Student data privacy refers to the responsible, ethical, and careful collection, use, sharing, and protection of student data.

Ontario Schools looks holistically at the collection, protection, use, and life cycle of our data. Technology is a key component of the process, but even more important are the processes around data use. Of critical importance are the people who carry out those processes and use the data.

People, processes, and technology are the framework for our technology governance. Read more in our Technology Governance Guide.

Examples of technology protecting our data:

Examples of processes protecting our data:

Examples of people protecting our data:

There are several laws regarding student data privacy, some apply to schools while other apply to vendors.

Ontario Local Schools maintains a process for reviewing digital tools before they are used with students or district data. Any application that requires student accounts, collects student information, or stores district data must be reviewed and approved prior to use.

This process supports student privacy, system security, and instructional effectiveness.

This aligns with:

Board Policy 8305 — Information Security

(which establishes requirements for protecting district data and systems)

and

Board Policy 7540.02 — Digital Content and Accessibility

(which establishes expectations for district-approved digital tools and online resources)

Staff submit a request to use a digital tool that is not currently approved.

The Technology Department determines whether a Data Privacy Agreement (DPA) exists through the Student Data Privacy Consortium (SDPC) or works with the vendor to obtain one.

Tools that meet district privacy and security requirements may be approved. Tools that do not meet requirements may be denied or limited in use.

Ontario Local Schools participates in the Student Data Privacy Consortium (SDPC) and maintains an approved vendor list:

The district uses technical controls, including managed Google sign-in access, to help ensure that only approved applications connect to district accounts and student data.

Staff must submit requests for new digital tools and may only use applications that have been approved by the district.

These expectations align with:

Board Policy 7540.04 — Staff Technology Acceptable Use and Safety

(which requires staff to follow district technology procedures and protect student information)

A data privacy agreement is a legally binding contract between a data controller and a data processor, which defines how data will be used. In this case, the data controller is Ontario Local Schools, while the data processor is any third-party vendor we share student data with.

For schools, a data privacy agreement establishes several key parameters that govern what a third-party vendor can do with data, including:

Depending on the vendor, it may take days, weeks or months to negotiate a DPA that works for both parties. Most vendors are willing to work with schools to come to an understanding.

Multifactor authentication (MFA) requires two of the three following elements to log in

By enabling MFA, your account is much less likely to be hacked, even if your password becomes compromised. This is especially important for sensitive accounts like banking and health care. For more information on MFA, visit the Cybersecurity & Infrastructure Security Agency (CISA) website. 

Common Sense Media is an independent nonprofit organization that helps empower parents/guardians by providing information to make smart media choices.

 

Learn more about FERPA.

The Family Educational Rights and Privacy Act (FERPA) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

 

Learn about how data tells the story of YOU.

Learn about data privacy in this short article.