From our colleagues, Michelle J. Anderson and Jim Halpert, originally published as a Data Protection, Privacy and Security Alert (US)

According to the Data Quality Campaign, 36 states considered 110 student data privacy bills in 2014, and 20 states enacted 28 such bills into law.  At least eight of these new laws may have significant implications for businesses that provide services involving student data to schools, and most of these laws have already taken effect.

IMPLICATIONS FOR VENDORS: Some of the new state student privacy laws specifically require that contracts with vendors include clauses that address the requirements of the new state law.  In most cases, the new state law will be directly applicable to vendors whether or not the contract warns them of the new requirements.

IMPLICATIONS FOR OPERATORS OF K-12 EDUCATIONAL WEBSITES, ONLINE SERVICES AND MOBILE APPS: In addition to new vendor contractor requirements , K-12 educational websites, online services and apps will be subject to various requirements regardless of whether they have a contract with a school.

See the full article (Data Protection, Privacy and Security Alert (US)) for information on steps to take and things to watch out for.