language: en · status: in-force · last checked: 2026-10-08

North Dakota — protection of student data; school district policy (N.D.C.C. §15.1-07-25.3)

North Dakota has no operator-binding (SOPIPA-model) student-privacy statute. The Century Code's student-data provision is addressed to the school board: each board must adopt a student-data protection policy that requires the board's own permission before student data is shared with anyone who is not a district employee or with "any other entity", and requires the superintendent to compile a list of the individuals and entities student data is shared with. The section was created by section 1 of 2015 Senate Bill 2326 (2015 N.D. Sess. Laws ch. 141), which has no effective-date or emergency clause and was filed with the secretary of state on 20 April 2015, so under N.D. Const. art. IV, §13 it took effect on 1 August 2015; it was last amended by 2025 House Bill 1357.

Applicability to EdTech

A board-level approval gate. The policy "must … Require that permission be obtained from the board before student data is shared with an individual who is not a school district employee or any other entity" (§15.1-07-25.3(2)(a)). A vendor that will receive student data from a North Dakota district is such an entity, so the sharing needs the board's permission under the district's policy — not only a purchasing decision.
The vendor will be on a list. The superintendent must compile "A list of individuals with whom and entities with which student data is shared" (§15.1-07-25.3(3)(a)), and the policy is available on request (§15.1-07-25.3(4)).
No vendor duties as such. Nothing in the section binds the vendor directly; contractual terms (for instance a data privacy agreement) are where a North Dakota district's requirements reach a supplier.

Document	Covers
STUDENT-DATA.md	N.D.C.C. §15.1-07-25.3 in full

Key obligations at a glance

Each board adopts a student-data protection policy — §15.1-07-25.3(1).
Board permission before sharing with non-employees or any other entity (parents and sharing authorised by law excepted) — §15.1-07-25.3(2)(a).
Sharing with the state student-information-system entity under a data sharing agreement designating the department an authorized representative under FERPA — §15.1-07-25.3(2)(b).
Superintendent's lists of recipients and of staff with access — §15.1-07-25.3(3).

Enforcement

The section sets no penalty and names no enforcing authority (§15.1-07-25.3).

Licence

The corpus reproduces N.D.C.C. §15.1-07-25.3 verbatim from the North Dakota Legislative Council's chapter PDF for chapter 15.1-07.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

The chapter PDF (ndlegis.gov — t15-1c07.pdf, read 2026-10-08) carries no copyright notice.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).

Kansas Student Data Privacy Act — a neighbouring state that binds districts and their service providers by statute
Idaho Code §33-133 — the board-and-district model with mandatory vendor-contract clauses
FERPA — the federal regime §15.1-07-25.3(2)(b) invokes

Sources

North Dakota Legislative Council — N.D.C.C. chapter 15.1-07 (PDF)
North Dakota Legislative Council — 2015 Session Laws, chapter 141 (Senate Bill 2326) — section 1 creates the section ("Protection of student data - School district policy"); no effective-date or emergency section; "Approved April 20, 2015 / Filed April 20, 2015"; the 2015 session-law section table lists "SB 2326 15.1-07-25.3 Created 141"
North Dakota Legislative Council — Constitution of North Dakota, article IV — §13: "Every law, except as otherwise provided in this section, enacted by the legislative assembly during its eighty natural meeting days takes effect on August first after its filing with the secretary of state" (same wording in the 2016 capture of the legis.nd.gov PDF)
North Dakota Legislative Assembly — HB 1357 (2025), bill overview — the 2025 amendment to §15.1-07-25.3