Student Data Privacy Training

Required training · about 25 minutes

Before you see any student information

NYCID works inside New York City public schools. To do that work, New York City Public Schools (NYCPS) trusts us with information about its students. That trust comes with rules set by federal law, state law, a Chancellor's regulation, and our written agreement with NYCPS.

Every NYCID officer, employee and assignee completes this training before receiving access to Confidential Information, and again every year.

Part 1

The four sets of rules

Part 2

NYCID's own rules

Part 3

Spotting and reporting a breach

Part 4

Knowledge check and sign-off

Use Next and Back, or the arrow keys. You need 8 of 10 on the knowledge check. You can retake it.

Part 1 · The rules

Why these rules apply to you

When NYCPS shares student information with NYCID, the law treats NYCID as if it were part of the school for that one purpose.

Under FERPA and Chancellor's Regulation A-820, NYCID is a School Official and an Authorized Third Party: an outside organization doing a job the school would otherwise use its own employees for.
Under New York Education Law 2-d, NYCID is a third-party contractor.
In our agreement with NYCPS, NYCID is the Processor. The information stays NYCPS's. We hold it and use it only as they direct.

A-820 says an Authorized Third Party that accesses student information must be trained before it gets that access. That is this training.

Source: Chancellor's Regulation A-820 (issued May 28, 2025), Sections II, III.E and IX.

Part 1 · The rules

What counts as Confidential Information

Anything that identifies a student, alone or combined with other details. The regulations call it Student PII (personally identifiable information).

Named in A-820

Student's name, and names of parents or family
Address, email, phone number
Student ID (OSIS), Social Security number, fingerprints or other biometrics
Date and place of birth
School, grade or class when it would let someone work out who the student is

What that looks like at NYCID

Program rosters and enrollment reports
Attendance, grades, credits, transcripts
IEP or special education status, health notes
Case notes, incident and discipline records
Signed contracts, working papers, photos
Records from school-sponsored work programs

It does not matter where it lives: the app, a spreadsheet, an email, a printout, a sticky note, or something you said out loud. If it identifies a student, it is covered.

Source: A-820 Section II (definitions of Education Records, Record, and Student PII).

Part 1 · The rules

Four sets of rules, one message

Federal

FERPA

Family Educational Rights and Privacy Act. Parents and adult students control who sees education records.

New York State

Education Law 2-d

Sets security duties for anyone outside the school system who receives student data.

New York City

Chancellor's Regulation A-820

NYCPS's own rulebook for confidentiality, retention and disclosure. Revised May 2025.

For families

Parents' Bill of Rights

The promises NYCPS makes to every family. It is attached to our agreement, so we keep them too.

All four say the same thing: use student information only for the program you were given it for, show it only to people who need it for that program, protect it, and speak up fast when something goes wrong.

Part 1 · Federal law

FERPA

FERPA gives parents rights over their child's education records. When the student turns 18, those rights move to the student (an "eligible student").

See the records. A parent or eligible student can inspect and review them, within 45 days of asking.
Ask for a correction when something is inaccurate, misleading, or violates the student's privacy.
Consent first. A school generally needs signed, dated, written consent before it shares anything that identifies the student.

NYCID sees student records without each family's consent because of one exception: the school official exception. It has conditions.

The exception coversUsing the information to deliver the program NYCPS asked us to deliver, under NYCPS's direction.

It does not coverAny other use, and passing the information to anyone else. That is re-disclosure, and it needs the family's consent.

Source: 20 U.S.C. 1232g; 34 C.F.R. Part 99; A-820 Sections IV, VII, IX and XI.

Part 1 · State law

New York Education Law 2-d

Section 2-d and its regulations (8 NYCRR Part 121) set the duties of a contractor that receives student data. NYCID must:

Use student data only for the purposes in our agreement.
Limit access to the staff and subcontractors who need it to provide the service.
Never sell it or use it for marketing or any commercial purpose.
Not disclose it to anyone else without the family's consent, apart from a subcontractor bound by the same terms or a legal order.
Keep safeguards that follow the NIST Cybersecurity Framework and encrypt student data when it is stored and when it is sent.
Report a breach to the school system promptly, and never later than 7 calendar days after discovering it.

If a breach is NYCID's fault, NYCID pays for notifying every affected family. The State can also fine a contractor and bar it from contracts that involve student data.

Source: N.Y. Education Law § 2-d; 8 NYCRR §§ 121.9, 121.10, 121.11.

