Oklahoma — Student DATA Act and student records (70 O.S. §§3-168, 24-114)
Two provisions of Oklahoma's school code. §3-168 is the Student Data Accessibility, Transparency and Accountability Act of 2013 — a transparency-and-governance statute addressed to the State Board of Education rather than to vendors directly. §24-114 governs how school districts store and dispose of student records and transcripts.
Applicability to EdTech
Unlike the SOPIPA-family statutes, §3-168 imposes no duties on an operator by its own force: it binds the State Board and the State Department of Education. A supplier meets it through procurement. The provision that reaches a vendor is §3-168(C)(6), which requires that any contract governing databases, assessments or instructional supports containing student or de-identified data and outsourced to a private vendor carry express provisions safeguarding privacy and security — so the obligation arrives as contract terms, and the Department cannot lawfully agree less.
Two further constraints shape what may be asked of a system: student or de-identified data may not be transferred without State Board approval (§3-168(C)(3)), and "student data" expressly excludes juvenile delinquency records, criminal records, medical and health records, Social Security numbers and biometric information unless included in a student's educational record (§3-168(B)(7)(b)).
For retention design, §24-114 sets two hard numbers — see below; they are far longer than the deletion windows the operator statutes of other states impose, because they bind the district's own recordkeeping rather than a vendor's copy.
Key obligations at a glance
State Board of Education (§3-168(C))
- Create and publish a data inventory and dictionary of the individual student data fields in the student data system — (C)(1).
- Publish FERPA-compliance policies and procedures — (C)(2).
- No transfer of student or de-identified data unless the Board approves — (C)(3).
- Maintain a detailed data security plan — (C)(4).
- Ensure outsourced contracts carry express privacy and security provisions — (C)(6).
- Report annually to the Governor and the Legislature — (C)(7).
Scope of "student data" (§3-168(B)(7))
- Includes assessment results, course and transcript information, grades, demographics, attendance, discipline, special education data and the military student identifier — (B)(7)(a).
- Excludes juvenile delinquency records, criminal records, medical and health records, Social Security numbers and biometric information, unless in the educational record — (B)(7)(b).
Records and transcripts (§24-114)
- Districts compile and maintain temporary and permanent student records and regulate access and disclosure — (A).
- Storage may be electronic or paper, backed up and secured to State Board standards — (B).
- A transcript must be kept for not less than 80 years after graduation, transfer or withdrawal — (C).
- All other record information is disposed of between 5 and 7 years after the student leaves — (D).
Contents
| Document | Covers |
|---|---|
| STUDENT-DATA-ACT.md | §3-168 and §24-114 in full — short title, definitions, State Board duties, rulemaking, existing collections, and the record storage and disposal rules |
Licence
The reproduced text is 70 O.S. §3-168 and §24-114, enacted by the Oklahoma Legislature and taken from the Legislature's compiled Title 70 PDF on oklegislature.gov. No copyright subsists in this text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It went on: "judges—and, we now confirm, legislators—may not be considered the 'authors' of the works they produce in the course of their official duties as judges and legislators. That rule applies regardless of whether a given material carries the force of law." (slip opinion, pp. 1 and 5–6, read 2026-10-01.)
The PDF carries no copyright notice of its own (checked in full; its only use of the word is inside the statute text). The printed "Added by/Amended by" credits are part of the Legislature's own publication.
Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup, anchors and the rejoining of hard-wrapped lines). Nothing here suggests that the Oklahoma Legislature endorses the corpus.
Related
- North Carolina §115C-402.5 — the closest analogue: a state data-system governance provision with its own collection bans
- Illinois SOPPA §28 — the State Board duties counterpart, there sitting beside direct operator duties
- FERPA — the federal regime §3-168(C)(2) implements