EduLens and Pennsylvania student data privacy
Pennsylvania has no comprehensive student data privacy statute. What actually governs school software vendors: FERPA, district policy, the state breach notification law, and district data privacy agreements.
- Governing law
- FERPA, district policy, and 73 P.S. § 2301 et seq. (breach notification)
- Status
- No comprehensive state statute
What does Pennsylvania require of school software vendors?
Pennsylvania has no comprehensive student data privacy statute equivalent to Illinois SOPPA or New York Education Law 2-d. Requirements for school software vendors in Pennsylvania come from FERPA, individual district policy and procurement standards, and the state breach notification law, which governs notification when personal information is compromised. Many Pennsylvania districts use standardized data privacy agreements through the Student Data Privacy Consortium.
Last reviewed August 2026
What applies in Pennsylvania
- FERPA governs
- Without a state overlay, the federal baseline does most of the work. Vendors handling student education records operate as school officials with legitimate educational interest, under district control.
- District policy sets the bar
- In the absence of a state standard, individual districts and intermediate units define their own vendor requirements. Expect variation between neighboring districts.
- Breach notification
- Pennsylvania's breach notification law applies to personal information held by vendors serving districts, which drives incident response expectations in vendor agreements.
Without a state standard, the consortium fills the gap
Many Pennsylvania districts use standardized agreements through the Student Data Privacy Consortium rather than drafting their own. That gives an out-of-state vendor a single agreement to sign that multiple districts will accept.
The practical advice for a vendor: ask early which agreement a district uses. In a state without a statutory template, the answer varies, and discovering it late is what stalls a purchase.
No statute does not mean no scrutiny
Pennsylvania districts are not less careful than Illinois districts; they simply have less external structure to lean on. That often means more questions rather than fewer, because the technology director is defining the standard rather than applying one.
A vendor who arrives with a complete package — agreement, data element inventory, sub-processor list, retention policy, security overview, and audit trail capability — makes that job easy. In a state with no template, being organized is the differentiator.
What EduLens provides a Pennsylvania district
- A data privacy agreement ready for district counsel review, or willingness to sign the district or consortium standard agreement
- Documented data element inventory by module
- Sub-processor disclosure
- Configurable retention and complete deletion workflows
- Complete access audit trails
- Breach notification commitments in the agreement
Pennsylvania student data privacy — common questions
No. Pennsylvania has not enacted a comprehensive student data privacy statute comparable to Illinois SOPPA or New York Education Law 2-d. Vendor requirements come from FERPA, individual district policy, and the state breach notification law.
A data privacy agreement, a list of the data elements collected, a sub-processor disclosure, retention and deletion policy, a security overview, and evidence of access audit trails. Those are the materials a state with a statute would require, and they are equally reasonable to request without one.
Other states
This summary reflects our reading of publicly available statutes and state guidance as of August 2026. It is not legal advice. Student privacy law changes and district requirements vary. Confirm current obligations with your district's counsel and technology office before making a purchasing decision.
Evaluating EduLens for a Pennsylvania school?
We'll send the data privacy agreement, data element inventory, and sub-processor disclosure before the first call if that's useful.