Student Data Privacy Obligations Growing Charter and Independent Schools Underestimate

A school with 400 students collects far more than names and grades. It holds addresses, health notes, disciplinary records, special education plans, free and reduced lunch status, and the contact details of every parent. Most of that data now lives in software the school does not run, owned by vendors the school may have never formally reviewed. When a school grows from one campus to four, that data footprint multiplies, and the privacy obligations attached to it grow with it.

Why growing schools underestimate the problem

Small schools run on trust and proximity. The head of school knows the registrar, the registrar knows the student information system, and everyone assumes the vendor handles security. That assumption works until the school has 1,500 students, six platforms, and no one whose job is to ask what each platform does with the data.

Three things change as a charter network or independent school grows.

The number of systems expands faster than the number of reviews. A student information system, a learning management system, a communication app, a transportation tool, a food service platform, a counseling tool, and a handful of classroom apps teachers adopted on their own. Each one receives student data. Few have been through a formal vendor review.

Responsibility spreads out. In a single-campus school, the principal signs off on everything. In a network, a regional director, a campus lead, and individual teachers all make technology decisions. No single person sees the full list of tools touching student records.

Funders, authorizers, and parents pay closer attention. A breach at a four-campus network is a story. Authorizers ask about data practices during renewals, and parents increasingly ask where their children's information goes.

What the main rules actually require

Student data privacy is not governed by one law. Three layers apply to most growing schools, and the layers overlap.

FERPA

The Family Educational Rights and Privacy Act protects student education records and gives parents and eligible students rights to inspect and correct them. It applies to schools that receive funds from the U.S. Department of Education, which covers charter schools as public schools. Many private and independent schools receive no such funds and may fall outside FERPA directly, though they often follow it by contract, by accreditor expectation, or because the vendors they use require it. Confirm your status rather than assuming.

FERPA matters most for how schools share data with vendors. The Department of Education's Student Privacy Policy Office explains the "school official" exception: a vendor can receive student records without parent consent only if the school keeps direct control over how the vendor uses and maintains that data. In practice, that means a contract that limits the vendor to the contracted purpose, prohibits redisclosure, and requires deletion or return of data at the end of the relationship. A click-through terms of service that lets a vendor use student data for its own product development does not satisfy that test. The Department publishes guidance at studentprivacy.ed.gov.

COPPA

The Children's Online Privacy Protection Act governs online services that collect personal information from children under 13. Schools can sometimes consent on behalf of parents for educational purposes, but the vendor remains bound by the rules. The Federal Trade Commission finalized amendments to the COPPA Rule in April 2025, the first major update since 2013. The amendments broaden the definition of personal information to include biometric identifiers and add requirements around data retention and security programs. The compliance date is April 22, 2026, so the updated obligations are now in force for the vendors your school uses. The FTC declined to adopt education-specific changes in that update, so the school-consent question remains governed by existing guidance. The full rule text is in the Federal Register.

For a school, the practical point is simple. If a classroom app collects data from students under 13, ask the vendor how it handles consent, retention, and deletion, and get the answer in writing.

State student privacy laws

Many states have their own student data privacy statutes, and they are often stricter than the federal baseline. California's Student Online Personal Information Protection Act, for example, restricts how operators of educational services may use student information, including a ban on targeted advertising based on it. Networks that operate across state lines face a different set of rules in each state. Check your state education agency and your authorizer for current requirements, since these laws change frequently.

What a breach actually costs a school

The risk is not theoretical. The Center for Internet Security reported in March 2025 that 82% of K-12 schools experienced a cyber incident between July 2023 and December 2024. The December 2024 attack on the PowerSchool student information platform exposed the personal data of an estimated 62.4 million students, and individual schools that had done nothing wrong spent weeks answering parent questions and notifying families. Ransomware attacks on education institutions rose 23% year over year in the first half of 2025, with an average ransom demand of $556,000, according to reporting by Cybersecurity Dive.

