New York Codes, Rules and Regulations
Title 8 - EDUCATION DEPARTMENT
Chapter II - Regulations of the Commissioner
Subchapter E - Elementary and Secondary Education
Part 121 - Strengthening Data Privacy and Security in NY State Educational Agencies to Protect Personally Identifiable Information
Section 121.6 - Data Security and Privacy Plan

Universal Citation: 8 NY Comp Codes Rules and Regs § 121.6

Current through Register Vol. 46, No. 12, March 20, 2024

(a) Each educational agency that enters into a contract with a third-party contractor shall ensure that the contract includes the third-party contractor's data security and privacy plan that is accepted by the educational agency. The data security and privacy plan shall, at a minimum:

(1) outline how the third-party contractor will implement all state, federal, and local data security and privacy contract requirements over the life of the contract, consistent with the educational agency's data security and privacy policy;

(2) specify the administrative, operational and technical safeguards and practices it has in place to protect personally identifiable information that it will receive under the contract;

(3) demonstrate that it complies with the requirements of Section 121.3(c) of this Part;

(4) specify how Officers or employees of the third-party contractor and its assignees who have access to student data, or teacher or principal data receive or will receive training on the federal and state laws governing confidentiality of such data prior to receiving access;

(5) specify if the third-party contractor will utilize sub-contractors and how it will manage those relationships and contracts to ensure personally identifiable information is protected;

(6) specify how the third-party contractor will manage data security and privacy incidents that implicate personally identifiable information including specifying any plans to identify breaches and unauthorized disclosures, and to promptly notify the educational agency;

(7) describe whether, how and when data will be returned to the educational agency, transitioned to a successor contractor, at the educational agency's option and direction, deleted or destroyed by the third-party contractor when the contract is terminated or expires.

Disclaimer: These regulations may not be the most recent version. New York may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.