Part 1 · City regulation

Chancellor's Regulation A-820

A-820 applies to every NYCPS employee and every Authorized Third Party. It lists what a School Official must do. These are your duties:

Keep records and PII confidential. Share only when the family consented in writing, the record has been fully de-identified, or the law specifically allows it.
Collect and share only what is necessary for an educational purpose. Keep it to the minimum.
Encrypt anything electronic that goes to an outside party, email included.
No commercial or marketing use, directly or indirectly.
Do not keep it once it is no longer needed for the purpose we received it for. Return it or destroy it.
Get trained before access.
Promptly notify NYCPS of a privacy complaint or breach.

A-820 also bans "indiscriminate access": looking at records you do not need for your own job.

Source: A-820 Sections III, VIII.A and XV.

Part 1 · For families

Parents' Bill of Rights for Data Privacy and Security

Parents, and students 18 and older, have these rights over records held by NYCPS and by outside organizations like NYCID:

Their child's information will not be sold or used for commercial, marketing or advertising purposes.
They can inspect and review the education records within 45 days.
They can ask for changes to records that are inaccurate, misleading or violate privacy.
Written consent is required before PII is disclosed, unless the law allows otherwise.
The information is protected when it is stored and when it is sent, with encryption, firewalls and password protection that meet industry standards.
They are told about a breach or unauthorized disclosure, within 60 days of NYCPS discovering it.
They can file a complaint with NYCPS, the State Education Department, or the U.S. Department of Education.

Source: NYCPS Parents' Bill of Rights for Data Privacy and Security; 8 NYCRR § 121.3.

Part 1 · In practice

When someone asks you for a student's records

The records belong to NYCPS and the rights belong to the family. NYCID staff do not decide these requests alone.

Do

Tell the parent or student they have the right to ask, and that the request goes to the school principal.
Tell your Director the same day so NYCID can help the school answer inside the 45 days.
Write down who asked, when, and for what.

Do not

Hand over, read out, email or text records on your own.
Confirm anything about a student to a caller you cannot verify, even "is she enrolled?"
Give records to a lawyer, advocate, employer, relative, police officer or another agency without written consent or your Director's go-ahead.

A subpoena or court order goes straight to your Director and NYCID's privacy lead. Do not answer it yourself.

Source: A-820 Sections V, VI, VII.D and VIII.C.

Part 2 · NYCID's rules

Rule 1 · Only your students, only for your job

NYCID Solutions shows each staff member the programs they are assigned to. Program staff, their Directors and executives can see a program's students. Nobody else at NYCID can.

Open a student's record only when your work for that student requires it.
No looking up a neighbor, a relative, a friend's child, or a student from a program you do not work in.
Your sign-in is yours. Never share it, never let someone work under your account, never sign in for someone else.
If you can see something you should not be able to see, that is a problem to report, not a perk.
When your role changes or you leave a program, your access to its students ends.

The app records who opened and changed what, under the signed-in account.

Part 2 · NYCID's rules

Rule 2 · NYCID accounts, NYCID devices

Student information stays in your @nycid.org account, with 2-Step Verification on.
No personal devices for student data. No personal Gmail, personal Drive, personal phone photos, or personal messaging apps.
Email is not forwarded automatically outside NYCID. Do not set up forwarding or filters that send work mail elsewhere.
Lock your screen every time you step away. Do not leave a roster open on a desk, a classroom screen or a projector.
On a shared tablet or kiosk, sign out of staff tools before a student touches it.
Do not save passwords in a shared browser, and do not use public Wi-Fi for student records without a secure connection.
No outside apps or AI tools. Do not paste or upload student information into any website, app or AI tool that NYCID has not approved for student data.

Part 2 · NYCID's rules

Rule 3 · Sharing and sending

Leave student information where it already lives: NYCID Solutions and NYCID's Google Drive. Point people to it there.

Do

Share a file with named @nycid.org people only.
Send the minimum. A first name and last initial is often enough.
Check every recipient before you hit send, especially autofill and reply-all.
For school staff, use the route your Director set up (for example, printed reports handed to the named school contact).

Do not

Set a file to "anyone with the link."
Put student details in a text message, group chat, social media post or a personal email.
Email a roster, an OSIS number, a date of birth or a Social Security number to anyone outside NYCID unless your Director approved that route and it is encrypted.
Screenshot or photograph a screen of student records.

Photos and stories about students need a signed consent on file before they go anywhere public.

