The School Official Exception
Vendors can access student data without parent consent if designated as "school officials" with "legitimate educational interest." But this requires meeting specific FERPA criteria and contractual requirements.
When Vendors Can Access Data Without Consent
Under FERPA's school official exception, contractors can access education records if: the service would otherwise be performed by school employees, the vendor is under direct control of the school regarding data use, the vendor uses data only for authorized purposes, and the vendor meets criteria specified in the school's annual FERPA notice.
Required Contractual Provisions
Contracts with ed tech vendors should include: purpose limitation (data used only for contracted services), prohibition on secondary use (no use for marketing, profiling, etc.), security requirements, data retention and destruction terms, breach notification requirements, and audit rights.
Vendor Evaluation Checklist
- • What student data will the vendor access?
- • How will data be used, stored, and secured?
- • Who else might access the data?
- • What happens to data when contract ends?
- • What breach notification procedures exist?
- • Does the contract include required FERPA provisions?
FERPA Compliance
Ensure your data practices meet FERPA requirements and protect student privacy.
Common Vendor Compliance Issues
- • Data mining: Using student data for purposes beyond educational services
- • Insufficient security: Inadequate protection of stored data
- • Unclear data ownership: Questions about who controls student data
- • Retention issues: Keeping data longer than necessary
- • Third-party sharing: Sharing data with subcontractors without authorization
Managing Vendor Relationships
Before Contracting
Conduct privacy review before any vendor gets access to student data. Don't let technology adoption outpace compliance review.
During the Relationship
Monitor vendor compliance. Exercise audit rights. Respond to any concerns about data handling.
When Contracts End
Ensure data is returned or destroyed according to contract terms. Get written confirmation.
Resources & Guides
Access implementation guides, best practices, and training materials for your team.
Key Takeaways
- Vendors can access data under the school official exception with proper contracts and controls.
- Contracts must include purpose limitation, security requirements, and data handling terms.
- Conduct privacy reviews before contracting, monitor during, and verify data handling at termination.
Dr. Sarah Chen
Chief Education Officer
Former school principal with 20 years of experience in K-12 education. Dr. Chen leads AcumenEd's educational research and curriculum alignment initiatives.