A vendor breach is still your breach in the eyes of parents. For a school with a $6 million annual budget, an incident that requires forensic work, legal counsel, family notification, and credit monitoring can consume a meaningful share of a year's technology and operations spending, before counting the reputational cost with families deciding whether to re-enroll.

A practical framework for the first 90 days

A growing school does not need an enterprise privacy program. It needs a short list of things done in the right order.

1. Inventory every system that holds student data. Start with finance and the registrar, then ask each campus lead and a sample of teachers what they use. Include free tools. The first inventory almost always surfaces tools leadership did not know about.
2. Classify the data in each system. Note which tools hold sensitive categories: health information, special education records, discipline, immigration or housing status, and anything about students under 13.
3. Review contracts for the five clauses that matter. Purpose limitation, no redisclosure, security requirements, breach notification timing, and deletion or return of data on termination. Flag any vendor that reserves the right to use student data for its own purposes.
4. Assign an owner. One named person, not a committee, is accountable for the inventory, the contract review, and the annual refresh. At a small school this is often a part-time role.
5. Set a technical baseline. Multifactor authentication on every account with access to student records, role-based access so staff see only what they need, and encrypted devices for anyone who takes records off site.
6. Write a one-page incident plan. Who gets called, who decides on notification, who talks to families, and which law firm or insurer is on retainer. Test it once a year with a short tabletop exercise.
7. Train staff on the common failure points. Phishing, sharing files with open links, and signing up for new apps with a student roster. Short, scenario-based sessions at the start of each year work better than annual slide decks.
8. Revisit the list every year. New apps appear every semester. A yearly review before the school year starts keeps the inventory honest.

Where fractional IT leadership fits

Most schools in the 25 to 200 employee range cannot justify a full-time chief information officer or privacy officer, and they should not have to. Their managed service provider keeps devices running and accounts working, which is valuable work. The gap is the layer above it: someone who maintains the vendor inventory, reads the data processing terms, sets the security baseline, and gives the head of school and the board a clear answer when an authorizer or parent asks how student data is protected.

Elevaire Systems provides that layer as Fractional IT Leadership. We work alongside the school's existing IT provider, take ownership of the inventory and contract review, and translate the findings into decisions leadership can act on. The goal is not more tools. It is a school that can answer the question "where does our student data go, and who is responsible for it?" in one sentence.

Frequently Asked Questions

Does FERPA apply to private and independent schools?

FERPA applies to schools that receive funds from the U.S. Department of Education. Charter schools generally do. Many private schools do not, so FERPA may not bind them directly. Even so, vendors, accreditors, and parents often expect FERPA-style practices, and state laws may apply regardless of federal funding.

Is a vendor responsible if it gets breached, or is the school?

Both, in different ways. The vendor carries legal and contractual responsibility for its own security. The school remains responsible for choosing vendors with care, having a contract that requires breach notification, and communicating with families. Parents and authorizers will look to the school first.

How much does it cost to get student data privacy under control?

For a school with one to four campuses, the first 90 days are mostly staff time: building the inventory, reviewing contracts, and setting a security baseline. Ongoing cost depends on the tools you add, such as identity management and device encryption, and on whether you retain outside help. A fractional engagement typically costs a fraction of a full-time hire, because the work is concentrated in setup and a regular review cycle.

How does this work alongside our existing IT provider?

It works as an addition. Your IT provider continues to handle devices, networks, accounts, and day-to-day support. Fractional IT leadership covers the planning and oversight work they are usually not scoped to do, such as vendor privacy reviews, policy, and reporting to leadership. The two roles share information and avoid overlap.

Can teachers keep using free classroom apps?

Often yes, once the apps are reviewed. Set a simple approval process: teachers submit the tool, the owner checks the privacy terms against the five contract clauses, and approved tools go on a shared list. Tools that sell student data or use it for advertising should not be approved.

How do we get started?

Begin with the inventory. Ask every campus lead and department head to list the tools they use that involve student information, then compare that list to what finance pays for. The gaps show you where the risk is. From there, prioritize the systems that hold the most sensitive records and review those contracts first.