language: en · status: in-force · last checked: 2026-09-19

Indiana — student records (IC 20-33-7, IC 20-19-3-9.4)

Indiana's student-privacy layer is a records chapter sitting on top of FERPA, not an operator statute. IC 20-33-7 defines what an education record is, gives custodial and non-custodial parents equal access to it, sets out the two routes by which a school may disclose records without parental consent, and limits what happens to a student's stored property. IC 20-19-3-9.4 is the student test number — Indiana's statewide student identifier — and the military-connected identifier derived from it. The earliest-enacted sections reproduced, IC 20-33-7-1 to -3, were added by P.L.1-2005, SEC.17 (House Enrolled Act 1288, the 2005 education recodification), whose SECTION 17 is marked "[EFFECTIVE JULY 1, 2005]"; IC 20-33-7-4, -5 and 20-19-3-9.4 came later (P.L.255-2019, P.L.165-2025, P.L.1-2010).

Applicability to EdTech

There is no Indiana SOPIPA. Nothing in Indiana law imposes duties on an operator of a school service by its own force: no deletion window, no targeted-advertising ban, no contract-terms mandate. A supplier's obligations arrive through FERPA's school-official exception and through the district's contract.

What this chapter changes is what the school may lawfully ask a system to do:

• A product that models "the parent" as one account holder is wrong in Indiana. §20-33-7-2 requires equal access for a custodial and a non-custodial parent, and the only ground for withholding is a court order the school holds or knows of — so access control has to represent two parents and a per-parent court-order restriction, not a single guardian flag.
• Two disclosure routes operate without parental consent and a system must not block or log them as breaches: to a juvenile justice agency before adjudication, on the agency's written non-redisclosure certification (§20-33-7-3(b)), and to appropriate officials in a health or safety emergency (§20-33-7-4).
• The student test number (§20-19-3-9.4(a)) is the identifier Indiana expects to travel with a student, and it must support determining enrolment as of any past date. The military-connected identifier derived from it ((b)) is expressly confidential.

Indiana's comprehensive privacy act mostly does not reach school work

Indiana's Consumer Data Protection Act (IC 24-15) came into force on 1 January 2026, and two provisions decide how much of it touches a supplier to Indiana schools:

• The threshold — IC 24-15-1-1(a) applies the article only to a person controlling or processing the personal data of 100,000 Indiana consumers, or 25,000 while deriving more than half its gross revenue from selling personal data.
• The contractor exemption — IC 24-15-1-1(b)(1)(B) exempts a third party under contract with a state body or political subdivision when acting on behalf of that entity, and says in terms that the exemption does not cover data the third party holds or creates outside the scope of that contract. A school corporation is such an entity, so district work is outside the act while anything a supplier does with the same data beyond the contract is inside it.
• Its FERPA exemption is data-level — "personal data regulated by" FERPA — not an exemption for educational institutions, the same shape as the Texas TDPSA. That matters only where the contractor exemption does not already apply.

The act is therefore not extracted here; collect it if a non-school Indiana surface ships.

Key obligations at a glance

Access (§20-33-7-2)

• Equal access for custodial and non-custodial parents — (a).
• Withheld from a non-custodial parent only on a court order the school has a copy of or actual knowledge of — (b).

Disclosure without parental consent (§20-33-7-3, §20-33-7-4)

• To a juvenile justice agency, pre-adjudication, on a written certification not to pass it on except to another juvenile justice agency — §20-33-7-3(b)(3).
• A good-faith effort to comply carries immunity from civil liability — §20-33-7-3(e).
• Health or safety emergency: disclosure to appropriate officials, a defined list that includes law enforcement, DCS, medical personnel and named school administrators — §20-33-7-4(a).

Student property (§20-33-7-5)

• Property in a locker, desk or cubby may not be removed after a student dies, transfers or withdraws without giving the parent the chance to collect it — (b). Law enforcement powers are unaffected — (c).

Contents

Licence

The corpus reproduces IC 20-33-7 and IC 20-19-3-9.4 verbatim from the Indiana General Assembly's Indiana Code 2026 chapter PDFs, with each section's "As added by / Amended by" credit and the bracketed recodification notes.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

The chapter PDFs carry no copyright notice or terms (first and last pages read, and the full text searched, 2026-10-01). The site's HTML at iga.in.gov is a JavaScript application that serves no readable page to this network, so no site terms of use could be read; that does not affect the statute text, which the General Assembly enacts.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).

Related

• FERPA — the federal regime IC 20-33-7-3 and -4 carve exceptions out of
• Illinois SOPPA — the operator-duty regime Indiana does not have
• Texas TDPSA — comparator for a comprehensive act with a data-level FERPA exemption
• Oklahoma Student DATA Act — the other state here reached through its legislature's own PDFs

Sources

• Indiana Code 2026 — Title 20, Article 33, Chapter 7
• Indiana Code 2026 — Title 20, Article 19, Chapter 3
• Indiana Code 2026 — Title 24, Article 15 (Consumer Data Protection) — cited above, not extracted
• Indiana General Assembly — House Enrolled Act 1288 (2005) (PDF) — "SECTION 17. IC 20-33 IS ADDED TO THE INDIANA CODE AS A NEW ARTICLE TO READ AS FOLLOWS [EFFECTIVE JULY 1, 2005]", including "Chapter 7. Parental Access to Student Records" (read through the Internet Archive capture of 3 March 2017)
• Indiana General Assembly — House Enrolled Act 1001 (2005) — SECTION 177 amends "IC 20-33-2-7, AS ADDED BY HEA 1288-2005, SECTION 17", which the Indiana Code 2026, IC 20-33-2 credits as "As added by P.L.1-2005, SEC.17. Amended by P.L.246-2005, SEC.177" — identifying HEA 1288 as P.L.1-2005 (read through the Internet Archive capture of 11 August 2006)