Data security and privacy standard
Compiled text through Aug 15, 2021
Register checked through Jul 29, 2026
Later Register activity found — review the notice before relying on the compiled text.
Dates and status
- Compiling agency
- State Education Department
- Text status
- Later rule activity found; update pending
- Compiled text through
- Aug 15, 2021
- Register checked through
- July 29, 2026/Vol. XLVIII, Issue 30 (2026-07-29)
- Activity status
- Later Register activity found — review the notice before relying on the compiled text.
- Latest notice
- EDU-42-25-00015-A · Adopted rule · Feb 25, 2026
- Source snapshot
- Jun 5, 2026
(a)As required by Education Law section 2-d(5), the department adopts the National Institute for Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity version 1.1 (NIST Cybersecurity Framework or NIST CSF) as the standard for data security and privacy for educational agencies.
(b)Each educational agency shall adopt and publish a data security and privacy policy that implements the requirements of this Part and aligns with the NIST CSF no later than October 1, 2020.
(c)Each educational agency’s data security and privacy policy must also address the data privacy protections set forth in Education Law section 2-d(5)(b)(1) and (2) as follows:
(1)every use and disclosure of personally identifiable information by the educational agency shall benefit students and the educational agency (e.g., improve academic achievement, empower parents and students with information, and/or advance efficient and effective school operations).
(2)personally identifiable information shall not be included in public reports or other documents.
(d)An educational agency’s data security and privacy policy shall include all the protections afforded to parents or eligible students, where applicable, under FERPA and the Individuals with Disabilities Education Act (20 U.S.C. 1400 et seq.), and the Federal regulations implementing such statutes.
(e)Each educational agency must publish its data security and privacy policy on its website and provide notice of the policy to all its officers and employees.