Charter Data PrivacyJurisdictional Research
Home/Massachusetts/603 CMR 23.00

603 CMR 23.00

Massachusetts Student Records Regulations

Statute
603 CMR 23.00 et seq.
Regulations
M.G.L. c. 71, §§ 34D, 34E, 34F (statutory authority)
Enacted / Last Major Amendment
BoESE regulation under M.G.L. c. 71 authority
Jurisdictional Layer
Massachusetts (state)

Summary

Foundational MA student-records regulation, harmonized with FERPA. Governs maintenance, access, amendment, security, retention, and destruction of student records held by MA public and charter schools. Drives operational retention behavior: the transcript is retained 60 years and the temporary record 7 years after graduation, transfer, or withdrawal.

Key Terms

Student record
The transcript plus the temporary record, including all information kept by the school on a student in any form.
Eligible student
A student who has reached 14 or entered 9th grade, who gains record rights alongside the parent.

School-side obligations

  • Provide annual written notice to parents and eligible students (603 CMR 23.10)
  • Maintain a log of all access to the student record (603 CMR 23.07)
  • Follow the retention schedule: transcript 60 years, temporary record 7 years (603 CMR 23.06)
  • Permit inspection and amendment of records
  • Maintain physical and electronic security of records

Vendor-side obligations

  • Not a regulatory mandate in 603 CMR; a vendor DPA is operational best practice
  • Support the school's access-log, retention, and security obligations for any handled records

Breach notification

M.G.L. c. 93H (the general MA breach law, implemented by 201 CMR 17.00) applies to PII broadly, including student data.

Enforcement

MA Department of Elementary and Secondary Education (BoESE).

NCSC AI Toolkit — Scanner Fields

These fields in the NCSC AI Toolkit derive from this statute:

state_primary_lawrequires_annual_notificationretention_transcript_yearsretention_temporary_yearsaccess_log_requiredstate_general_breach_law

Case Law — Verification Queue

Pending vLex verification. Never cite these without verification.

  • 603 CMR 23 construction
    TBD
    vLex query: '603 CMR 23' /s student records

Open Questions / Unsettled Law

  • Vendor DPA is not a 603 CMR mandate (an operational gap versus NY and NJ)
  • Interaction of 201 CMR 17.00 data-security rules with student-record handling