The nonprofit data layer

When school work connects with community organizations, such as a United Way partner running a family stability program, the data gets more sensitive than a typical classroom tool. Household income, benefits enrollment such as SNAP or Medicaid, housing status or homelessness, immigration status and household makeup can all appear. Much of this is collected from adults rather than students, and much of it is governed by program rules rather than by FERPA, so the student privacy toolkit from Track 1 only covers part of the picture.

The working rules are simple to state and hard to follow consistently. Collect the minimum. Keep the most sensitive fields out of AI prompts entirely. Set a retention limit for every field and delete on schedule. Get consent in plain language that names each partner who will see the data and makes withdrawal easy, and remember that when the data includes student records, FERPA still applies on top of whatever consent the family gives a nonprofit.

Data sharing agreements are the backbone. A good one states the purpose, lists the exact fields, limits who can access them, sets security requirements, bans redisclosure, sets breach notice timelines, and defines retention and deletion. The NDPA from Module 5 is a useful model for the structure. Program rules add their own constraints: SNAP has confidentiality rules at 7 CFR 272.1(c), HUD-funded homeless management information systems have their own privacy and security standards, and HIPAA applies only to covered entities and their business associates, which most nonprofits in this work are not.