# What is a student data privacy agreement, and what should vendors sign?

> What a DPA covers, the National Data Privacy Agreement, state versions, and questions to ask any edtech vendor.

URL: https://theautismkit.com/guides/student-data-privacy-agreement
By The Autism Kit team · Updated 2026-09-27

**Short answer:** A student data privacy agreement (DPA) is a contract between a school district and an edtech vendor that sets out what student data the vendor may collect, how it's used, protected and deleted, and what happens after a breach. Many districts use the Student Data Privacy Consortium's National Data Privacy Agreement (version 2 released April 2024), often with state-specific terms.

**Key takeaways**
- A **DPA** is a contract about **student data** between a district and a vendor.
- It covers **collection, use, security, deletion** and **breaches**.
- Many districts use the **National Data Privacy Agreement**.
- Check the **SDPC registry** for signed agreements.

## What does a DPA cover?

| Area | What it sets out |
| --- | --- |
| Data collected | Which student data the vendor may access |
| Use | Only for providing the service; no selling or targeted ads |
| Security | How data is protected |
| Deletion | When and how data is returned or destroyed |
| Breaches | Notification duties and timelines |
| Subprocessors | Which third parties may handle data |

DPAs support districts' duties under FERPA, which protects student education records.[3]

## What is the National Data Privacy Agreement?

The Student Data Privacy Consortium publishes a National Data Privacy Agreement. Version 2 was released in April 2024, and states can add their own exhibits.[1] The consortium's registry lets member districts share agreements vendors have already signed.[2]

## What should schools ask any vendor?

**Try:**
- What student data do you collect, if any?
- Can the app work without student accounts?
- Where is data stored, and who can access it?
- Will you sign our DPA?

**Skip:**
- Assuming a free app collects nothing
- Clicking through terms without review

**Where The Autism Kit stands.** In the current app, children's routines and photos stay on the device, and there are no ads. We're happy to review
  your district's student data privacy agreement.

## What can I do next?

- [ ] Check whether your district uses the national DPA
- [ ] Search the SDPC registry for the vendor
- [ ] Send the vendor your DPA to review

Talk to us about your school or district: [For schools](https://theautismkit.com/schools)

## Common questions

### Is a DPA required by law?

Requirements vary by state. Some states require specific contract terms; many districts require a DPA as policy even where state law doesn't.

### Where can I see which vendors have signed?

The Student Data Privacy Consortium runs a registry where member districts share signed agreements, which can make approval faster.

### Will The Autism Kit sign our DPA?

We're happy to review your district's student data privacy agreement. Contact us through the schools page.

## Sources

1. Student Data Privacy Consortium (Access 4 Learning): National Data Privacy Agreement. https://privacy.a4l.org/national-dpa/
2. Student Data Privacy Consortium: Resource registry of signed agreements. https://sdpc.a4l.org/
3. US Department of Education, Student Privacy Policy Office: FERPA. https://studentprivacy.ed.gov/ferpa

General guidance, not a diagnosis or treatment plan. Talk with your pediatrician or a developmental specialist about your child's care.