language: en · last checked: 2026-10-08

New Hampshire — student and teacher information protection and privacy (RSA 189:65 to 189:68-a)

New Hampshire's student-privacy subdivision of RSA chapter 189. It carries two regimes: the department's and schools' duties over student and teacher personally-identifiable data, with minimum standards that each local education agency's privacy plan must meet, including an inventory and review of every software application and digital tool and a requirement that service providers meet or exceed them (RSA 189:65–189:68); and New Hampshire's SOPIPA-model operator statute (RSA 189:68-a), which reaches cloud computing services by name.

RSA 189:65 Definitions

Verbatim from New Hampshire General Court — 189:65, reached through the Internet Archive capture taken 2025-11-06 (id_, the publisher's original bytes); see Meta.

In this subdivision:

I. "Biometric" means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, and handwriting.

II. "Board" means the state board of education.

III. "Department" means the department of education.

IV. "District", "school", or "school district" means a school district, including the school administrative unit to which it may belong, and the high school educational program at the state prison or county jail in which an inmate under the age of 21 inclusive or in which an inmate under the age of 21 inclusive who is a "child with a disability" under RSA 186-C:2, I, is participating.

V. "Disclosure" means permitting access to, revealing, releasing, transferring, or otherwise communicating, personally identifiable information contained in education records to any party, by any means, including oral, written, or electronic.

VI. "Statewide longitudinal data system" (SLDS) means the department's statewide longitudinal data system containing student information collected pursuant to RSA 193-E:5 and the state longitudinal database created to house data pursuant to RSA 193-E:5.

VII. "Student personally-identifiable data" means:

(a) The student's name.
(b) The name of the student's parents or other family members.
(c) The address of the student or student's family.
(d) Indirect identifiers, including the student's date of birth, place of birth, social security number, email, social media address, or other electronic address, telephone number, credit card account number, insurance account number, and financial services account number.
(e) Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.

VII-a. "Teacher personally-identifiable data" or "teacher data," which shall apply to teachers, paraprofessionals, principals, school employees, contractors, and other administrators, means:

(a) Social security number.
(b) Date of birth.
(c) Personal street address.
(d) Personal email address.
(e) Personal telephone number.
(f) Performance evaluations.
(g) Other information that, alone or in combination, is linked or linkable to a specific teacher, paraprofessional, principal, or administrator that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify any with reasonable certainty.
(h) Information requested by a person who the department reasonably believes or knows the identity of the teacher, paraprofessional, principal, or administrator to whom the education record relates.

VIII. "Testing entity" means a third party, within or outside of New Hampshire, contracted to administer the state assessment as defined in RSA 193-C:6.

IX. "Workforce information" means information related to unemployment insurance, wage records, unemployment benefit claims, or employment and earnings data from workforce data sources, such as state wage records, wage record interchange system (WRIS) data or the federal employment data exchange system (FEDES).

Source. 2014, 68:1. 2015, 71:2, eff. Aug. 1, 2015. 2023, 7:5, eff. June 25, 2023.

RSA 189:66 Data Inventory and Policies Publication

Verbatim from New Hampshire General Court — 189:66, reached through the Internet Archive capture taken 2026-09-30 (id_, the publisher's original bytes); see Meta.

I. The department shall create, maintain, and make publicly available an annually-updated index of data elements containing definitions of individual student personally-identifiable data fields or fields identified in RSA 189:68 currently in the SLDS or any other database maintained by the department, or added or proposed to be added thereto, including:

(a) Any individual student personally-identifiable data required to be reported by state or federal law.
(b) Any individual student personally-identifiable data which has been proposed for inclusion in the SLDS with a statement explaining the purpose or reason for the proposed collection.
(c) Any individual student personally-identifiable data that the department collects or maintains.
(d) Any data identified in RSA 189:68.

II. The department shall develop a detailed data security plan to present to the state board and the commissioner of the department of information technology. The plan shall include:

(a) Privacy compliance standards.
(b) Privacy and security audits.
(c) Breach planning, notification, and procedures.
(d) Data retention and disposition policies.

