The Plentiful Pitfalls of Personally Identifiable Data

In this 2021 article, Robert Iskander explains why personally identifiable information is a serious risk for schools and districts, from vendor agreements to ransomware. The section added below updates the picture with the federal rules, the shared agreement templates and the cybersecurity findings available in 2026.

It is hard to overstate the gravity of personally identifiable information as it relates to any and all student and minor populations. By definition, personally identifiable information (PII) is a clear and present danger to every school and every district. We can look at the current data governance, what is planned, and which organizations are taking the lead in this arena. If PII is any data that could potentially identify an individual, then districts really need to take a hard look at their practices. 

Potential pitfalls 

By collecting and storing PII data within their application database and/or their platform (willingly or unwillingly), school and district vendors will have to meet a higher standard of regulatory compliance in terms of what they can or cannot do with any of the school data and have to agree to strict data privacy rules and regulations by signing a Data Privacy Agreement (DPA). A sample DPA could be found on A4L’s SDPC (Student Data Privacy Consortium) website; SDPC is a national initiative that is attempting to standardize the suitable language for DPA’s that both schools and vendors are willing to agree to. 

In addition to signing DPA’s, vendors have to comply with strict security requirements and audits that are now being imposed on all vendors. There are several standards for security compliance, including ISO 27001 & 27002 and NIST, in addition to SOC-2 Types 1 & 2 audits. These types of compliance requirements and third-party audits are very expensive and take a long time to materialize. They become major barriers to market entry for early-stage EdTech startups, and in many cases, larger EdTech companies. 

Another challenge for school districts now is auditing each of the applications for PII data collection or storage and going through and vetting each of the vendors that require PII data in their platform. The vetting process and tools are still very primitive and are usually driven by State regulations, and many of the districts don’t have the expertise nor the resources to do it correctly.  This is an area in which several standards organizations such as IMS Global Learning Consortium are currently working. 

Real-time risks of not getting it right

Districts have a lot to lose by not getting this right due to student and consumer data privacy compliance regulations – and associated financial penalties – imposed by the federal and state government regulators. But the biggest financial risk is ransomware attacks to schools and vendors alike. There are hundreds of reported cybersecurity ransomware attacks on schools every year, and it is increasing exponentially, costing these school districts hundreds of millions of taxpayer dollars every year. You also have personal and professional liability on the part of the superintendent – this can be very serious.

The growth of online learning is spooling up effects on student data privacy

As students and teachers spend more time learning online remotely from home outside their school’s firewalled and/or filtered internet infrastructure, there is no more proactive school-monitored protection. This leaves the students and staff open to online scammers through several types of online cybersecurity attacks and vulnerabilities. Phishing attacks are common and more untrained learners may fall hostage to such attacks, stealing their identities and accessing credentials to other important online applications. This is why it is important to create a safe online digital learning environment that starts with a managed access device (such as a Chromebook or PC), a filtered Internet connection (from home), and more importantly, a safe and secure iPaaS (Integration Platform as a Service) such as School Passport which will govern the exchange of data with vendors. 

With 90 percent of students using digital devices at least four days per week, the use of EdTech platforms has exploded. Hundreds of new product ideas were launched globally into the market for student use during the pandemic. EdTech is here to stay and evolve. As new companies emerge, they can better equip themselves to face a security crisis, and every EdTech business should have an incident response plan in place.

The bottom line is that schools are obligated to keep PII private. As a rule, schools should reduce the amount of information collected and govern the exchange of data with EdTech vendors providing only what is necessary to use their SaaS platform.

Student data privacy in schools: the rules, the tools and the 2025 update

Student data privacy in schools rests on a small number of federal laws, several shared tools and a lot of local decisions, and Robert Iskander’s article above is right that the vendor relationship is where most of those decisions land. This section sets out what the main laws say, what changed in 2025, and what a district can do about the vendor vetting problem Iskander describes.

What FERPA requires of schools and their vendors

The Family Educational Rights and Privacy Act (FERPA) protects education records, and the U.S. Department of Education’s student privacy office explains that personally identifiable information under the law includes names, addresses, student numbers and indirect details that could identify a student. Parents, or students once they turn 18 or attend a postsecondary institution, may inspect records, ask for corrections and generally must consent in writing before the information is shared. One exception matters most for technology: a school may share information with a vendor as a “school official” if the vendor performs a service for the school, is under the school’s direct control and is bound by limits on sharing the data onward. That is the legal reason a data privacy agreement matters, because the agreement is how a school shows that a vendor is under its control and limited in what it may do with the data.

The 2025 changes to children’s online privacy

The Federal Trade Commission enforces a second law, the Children’s Online Privacy Protection Act (COPPA), which covers companies that collect information from children. On January 16, 2025 the FTC announced final changes to the COPPA Rule: separate parental consent before disclosing a child’s information to third parties for purposes such as targeted advertising, limits on how long data may be kept, more transparency from approved safe harbor programs, and a wider definition of personal information that adds biometric and government-issued identifiers. The rule takes effect 60 days after publication in the Federal Register, and companies have one year from publication to comply with most provisions. The same announcement says the FTC chose not to finalize proposed changes affecting educational technology companies in school settings, so the questions that are specific to schools still turn on FERPA and state law.

Shared agreements instead of one-off negotiations

Iskander describes the Student Data Privacy Consortium as an effort to standardize agreement language. Its current site offers a National Data Privacy Agreement and a searchable registry of existing agreements, so a district can see whether a vendor has already signed terms with others. The site reports more than 233,000 active agreements covering about 15,900 applications, participating districts in 41 states, and over 295,000 standard agreements signed since 2016 without legal negotiation. These are the consortium’s own figures, but they show that the template approach has become a common route for districts that cannot negotiate each contract alone.

What a cyberattack costs a district

Iskander’s warning about ransomware has a government source behind it. In a report published in October 2022, the Government Accountability Office found that state and local officials reported cyberattacks on K-12 schools causing three days to three weeks of lost learning, with recovery taking two to nine months. Those figures describe disruption to teaching and are a different measure from the attack counts and dollar totals quoted in the original article, which come from the author and which this section has not verified.

A short list for district leaders

1. Keep an inventory of every application that holds student information, with a named owner for each.
2. Ask whether the vendor has signed an agreement through the Student Data Privacy Consortium or an equivalent state agreement before a teacher adopts the tool.
3. Collect less. As Iskander says, schools should provide vendors only what a platform needs to function, and anything not collected cannot be breached.
4. Write down who is called, and in what order, when a vendor reports an incident.

Related questions about how students learn to protect their own information are covered in the edCircuit digital citizenship guide. The law will keep changing, and districts that already have an inventory and a standard agreement will find each new vendor question easier to answer.

Subscribe to edCircuit to stay up to date on all of our shows, podcasts, news, and thought leadership articles.

More on Cybersecurity