Skip to content
the autism kit
Guide

What is a student data privacy agreement, and what should vendors sign?

What a DPA covers, the National Data Privacy Agreement, state versions, and questions to ask any edtech vendor.

By The Autism Kit teamUpdated Sep 27, 2026 · 1 min read
Listen to this articleAbout 1 min
Read aloud · speed
A person signing a document beside a notebook
Photo: Kaboompics.com on Pexels
The short answer

A student data privacy agreement (DPA) is a contract between a school district and an edtech vendor that sets out what student data the vendor may collect, how it's used, protected and deleted, and what happens after a breach. Many districts use the Student Data Privacy Consortium's National Data Privacy Agreement (version 2 released April 2024), often with state-specific terms.

Key takeaways
  • A DPA is a contract about student data between a district and a vendor.
  • It covers collection, use, security, deletion and breaches.
  • Many districts use the National Data Privacy Agreement.
  • Check the SDPC registry for signed agreements.

What does a DPA cover?

Typical DPA terms
AreaWhat it sets out
Data collectedWhich student data the vendor may access
UseOnly for providing the service; no selling or targeted ads
SecurityHow data is protected
DeletionWhen and how data is returned or destroyed
BreachesNotification duties and timelines
SubprocessorsWhich third parties may handle data

DPAs support districts' duties under FERPA, which protects student education records.3

What is the National Data Privacy Agreement?

The Student Data Privacy Consortium publishes a National Data Privacy Agreement. Version 2 was released in April 2024, and states can add their own exhibits.1 The consortium's registry lets member districts share agreements vendors have already signed.2

What should schools ask any vendor?

Try
  • What student data do you collect, if any?
  • Can the app work without student accounts?
  • Where is data stored, and who can access it?
  • Will you sign our DPA?
Skip
  • Assuming a free app collects nothing
  • Clicking through terms without review

What can I do next?

0 of 3 done

Talk to us about your school or district: For schools

Common questions

Requirements vary by state. Some states require specific contract terms; many districts require a DPA as policy even where state law doesn't.

Sources

  1. Student Data Privacy Consortium (Access 4 Learning): National Data Privacy Agreement. privacy.a4l.org
  2. Student Data Privacy Consortium: Resource registry of signed agreements. sdpc.a4l.org
  3. US Department of Education, Student Privacy Policy Office: FERPA. studentprivacy.ed.gov

This guide shares general information and our team's perspective, based on the sources above. Rules and services differ by country, region and school, so always check your local guidance and your organisation's policies. How we write our guides.

Was this guide helpful?
Share this guide with someone who'd find it useful
Listen

Keep reading

All guides and stories →

One small, useful tip a week

Practical ideas built on evidence-based practices, plus a free printable to start. Unsubscribe anytime.

We never sell or share your email.