III. The security plan shall:

(a) Require notification as soon as practicable to:
- (1) Any teacher or student whose personally identifiable information could reasonably be assumed to have been part of any data security breach, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the integrity of the data system; and
- (2) The governor, state board, senate president, speaker of the house of representatives, chairperson of the senate committee with primary jurisdiction over education, chairperson of the house committee with primary jurisdiction over education, and commissioner of the department of information technology.
(b) Require the department to issue an annual data security breach report to the governor, state board, senate president, speaker of the house of representatives, chairperson of the senate committee with primary jurisdiction over education, chairperson of the house committee with primary jurisdiction over education, and commissioner of the department of information technology. The breach report shall also be posted to the department's public Internet website and shall not include any information that itself would pose a security threat to a database or data system. The report shall include:
- (1) The name of the organization reporting the breach.
- (2) Any types of personal information that were or are reasonably believed to have been the subject of a breach.
- (3) The date, estimated date, or date range of the breach.
- (4) A general description of the breach incident.
- (5) The estimated number of students and teachers affected by the breach, if any.
- (6) Information about what the reporting organization has done to protect individuals whose information has been breached.

IV. The department and each local education agency shall make publicly available students' and parents' rights under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. section 1232g, et seq., and applicable state law including:

(a) The right to inspect and review the student's education records within 14 days after the day the school receives a request for access.
(b) The right to request amendment of a student's education records that the parent or eligible student believes are inaccurate, misleading, or otherwise in violation of the student's privacy rights under FERPA.
(c) The right to provide written consent before the school discloses student personally identifiable data from the student's education records, provided in applicable state and federal law.
(d) The right to file a complaint with the Family Policy Compliance Office in the United States Department of Education concerning alleged failures to comply with the requirements of FERPA.

V. The department shall establish minimum standards for privacy and security of student and employee data, based on best practices, for local education agencies. Each local education agency shall develop a data and privacy governance plan which shall be presented to the school board for review and approval by June 30, 2019. The plan shall be updated annually and presented to the school board. The plan shall include:

(a) An inventory of all software applications, digital tools, and extensions. The inventory shall include users of the applications, the provider, purpose, publisher, privacy statement, and terms of use.
(b) A review of all software applications, digital tools, and extensions and an assurance that they meet or exceed standards set by the department.
(c) Policies and procedures for access to data and protection of privacy for students and staff including acceptable use policy for applications, digital tools, and extensions.
(d) A response plan for any breach of information.
(e) A requirement for a service provider to meet or exceed standards for data protection and privacy.
(f) A provision that students participating in career exploration or career technical education may, with written parental consent, register for technology platforms and services to be used as part of the student's approved program of study, which require the provision of personally identifiable information. Copies of written parental consent shall be retained as part of a student's educational record.

Source. 2014, 68:1. 2015, 136:1, eff. Aug. 11, 2015. 2018, 252:1, 2, eff. Aug. 11, 2018. 2020, 37:15, 16, eff. July 29, 2020. 2023, 225:2, eff. Oct. 3, 2023.

RSA 189:67 Limits on Disclosure of Information

Verbatim from New Hampshire General Court — 189:67, reached through the Internet Archive capture taken 2026-09-30 (id_, the publisher's original bytes); see Meta.

I. A school shall, on request, disclose student personally-identifiable data about a student to the parent, foster parent, or legal guardian of the student under the age of 18 or to the eligible student.

II. A school or the department may disclose to a testing entity the student's name, unique pupil identifier, and birth date for the sole purpose of identifying the test taker. Except when collected in conjunction with the SAT or ACT:

(a) When such tests are used for the purpose of the state assessment as defined in RSA 193-C:6, the data shall be maintained by the testing entity in accordance with RSA 193-C:12.
(b) The data shall not be disclosed by the testing entity to any other person, organization, entity, or government or any component thereof, other than the parent or guardian, the department, school or school district, and shall not be used by the testing entity for any other purpose except as provided in RSA 193-C:12.

II-a. Students taking the SAT or ACT, when such tests are used for the purpose of the state assessment as defined in RSA 193-C:6, may opt to have all personal information destroyed by the testing entity, following the completion and verification of the test.

