EdLaw
National Data Privacy Agreement (NDPA)
The SDPC's standardised data privacy agreement between districts and EdTech vendors. Current version v2.2, published 2025-11-19 (SDPC National DPA page), issued in three variants: Standard, Vendor-Specific, and District-Modified, with usage guidelines. Developed with 28 state alliances; per the SDPC, designed "to address common student data privacy concerns and streamline the educational application contracting processes for schools/districts who do not have the legal or fiscal resources", with over 222,000 standard DPAs executed since 2016.
Applicability to EdTech
This is the concrete instrument behind district requirements such as: no sale of student data, no targeted advertising or commercial profiling, data deletion/return on contract termination, and (in recent revisions) restrictions on using district data to train AI models. It operationalises FERPA's school-official exception and the state statutes' required contract clauses in one signable document.
Contents
| Document | Covers |
|---|---|
| CLAUSE-MAP.md | v2.2 Standard — school-official designation (1.1), no sale/disclosure (4.4), disposition (4.6), advertising limits (4.7), security (5.2–5.3), exhibits A–G |
Notable verified fact: the v2.2 Standard contains no AI/model-training clause — district AI-training prohibitions are custom additions, not standard NDPA terms (see the clause map).