Data Privacy Center

Data privacy refers to how personal information is collected, used, stored, and shared. In a K–12 school district, this means ensuring that sensitive information about students and staff is handled responsibly and securely. 

This includes information such as: 

• Student names, IDs, and demographic details 

• Class schedules, grades, and academic progress 

• Attendance and assessment data 

• Health and accommodation information 

• Digital activity connected to district‑issued accounts 

• Staff employment and credential information 

Data privacy ensures this information is kept secure, used only for educational purposes, and never shared with unauthorized individuals or companies. 

At SUSD, protecting personal information is not just a technical task — it is a shared commitment across teachers, administrators, technology staff, and our educational partners. 

A Data Privacy Agreement is a legal contract between SUSD and an educational technology company. 

This agreement helps ensure that:

• Student and staff information is protected 

• Data is used only to support learning 

• Vendors do not sell or share information 

• Security best practices are followed 

• Data is deleted when no longer needed 

DPAs help safeguard student and staff information when working with third‑party companies. 

Families trust us with some of their most sensitive information. Strong data privacy practices help us: 

• Keep students safe in an increasingly digital world 

• Ensure educational tools meet strict privacy and security standards 

• Comply with federal and state laws such as FERPA, CIPA and COPPA

• Promote responsible and ethical use of technology 

• Build transparency and trust with our community 

Safeguarding data is essential to maintaining a secure learning environment. 

SUSD uses multiple layers of protection, both technical and procedural, to keep personal information safe. 

1. Careful Review of Digital Tools 

Before approving any educational app or software, SUSD: 

• Reviews the vendor’s privacy practices 

• Requires a Data Privacy Agreement (DPA) 

• Ensures data is used only for learning purposes 

• Verifies the company does not sell or misuse student information 

This keeps student data out of the hands of advertisers and unauthorized third parties. 

2. Compliance With Privacy Laws 

SUSD follows all major laws designed to protect student information, including: 

• FERPA – protects student education records 

• COPPA – restricts data collection for children under 13 

• CIPA- protects students from harmful online content 

• State-mandated student data privacy requirements 

These laws ensure student information is handled with care and confidentiality. 

3. Secure Accounts and Login Protection 

We use strong cybersecurity measures such as: 

• Multi-factor authentication (MFA) for staff 

• Strong password requirements 

• Automated monitoring for suspicious logins 

• Regular system updates and security patches 

5. Strict Access Controls 

Only staff members who need access to specific information can view it. 
We use: 

• Role-based permissions 

• Regular audits of account access 

• Monitoring for unusual activity 

6. Cybersecurity Monitoring 

Our IT teams use tools such as: 

• Firewalls 

• Advanced threat detection systems 

• Continuous monitoring for vulnerabilities 

7. Staff Awareness and Training 

All staff receive training in: 

• Safe data handling 

• Cybersecurity best practices 

• Recognizing phishing attempts 

• Responsible use of digital tools 

SUSD uses a centralized Digital Resource Request & Review Workflow to ensure every digital tool used in our schools is safe, effective, and aligned with district goals. 

When a staff member wants to use a new digital resource, the following steps take place: 

1. A request form is submitted 

Teachers or staff members submit a formal request to have the tool reviewed. 

2. Instructional or operational value is evaluated 

We determine whether the resource meaningfully supports student learning or district operations. 

3. The vendor undergoes a thorough review 

SUSD evaluates each digital tool and its provider for: 

• Data privacy compliance 

• Security practices and protections 

• Cost and licensing structure 

• Data minimization practices (collecting only what is necessary) 

4. Data Privacy Agreement (DPA) is executed if needed 

A DPA ensures the vendor protects student information, uses data only for educational purposes, and does not sell or misuse any information. 

5. Partnership with 1EdTech 

SUSD is proud to be partnered with 1EdTech, a nonprofit organization dedicated to improving the security, privacy, and interoperability of digital learning tools. 
This partnership helps us ensure approved tools meet nationally recognized standards and fully support safe, reliable learning experiences. 

6. The approved resource is added to the district dashboard 

Once approved, the resource is added to SUSD’s list of authorized digital tools, where families and staff can view the tools used across the district.

Data privacy is a shared responsibility. Students, staff, and families can help by: 

For Staff

• Only using district-approved digital tools 

• Never sharing passwords 

• Using multi-factor authentication when available 

• Being cautious of phishing emails 

• Reporting suspicious activity immediately 

For Students

• Keeping passwords private 

• Logging out of shared devices 

• Avoiding sharing personal information online 

• Reporting concerning digital behavior

For Parents

• Use strong, unique passwords for accounts 

• Enable two‑factor authentication when available 

• Be cautious when sharing information online 

• Help children recognize phishing or scam messages 

• Talking with students about responsible digital behavior 

• Discuss the importance of keeping personal details private—even with friends online. 

• Regularly discuss safe online behavior with students 

• Contacting the school with any concerns 

Together, we can keep our community’s information secure. 

(CIPA) Children’s Internet Protection Act  

CIPA was enacted by Congress in 2000 to address concerns about children's access to obscene or harmful content over the Internet. CIPA imposes certain requirements on schools or libraries that receive discounts for Internet access or internal connections through the E-rate program – a program that makes certain communications services and products more affordable for eligible schools and libraries. In early 2001, the FCC issued rules implementing CIPA and provided updates to those rules in 2011.

CIPA

(COPPA) Children’s Online Privacy Protection Act  

COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.

COPPA

(FERPA) Family Educational Rights and Privacy Act  

FERPA is a federal law that affords parents the right to have access to their children’s education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records. When a student turns 18 years old, or enters a postsecondary institution at any age, the rights under FERPA transfer from the parents to the student (“eligible student”). The FERPA statute is found at 20 U.S.C. § 1232g and the FERPA regulations are found at 34 CFR Part 99.

FERPA

(HIPAA) Health Insurance Portability and Accountability Act 

HIPAA is used to measure and improve the security of health information. http://www.hhs.gov/ocr/privacy/hipaa/understanding/ (PCI DSS) Payment Card Industry Data Security Standard This covers the management of payment card data. http://www.pcisecuritystandards.org/ (PPRA) Protection of Pupil Rights Amendment Gives parents and minor students’ rights regarding surveys, collection and use of information for marketing purposes, and certain physical exams.

HIPPA

(PPRA) The Protection of Pupil Rights Amendment  

(PPRA) is a federal law (20 U.S.C. § 1232h) protecting student privacy by requiring parental consent before students participate in surveys, analyses, or evaluations funded by the U.S. Department of Education that reveal information on 8 protected areas. It applies to K-12 schools, ensuring rights to inspect instructional materials and opt-out of marketing surveys.

PPRA

The Arizona Department of Education has put together many resources for all stakeholder groups to learn about data privacy and help protect student data. Every person has a role to play...click to learn more.