III. Except as provided in RSA 193-C:12 or when collected in conjunction with the SAT or ACT, when such tests are used for the purpose of the state assessment as defined in RSA 193-C:6, neither a school nor the department shall disclose or permit the disclosure of student or teacher personally-identifiable data, the unique pupil identifier, or any other data listed in RSA 189:68, I to any testing entity performing test-data analysis. The testing entity may perform the test analysis but shall not connect such data to other student data.

IV. Except as provided in RSA 193-E:5, or pursuant to a court order signed by a judge, the department shall not disclose student personally-identifiable data in the SLDS or teacher personally-identifiable data in other department data systems to any individual, person, organization, entity, government or component thereof, but may disclose such data to the school district in which the student resides or the teacher is employed.

V. Student personally-identifiable data shall be considered confidential and privileged and shall not be disclosed, directly or indirectly, as a result of administrative or judicial proceedings.

VI. The department shall report quarterly on its website the number of times it disclosed student personally-identifiable data to any person, organization entity or government or a component thereof, other than the student, his or her parents, foster parents or legal guardian and the school district, early childhood program or post-secondary institution in which the student was enrolled at the time of disclosure; the name of the recipient or entity of the disclosure; and the legal basis for the disclosure.

Source. 2014, 68:1. 2015, 71:3. 2016, 69:1, eff. July 4, 2016. 2019, 323:2, 3, eff. Oct. 12, 2019.

RSA 189:68 Student Privacy

Verbatim from New Hampshire General Court — 189:68, reached through the Internet Archive capture taken 2026-09-30 (id_, the publisher's original bytes); see Meta.

I. Except as provided in RSA 193-C:12, the department shall not collect or maintain the following data in the SLDS:

(a) Name of the student's parents or other family members.
(b) Address of the student or student's family.
(c) Student email or other electronic address.
(d) Student or family telephone number.
(e) Student or parent credit card account number, insurance account number, or financial services account number.
(f) Juvenile delinquency records.
(g) Criminal records.
(h) Medical and dental insurance information.
(i) Student birth information, other than birth date and town of birth.
(j) Student social security number.
(k) Student biometric information.
(l) Student workforce information, including the employer's name.
(m) Height and weight.
(n) Body mass index (BMI).
(o) Political affiliations or beliefs of student or parents.
(p) Family income, excluding free and reduced lunch program eligibility as determined by Food Nutrition Services of the United States Department of Agriculture.
(q) Mother's maiden name.
(r) Parent's social security number.
(s) Mental and psychological problems of the student or the student's family.
(t) Sex behavior or attitudes.
(u) Indication of a student pregnancy.
(v) Religious or ethical practices, affiliations, or beliefs of the student or the student's parents.

II. No school shall require a student to use an identification device that uses radio frequency identification, or similar technology, to identify the student, transmit information regarding the student, or monitor or track the student without approval of the school board, after a public hearing, and without the written consent of a parent of legal guardian of an affected student which may be withheld without consequence.

III. No school shall install remote surveillance software on a school supplied computing device provided to a student without the approval of the school board, after a public hearing and without the written consent of a parent, foster parent, or legal guardian of the affected student which may be withheld without consequence. In this paragraph, "surveillance" means observing, capturing images, listening, or recording and shall not include locating equipment when there is reason to believe the equipment is about to be or has been stolen or damaged.

IV. No school shall record in any way a school classroom for the purpose of teacher evaluations without school board approval after a public hearing, and without written consent of the teacher and the parent or legal guardian of each affected student.

V. (a) Nothing in this section shall preclude the use of audio or video recordings for use with or by a child with a disability, or by such child's teacher or service provider when the child's individualized education program or accommodation plan includes audio or video recording as part of the child's special education, related services, assistive technology service, or methodology, so long as such audio or video recordings are made, used, and maintained in accordance with the Family Education Rights and Privacy Act, 20 U.S.C. section 1232g, and applicable state law.

(b) Nothing in this section shall preclude the use of audio or video recordings for student instructional purposes.
(c) Nothing in this section shall preclude the use of audio or video recordings for use in the instruction of teacher interns or student teachers after written notification to the parent or legal guardian of each affected student as to the purpose of, and privacy policy for, the recordings.

