language: en · status: in-force · last checked: 2026-10-08

Wyoming — student data privacy and security (Education Code duty paragraphs)

Wyoming has no free-standing student-privacy act and no statute that binds an operator or vendor directly. Its student-data law is three paragraphs inside the duty lists of the Wyoming Education Code. 21-2-202(a)(xxxiv) has its reproduced text, including the data security plan, from 2014 Senate File 79 (Enrolled Act No. 66), effective 1 July 2014; its data-criteria wording appears earlier, as paragraph (xxxii) in 2011 House Bill 127 (Enrolled Act No. 98) and as (xxxiv) in 2012 Senate File 57, though no renumbering act was found, so that identity rests on the wording alone. 2017 House Bill 8 (Chapter 14, Session Laws of Wyoming 2017) added (xxxvii) and 21-3-110(a)(xxxv) with immediate effect on the Governor's signature of 16 February 2017:

• The state superintendent, with the department of enterprise technology services, must develop a data privacy and security plan for department data, and that plan must include a prohibition on the sale or trade of student data to private entities.
• The superintendent must maintain guidelines for school districts on student data.
• Each district's board of trustees must, from 1 January 2018, adopt and enforce a student-data policy in accordance with those guidelines.

Applicability to EdTech

These duties reach a vendor through the district's contract and policy, not directly:

• The district policy is the operative layer. Each board of trustees must "adopt and enforce a policy regarding the collection, access, privacy, security and use of student data in accordance with guidelines established by the state superintendent" (21-3-110(a)(xxxv)). A vendor serving a Wyoming district will meet that policy in its contract.
• What the guidelines must cover. Authorization and authentication mechanisms; administrative, physical and logical safeguards including encryption; privacy and security compliance standards; incident response "including breach notification and mitigation procedures"; and "Standards for retention and verified destruction of student data" (21-2-202(a)(xxxvii)).
• No sale of department data. The department's plan must include "Prohibition of the sale or trade of student data to private entities or organizations" (21-2-202(a)(xxxiv)(H)). The paragraph governs department data, not district or vendor data.

Contents

Key obligations at a glance

• Districts adopt and enforce a student-data policy under the superintendent's guidelines — 21-3-110(a)(xxxv).
• The guidelines cover access control, safeguards, incident response and verified destruction — 21-2-202(a)(xxxvii).
• The department's data privacy and security plan prohibits the sale or trade of student data — 21-2-202(a)(xxxiv).

Enforcement

The paragraphs set no penalty. They are duties of the state superintendent and of district boards of trustees.

Licence

The corpus reproduces the three paragraphs, with their section headings and lead-ins, verbatim from the Wyoming Legislative Service Office's compiled Title 21 PDF.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held that "officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties". The Title 21 PDF (wyoleg.gov/statutes/compress/title21.pdf, read 2026-10-08) carries no copyright notice or terms. Its text was searched for "copyright" and "all rights reserved", and only statutory uses of "all rights" turned up.

Conditions: none. The corpus names the source in Sources and in each section's {.meta} provenance line.

Related

• South Dakota student data reporting and privacy of records — another state whose student-data statute binds the education department rather than vendors
• Wyoming — computer security breach notice — the general breach statute (W.S. 40-12-501, 40-12-502)
• FERPA — which the department's plan and the district guidelines must comply with

Sources

• Wyoming Legislature — Wyoming Statutes, Title 21 (Education), compiled PDF
• Wyoming Legislature — 2011 HB0127, Enrolled Act No. 98 — section 1 amends 21-2-202 "by creating a new paragraph (xxxii)" ("In consultation with the office of the chief information officer and through a single repository, establish criteria and guidelines for the collection, storage, management and reporting of data…"); section 6(a), "this act is effective July 1, 2011"
• Wyoming Legislature — 2012 SF0057, Enrolled Act No. 65 — amends the same text as 21-2-202(a)(xxxiv)
• Wyoming Legislature — 2014 SF0079, Enrolled Act No. 66 — adds the data security plan to (xxxiv); section 5(a): "Sections 1 and 2 of this act are effective July 1, 2014", with sections 3 and 4 substituted under 5(b) depending on the Powers v. Mead litigation
• Wyoming Legislature — 2017 HB0008, Enrolled Act No. 14 — creates (xxxvii) and 21-3-110(a)(xxxv); section 2, "effective immediately upon completion of all acts necessary for a bill to become law"
• Wyoming Legislature — HB0008 (2017) bill digest — "2/16/2017 Governor Signed HEA No. 0014"; "Chapter No. 14 Session Laws of Wyoming 2017"