada school service providers (NRS 388.281–388.296) — a comparable "school service" regime with disclosure and security-plan duties
Sources
- Arkansas General Assembly — Act 754 of 2023 (HB 1757), enrolled
- Justia — 2023 Arkansas Code, Title 6, Subtitle 2, Chapter 18, Subchapter 26 — the codified numbering (index only), read through the Internet Archive capture of 17 December 2024