Source. 2014, 68:1. 2015, 71:4. 2016, 87:1, eff. May 19, 2016. 2019, 323:4, eff. Oct. 12, 2019. 2025, 141:400, eff. July 1, 2025.

RSA 189:68-a Student Online Personal Information

Verbatim from New Hampshire General Court — 189:68-a, reached through the Internet Archive capture taken 2026-09-30 (id_, the publisher's original bytes); see Meta.

I. For the purposes of this section:

(a) "Operator" means the operator of an Internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes.
(b) "Covered information" means personally identifiable information or materials, in any media or format that meets any of the following:
- (1) Is created or provided by a student, or the student's parent or legal guardian, to an operator in the course of the student's, parent's, or legal guardian's use of the operator's site, service, or application for K-12 school purposes.
- (2) Is created or provided by an employee or agent of the K-12 school, school district, local education agency, or county office of education, to an operator.
- (3) Is gathered by an operator through the operation of a site, service, or application described in subparagraph (a) and is descriptive of a student or otherwise identifies a student, including, but not limited to, information in the student's educational record or email, first and last name, home address, date of birth, telephone number, unique pupil identifier, social security number, financial or insurance account numbers, email address, other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, other student identifiers, search activity, photos, voice recordings, or geo-location information.
(c) "K-12 school purposes" means purposes that customarily take place at the direction of the K-12 school, teacher, or school district or aid in the administration of school activities, including, but not limited to, instruction in the classroom or at home, administrative activities, and collaboration between students, school personnel, or parents, or are for the use and benefit of the school.
(d) "Online service" includes cloud computing services, which shall comply with this section if they otherwise meet the definition of an operator.

II. (a) No operator shall knowingly engage in any of the following activities with respect to their site, service, or application:

(1) Targeted advertising on the operator's site, service, or application, or targeted advertising on any other site, service, or application when the targeting of the advertising is based upon any information, including covered information and persistent unique identifiers, that the operator has acquired because of the use of that operator's site, service, or application.
(2) Use of information, including persistent unique identifiers, created or gathered by the operator's site, service, or application, to amass a profile about a K-12 student.
(3) Sale, lease, rent, trade, or otherwise make available a student's information, including covered information. This prohibition does not apply to the purchase, merger, or other type of acquisition of an operator by another entity, provided that the operator or successor entity continues to be subject to the provisions of this section with respect to previously acquired student information.
(4) Disclosing protected information unless the disclosure is made to respond to or participate in judicial process.
(b) An operator shall:
- (1) Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.
- (2) Delete a student's covered information if the school or district requests deletion of data under the control of the school or district.
(c) Nothing in this section shall prohibit an operator from using de-identified student covered information as follows:
- (1) Within the operator's site, service, or application or other sites, services, or applications owned by the operator to improve educational products.
- (2) To demonstrate the effectiveness of the operator's products or services, including in its marketing.
(d) Nothing in this section shall prohibit an operator from sharing aggregated de-identified student covered information for the development and improvement of educational sites, services, or applications.

III. This section shall not apply to general audience Internet websites, general audience online services, general audience online applications, or general audience mobile applications, even if login credentials created for an operator's site, service, or application may be used to access those general audience sites, services, or applications.

IV. This section shall not limit Internet service providers from providing Internet connectivity to schools or students and their families.

V. This section shall not be construed to prohibit an operator of an Internet website, online service, online application, or mobile application from marketing educational products directly to parents so long as the marketing did not result from the use of covered information obtained by the operator through the provision of services covered under this section.

VI. This section shall not be construed to impose a duty upon a provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software or applications to review or enforce compliance with this section on those applications or software.

VII. This section shall not be construed to impose a duty upon a provider of an interactive computer service, as defined in 47 U.S.C. section 230, to review or enforce compliance with this section by third-party content providers.

VIII. This section shall not impede the ability of students to download, export, or otherwise save or maintain their own student created data or documents.

IX. The provisions of this section are severable. If any provision of this section or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.

Source. 2015, 128:1, eff. Jan. 1, 2016.