Vendor data privacy agreements for Georgia districts

What is a vendor data privacy agreement?

A data privacy agreement (DPA) is the contract that sets how an education technology vendor may collect, use, protect, share and delete student data. For Georgia districts it puts Georgia's Student Data Privacy, Accessibility, and Transparency Act and federal laws such as FERPA, PPRA and COPPA into enforceable terms, and it documents the district's control over data held by the vendor.

This article describes the laws and common contract terms; it is not legal advice. Districts should confirm their obligations and contract language with their board attorney.

This week: ask who in your district can approve and sign technology agreements, including free tools accepted with a click.

What Georgia's student data privacy law says

Senate Bill 89 (2015) enacted the Student Data Privacy, Accessibility, and Transparency Act at O.C.G.A. § 20-2-660 through § 20-2-668, with that part of the law effective July 1, 2016 [1]. It covers "operators": companies whose website, online service or app is used for K-12 school purposes, was designed and marketed for those purposes, and collects or uses student personally identifiable information. General-audience services fall outside this section.

Under § 20-2-666, without the required consent an operator may not use student data for targeted advertising, build a student profile except for K-12 school purposes, sell student data, or disclose student personally identifiable information outside listed exceptions. When an operator passes data to its own service providers, it must contractually bind them to the same limits and to reasonable security. Operators must keep reasonable security procedures and delete a student's data within a reasonable time, not to exceed 45 days, when the school or local board requests deletion of data under its control [1].

The act also has district and state roles. The Georgia Department of Education (GaDOE) designates a chief privacy officer [2]. Parents may inspect their child's education record and request student data in it, including data maintained by an operator, unless the local board determines the operator's data cannot reasonably be provided. GaDOE develops a model complaint process, and local boards must adopt complaint procedures that designate at least one person to handle complaints, provide a written response, and allow appeal to the superintendent and then the board [1].

This week: confirm your district has named a privacy complaint contact and that the name is current.

FERPA, PPRA and COPPA in brief

The U.S. Department of Education's Privacy Technical Assistance Center explains in its February 2014 guidance that FERPA's school official exception is the provision most likely to apply when districts share student data with online services. The provider must perform a service the district would otherwise do itself, meet the criteria in the district's annual FERPA notice, be under the district's direct control for use and maintenance of records, and use the data only for authorized purposes. The guidance recommends written agreements, notes that clicking "accept" on terms of service creates a contract, and advises that free tools go through the same approval process as paid ones. It also summarizes the Protection of Pupil Rights Amendment's notice and policy requirements for marketing uses of student information [3].

COPPA generally applies to commercial websites and online services directed to children under 13, or that knowingly collect personal information from them. The Federal Trade Commission's amended COPPA Rule took effect June 23, 2025, with most compliance due by April 22, 2026. It adds biometric and government-issued identifiers to the definition of personal information and updates security, retention and deletion duties. The FTC chose not to finalize its proposed education technology and school-authorization provisions, saying it will continue to enforce COPPA in that context under existing guidance [4].

This week: check that your annual FERPA notice defines who counts as a school official, including contracted providers.

What to put in a DPA

On breach timing, Georgia's breach notification law requires a business that maintains computerized personal information on behalf of a data collector, a term that includes local government agencies, to notify that collector within 24 hours of discovering a breach [5]. That statute's definition of personal information is narrow, so consider writing a broader notice duty covering all student data into the DPA.

This week: pull your three most widely used student-facing tools and check each DPA against this table.

Using the SDPC and the National Data Privacy Agreement

The Student Data Privacy Consortium (SDPC), a special interest group of the Access 4 Learning Community, runs a resource registry of existing agreements [6] and maintains the National Data Privacy Agreement (NDPA), a common contract whose current standard version is listed as v2.2 [7]. The first NDPA was released in 2020 by a working group of attorneys, district officials, companies and nonprofits, with sections for describing services, addressing state law and recording changes to standard terms [8]. Where a state alliance exists, a vendor can sign one alliance agreement that other districts in that state can join [9].

SDPC's public pages report alliances by count rather than by state, so ask SDPC or check the registry to confirm whether a Georgia alliance is active and whether Georgia-specific terms exist before relying on them. Either way, the NDPA's structure is a useful checklist, and your board attorney can confirm what Georgia terms to add.

This week: search the SDPC registry for your top vendors to see whether they have signed agreements with other districts.

A practical vendor intake workflow and annual rhythm

1. Request. Staff submit a short form naming the tool, users, grade levels and purpose before use.
2. Classify. Identify what student or staff data it touches and whether users are under 13.
3. Check for an existing agreement. Look in your inventory and the SDPC registry.
4. Review. Compare the vendor's privacy policy, security answers and terms with your DPA standard.
5. Sign. Use your DPA or the NDPA, signed by an authorized district official.
6. Configure. Connect through single sign-on and rostering that sends only needed fields.
7. Record. Log the vendor, data, DPA status, signer and expiry or renewal date.

Then keep a yearly rhythm: refresh the inventory and publish the approved-tools list each summer, spot-check for unapproved tools mid-year, and in spring review renewals, send deletion requests for retired tools and file the vendors' written confirmations.

In the K12 Cyber Forward portal, the vendor registry tracks DPA status and expiry dates alongside your improvement plan. Technology directors can find related guidance at For technology directors.

This week: add a renewal date column to your vendor inventory and sort it by the next 90 days.