Part 2 · NYCID's rules

Rule 4 · Paper, downloads and the end of a program

Paper with student information is locked up when you are not using it. Pick printouts up from the printer right away. Sign-in sheets do not sit out on a table.
Paper does not go home with you, and it does not ride around in a car or a backpack.
When paper is done, it goes in the shredder, never the trash or recycling.
Downloads and exports: make one only when the job needs it, keep it in NYCID Drive, and delete the copy in your Downloads folder when you finish.
When a program or contract ends, NYCID returns or securely destroys the student information as NYCPS directs. Do not keep your own copies "just in case."
Removing names from a file does not count as destroying it.

Source: A-820 Sections III.D.7 and XV.

Part 2 · NYCID's rules

Four things that are never allowed

1

Selling or marketing

No student list is ever sold, traded, or used to advertise or fundraise.

2

Using it for something else

Information given for one program is not reused for another purpose, however good the cause.

3

Passing it along

Employers, funders, other agencies and other nonprofits do not get student records from you without written consent.

4

Talking where others can hear

Hallways, the ferry, the staff room, social media. A spoken disclosure is still a disclosure.

Source: Education Law § 2-d; A-820 Sections II.E and III.D.6; Parents' Bill of Rights.

Part 3 · Breaches

What a breach is

A-820 defines a breach as the unauthorized acquisition, access, use or disclosure of PII by or to a person who is not authorized to have it. Hackers are rare. Most breaches are ordinary mistakes:

An email with a roster goes to the wrong person.
A laptop, tablet, phone or folder of paper is lost or stolen.
A file is shared by open link.
Someone uses a coworker's sign-in.

You click a link in a fake email and type your password.
A staff member looks up students they have no reason to see.
A roster is sent to a personal email "to work on at home."
Paper with student names is found in the trash.

It is a breach whether or not anyone meant harm, and whether or not you think anyone actually read it.

Source: A-820 Section II.C.

Part 3 · Breaches

Signs that something is wrong

A sign-in alert, a 2-Step code or a password reset you did not ask for.
An email that pushes you to act fast, open an attachment or "confirm your account." Check the sender's full address.
Sent mail, shared files or changes in a record that you do not remember making.
A device, a badge, keys or paper you cannot find.
A reply from someone who should never have received your message.
A parent, student or school contact telling you they saw information they should not have.
A coworker asking for your password, or asking you to look someone up for them.

You do not need to be sure. A suspected breach gets reported the same way as a confirmed one. Let NYCID's privacy lead decide what it is.

Part 3 · Breaches

How to report: three steps, same day

1

Stop and contain. Recall the email if you can, pull the open link, lock or sign out of the device. Do not delete anything and do not try to investigate on your own.

2

Report right away, the same day. Tell your Director and NYCID's privacy lead, , at . If it is after hours, email now and call your Director.

3

Write down the facts. What happened, when you noticed, which students or how many, what kind of information, who received it, and what you already did.

Why the same day. The clock starts when NYCID discovers it. NYCID has to notify NYCPS promptly, as our agreement requires and never later than 7 calendar days under state rules. NYCPS then has 10 days to report to the State and 60 days to notify families. A day you wait is a day taken from them.

Do not contact families, the school or NYCPS about the incident yourself. NYCID's privacy lead makes that notice (to studentprivacy@schools.nyc.gov) so it is accurate and complete.

Source: 8 NYCRR § 121.10; A-820 Sections III.F and XII.

Part 3 · Breaches

What is at stake

For students and familiesA leaked address, a custody detail, a disability status or a discipline record can follow a young person for years and can put a family at risk.

For NYCIDNYCPS can suspend or end our access to student data. NYCID can face damages, civil penalties, and a bar from contracts that involve student information.

If you reportReporting a mistake in good faith, your own included, is what NYCID expects. It will not be held against you for speaking up.

If you hide it or ignore the rulesStaff who misuse student information, or who knew of a breach and stayed quiet, face discipline up to termination.

Source: A-820 Section IX.D; 8 NYCRR § 121.11.

Wrap-up

Six habits to take with you

1

Need it for your job today? If not, do not open it.

2

Keep it where it lives. NYCID Solutions and NYCID Drive, on an NYCID device, under your own sign-in.

3

Send the minimum, to the right person. Check the recipient twice.

4

Lock it up. Screens, tablets and paper.

5

Do not keep what you no longer need. Shred paper, delete downloads.

6

Something off? Report it the same day. Suspected is enough.

Next: the knowledge check.

Student Data Privacy TrainingNYCID Solutions · Required before access to student information