language: en · status: in-force · last checked: 2026-10-08

Nevada — privacy of data concerning pupils: duties of state and local entities (NRS 388.267 to 388.278)

The "Duties of State and Local Entities" subheading of NRS chapter 388's part on the privacy of data concerning pupils. Most of it was enacted by 2015 Statutes of Nevada, chapter 492 (AB 221), whose section 12 provides "This act becomes effective on July 1, 2015"; sections on archiving, a FERPA-repeal contingency report and disclosures to law enforcement and third parties were added in 2025. These sections bind the Department of Education, boards of trustees and the governing bodies of charter and university schools, not the vendor. A supplier meets them through the district's contract and its software policies.

Applicability to EdTech

• Every contract that discloses pupil PII must carry two things: provisions specifically protecting its privacy and security, and a penalty for intentional or grossly negligent noncompliance, including termination and monetary damages (NRS 388.272(1)). A Nevada district cannot sign a data agreement without them, so a vendor's standard terms will be amended to include them.
• Freemium software needs a policy. Each board must adopt policies on teachers' use of "software offered to users free of charge for basic services, but that requires users to pay for any additional or premium proprietary features, functionality or virtual goods", and on data provided to a person without the board's express authorisation (NRS 388.271). Teacher-led free trials fall under that policy.
• Third-party access is published. The Department, and each board for data sent to the state system, must publish the third-party service providers that have access to individual pupil data (NRS 388.268(1)(b)(3), NRS 388.269(2)).
• The Department's data security plan binds districts (NRS 388.273(1)–(2)). Districts pass its requirements on to vendors under contract.
• The 2025 additions limit what a school may disclose to law enforcement and to third parties, including pupils' phone numbers and addresses (NRS 388.276, NRS 388.277, NRS 388.278).

Contents

Key obligations at a glance

• Department privacy policies, reviewed each biennium — NRS 388.267.
• Board policies on freemium software and unauthorised data provision — NRS 388.271.
• Mandatory privacy, security and penalty terms in PII-disclosing contracts — NRS 388.272.
• State data security plan, followed by districts — NRS 388.273.

Enforcement

These sections create no penalty of their own. NRS 388.272 makes the contract carry the penalty for a recipient's intentional or grossly negligent noncompliance.

Licence

The corpus reproduces NRS 388.267 to 388.278 verbatim from the Legislative Counsel Bureau's HTML of NRS chapter 388. The chapter page carries no copyright notice (checked in full), and NRS chapter 220, which governs the publication of the Nevada Revised Statutes, contains no copyright provision (NRS chapter 220, read 2026-10-08 through the Internet Archive capture of 14 November 2025).

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection." The SourceNote credits are the Legislative Counsel Bureau's, made in the course of its legislative duties, which is the situation that holding covers.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, whitespace collapsed, nothing reworded).

Related

• Nevada school service providers (NRS 388.281–388.296) — the second half of the same part, which binds operators directly
• FERPA — the federal regime NRS 388.267 requires the Department's policies to be consistent with
• Kentucky personal information security (KRS 61.931–61.933) — another state that writes security duties into the agency–supplier relationship

Sources

• Nevada Legislature — NRS chapter 388 (read through the Internet Archive capture of 6 October 2026; see the fact document)
• 2015 Statutes of Nevada, chapter 492 (AB 221) — the enacting act for NRS 388.267–388.273
• Nevada Legislature — 2015 Statutes of Nevada, chapter 492, section 12 (read through the Internet Archive capture of 17 April 2021) — "Sec. 12. This act becomes effective on July 1, 2015."; approved June 9, 2015