EdLaw
New York — 8 NYCRR Part 121 (data privacy and security in educational agencies)
The Commissioner of Education's regulations implementing N.Y. Educ. Law §2-d, adopted by the Board of Regents on 13 January 2020 and effective 29 January 2020. §2-d sets the duties; Part 121 is where the operational detail lives — the standard, the plan, the timetables and the penalties.
This is the most demanding US state regime in the corpus for a supplier, and the reason is §121.5: it makes the NIST Cybersecurity Framework v1.1 the mandatory standard, so "reasonable safeguards" is not a judgement call in New York, it is a named framework an educational agency's policy must align to and a contractor's plan must implement.
Applicability to EdTech
A supplier receiving student data or APPR data from a New York educational agency is a third-party contractor (§121.1(s)) and the duties attach directly, not only through the contract. The definition reaches a click-wrap acceptance: §121.1(d) defines "contract or other written agreement" to include an agreement created in electronic form "that is used with software licenses, downloaded and/or online applications", so a free tool a teacher signs up for is inside the regime.
Three things have to exist before a contract can be signed, and they are supplier deliverables, not paperwork the district produces alone:
- A data security and privacy plan, included in the contract and accepted by the agency — seven mandatory elements in §121.6(a), including sub-contractor management, incident handling, and what happens to the data at the end of the contract.
- Supplemental information to the parents' bill of rights, published on the agency's website, covering exclusive purposes, sub-contractor safeguards, contract duration and end-of-contract data fate, the accuracy-challenge route, storage location, and encryption in motion and at rest — §121.3(c).
- Training for the contractor's own officers and employees with access, before access — §121.6(a)(4).
The eight direct duties in §121.9(a) are the operative clause set: align to the NIST CSF, comply with the agency's policy, least-privilege internal access, no purpose beyond the contract, no onward disclosure without parental consent (two exceptions), reasonable safeguards, encryption in motion and at rest, and no sale or marketing use. §121.9(b) pushes all of it down to sub-contractors.
Key obligations at a glance
Breach timetable (§121.10) — the tightest chain in the corpus
- Contractor → educational agency: 7 calendar days from discovery — (a).
- Agency → Chief Privacy Officer: 10 calendar days from receiving that notice — (b); and 10 days from its own discovery — (d).
- Agency → affected parents, eligible students, teachers, principals: 60 calendar days, or 7 days after a law-enforcement or vulnerability hold lifts — (e).
- The contractor pays for the notification where the breach is attributed to it — (f).
Penalties and exclusion (§121.11)
- Failure to notify: the greater of $5,000 or up to $10 per person whose data was released — (a).
- Other §2-d violations: up to $1,000, then $5,000 on a second involving the same data, then $10,000 — (b).
- The Chief Privacy Officer may bar a contractor from any New York educational agency's student data for up to five years, and may declare it not a responsible bidder for the same period — (e)(2), (e)(3). That is the commercially serious sanction, not the money.
Educational agency duties that constrain what may be asked of a system
- No sale, and no marketing or commercial use or facilitation — §121.2(a).
- Data minimisation in collection, processing and transmission — §121.2(b).
- Districts may not report juvenile delinquency records, criminal records, medical and health records, or student biometric information to the department — §121.2(d).
- A published policy aligned to the NIST CSF — §121.5(b); annual training for the agency's own staff — §121.7; a designated data protection officer — §121.8.
Contents
| Document | Covers |
|---|---|
| PART-121.md | §§121.1 to 121.14 in full — definitions, transparency and collection restrictions, bill of rights, complaints, the NIST CSF standard, the plan, training, the data protection officer, third-party contractor duties, breach reporting, civil penalties, inspection rights, the Chief Privacy Officer's powers, severability |
Licence
The reproduced text is 8 NYCRR Part 121, regulations of the Commissioner of Education made under Education Law §2-d(5)(a), from the Official Compilation of Codes, Rules and Regulations of the State of New York as served on govt.westlaw.com for the Department of State's Division of Administrative Rules. Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) was decided on judges and legislators; its rule is that "officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties" (slip opinion, p. 1, read 2026-10-01), and the Commissioner, making binding rules under a statutory mandate, is such an official. The Supreme Court has not applied the doctrine to agency rules in terms.
Neither the State nor Thomson Reuters asserts terms over the text on the site. The section pages carry no copyright notice and link only Privacy and Accessibility pages (the builder's cached copies, checked 2026-10-01). The site's Help page (Internet Archive capture 2026-09-23; the live site now serves a bot challenge to this network) says: "Documents are obtained directly from the state for Thomson Reuters Westlaw" and "SOURCE: The Official Compilation of Codes, Rules and Regulations of the State of New York." Thomson Reuters is the transport, not the author, and the corpus takes no Westlaw editorial matter.
Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup and anchors only; the source's italics are kept). Nothing here suggests that the Department of State or Thomson Reuters endorses the corpus.
Related
- N.Y. Educ. Law §2-d — the enabling statute; Part 121 implements it and its section references run throughout
- NIST CSF — the framework §121.5 adopts as the mandatory standard
- Illinois SOPPA — the closest analogue: operator duties plus published school–operator agreements
- FERPA — the federal regime §121.1(f), §121.5(d) and §121.12 build on
- SDPC state terms — how duties of this kind arrive as contract clauses (no New York exhibit is published; NY districts contract on §2-d/Part 121 terms directly)