Under New York State Education Law §2-d (Ed Law 2-d) and its regulations (Commissioner’s Regulations Part 121), all students’ personally identifiable information (PII) must be protected by the third-party vendor that provides an application. If a site collects student names, IDs, or email addresses in order to give students access, the vendor must sign the district’s Parents’ Bill of Rights for Data Privacy and Security and the Ed Law 2-d supplemental information / Data Protection Agreement (DPA) before the tool is used with students.

PLEASE DO NOT USE ANY FREE APPLICATION WITH STUDENTS BEFORE CHECKING WITH THE TECHNOLOGY OFFICE / DISTRICT DATA PROTECTION OFFICER (DPO).  Free tools still collect student data and still require review — this is where most compliance gaps hide.