Ed Law 2-d
NY Education Law § 2-d
Statute: NY Education Law § 2-d (Article 2)
Regs: 8 NYCRR Part 121
THE major NY student data privacy statute. Requires every educational agency to adopt a Parents' Bill of Rights, designate a Data Protection Officer, align with NIST CSF, train staff annually, and tightly govern third-party-contractor data sharing.
School-side obligations
- Publish a Parents' Bill of Rights for Data Privacy and Security
- Designate a Data Protection Officer (8 NYCRR § 121.6)
- Adopt data security policy aligned with NIST Cybersecurity Framework
- Provide annual data privacy and security training to all employees handling student data
- Maintain an inventory of third-party contractors and data accessed
- + 4 more on detail page
Vendor-side obligations
- Sign contract incorporating Parents' Bill of Rights as supplement
- Adopt NIST CSF-aligned technologies, safeguards, practices
- Use student PII ONLY for authorized purposes
- NOT sell, market, or commercialize student PII
- Notify educational agency of breach without unreasonable delay, no later than 7 calendar days
- + 3 more on detail page
Breach notification: Vendor → school: ≤7 calendar days from discovery. School → parents and NYSED CPO: ≤10 calendar days from receiving vendor notice (or self-discovery).
Enforcement: NYSED Chief Privacy Officer. Civil penalties up to $10,000 per violation, $25,000 per school year for material violations. No express private right of action; Article 78 review available.