Data privacy agreements and the Pledge

A mid-sized district may use hundreds of online services, and every one of them handles some student data. Negotiating a custom privacy contract with each vendor is beyond the legal resources of most districts, and signing a different contract with every district is beyond most vendors. The Student Data Privacy Consortium (SDPC), part of the Access 4 Learning (A4L) Community, was formed to fix that by giving districts and vendors common contract language and a shared registry of signed agreements.

The result is the National Data Privacy Agreement (NDPA). It is a model data privacy agreement developed with districts, state alliances and legal counsel, designed so that the core privacy expectations are the same everywhere while leaving room for state-specific requirements.

The NDPA sits alongside the service agreement for a product. The standard clauses cover the purpose and scope of the agreement, the district's ownership and control of student data, parent and student rights of access, vendor obligations on use, security and subprocessors, breach notification, and the return or deletion of data when the service ends.

The exhibits carry the specifics. One exhibit describes the services being provided. Another is the schedule of data, which lists the data elements the vendor will collect, and must be updated when the vendor starts collecting new elements. One exhibit lets the vendor make a General Offer of Privacy Terms: once a vendor signs it with one district, other districts can accept the same terms without negotiating again. Further exhibits handle definitions, data deletion, data security requirements and state-specific terms.

The NDPA comes in variants. The standard agreement is used as written. A vendor-specific or district-modified agreement records negotiated changes. Version 2 was released in 2024, and the SDPC has since issued point releases. Use the version your state alliance currently specifies and check the SDPC site for the latest one before you sign. Several states also publish their own state-specific edition of the NDPA, with the extra terms their laws require already built in.

The SDPC Resource Registry is a public, searchable database of signed agreements between districts and vendors. Districts use it to see whether a vendor has already signed terms they can accept. Vendors can use it the other way round: reading agreements that comparable products signed is one of the best ways to learn what districts in a given state expect.

Because signed agreements are public, a vendor's data schedule and any negotiated changes are visible to every future customer. Write the data schedule accurately and narrowly. Overstating what you collect slows down every later review, and understating it is a breach of the agreement.

The standard NDPA was written for online services in general, not for AI features. It already constrains AI use through its limits on purpose, redisclosure and subprocessors. But reviewers report that the standard text does not contain a dedicated clause on training models with student data, so districts that want an explicit prohibition add it as a modification. Check the current version's text yourself before relying on this.

If you are building an AI feature, it is worth preparing language in advance rather than waiting for each district to draft its own. Useful terms to have ready: no training or fine-tuning of models on student data; model providers listed as subprocessors with their retention and training terms; prompts and outputs treated as student data when they contain it; retention limits on logs; and human review for any output that affects a decision about a student.

The Student Privacy Pledge was created in 2014 by the Future of Privacy Forum and the Software and Information Industry Association as a voluntary, public and legally enforceable commitment by edtech companies to a set of student privacy principles. It was updated in 2020, and hundreds of companies signed it.

As of April 25, 2025, the Future of Privacy Forum retired the Pledge. Former signatories were asked to remove references to it, and FPF has said they remain bound by their Pledge commitments for data collected while they were signatories. Some older guides, and some district questionnaires, still ask whether a vendor has signed the Pledge. The accurate answer today is that it no longer accepts signatories, and the right way to show the same commitments is through the NDPA, a clear privacy policy and the state law obligations covered in Module 4.