Data Privacy and Security

We're here to help!

Privacy matters. These resources are here to support Colorado educators while protecting student and staff information.

Data Privacy Law

Student Data Transparency and Security Act

The Student Data Transparency and Security Act (PDF) (HB 16-1423; C.R.S.22-16-101 et seq.) took effect on August 10, 2016.

This law protects student personal information collected by the Colorado Department of Education (CDE) and Local Education Providers, such as school districts and schools.

The law:

Requires stronger protections for student data
Makes data use more transparent
Sets clear rules for companies that collect student information for schools

Any company working with Colorado schools must agree to follow these rules before collecting student data. The goal is to protect student privacy and build trust in how student information is used.

Obligations Under the Law

The Law's Exceptions

The law does not prohibit the use of Student Personally Identifiable Information to:

Use adaptive learning or design personalized or customized education
Maintain, develop, support, improve, or diagnose a School Service Contract Provider's website, online service, online application, or mobile application
Provide recommendations for school, educational, or employment purposes within a School Service, so long as the response is not determined in whole or in part by payment or other consideration from a third party
Respond to a student's request for information or for feedback so long as the information or response is not determined in whole or in part by payment or other consideration from a third party
Identify for the student, only with the written consent of the student or the student's parent, institutions of higher education or scholarship providers that are seeking students who meet specific criteria, regardless of whether the identified institutions of higher education or scholarship providers provide consideration to the School Services Contract Provider
Produce and distribute, free or for consideration, student class photos and yearbooks only to the public education entity, students, parents, or individuals authorized by parents
Provide for the student, only with the express written consent of the student or the student's parent given in response to clear and conspicuous notice, access to employment opportunities, educational scholarships or financial aid, or postsecondary education opportunities, regardless of whether the School Services Contract Provider receives consideration from one or more third parties in exchange for the Student Personally Identifiable Information. This exception applies only to School Services Contract Providers that provide nationally recognized assessments that postsecondary institutions of higher education use in making admissions decisions.

This law does not:

Impose a duty on a providers of an interactive computer service to review or enforce compliance with this law by School Service Contract Providers or School Service On-Demand Providers
Impede the ability of a student to download, export, or otherwise save or maintain his or her own Student Personally Identifiable Information or documents
Limit internet service providers from providing internet connectivity to public schools or to students and their families
Prohibit a School Service Contract Provider from marketing education products directly to parents so long as the marketing does not result from the use of Student Personally Identifiable Information obtained by the School Service Contract Provider as a result of providing its website, online service, online application, or mobile application or
Impose a duty on a Provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software or applications to review or enforce compliance with this law on that software or those applications

(3) THE REQUIREMENTS SPECIFIED IN SECTIONS 22-16-108 TO PAGE 25-HOUSE BILL 16-1423 22-16-110 APPLY TO SCHOOL SERVICE CONTRACT PROVIDERS THAT ENTER INTO OR RENEW CONTRACTS WITH PUBLIC EDUCATION ENTITIES ON OR AFTER THE EFFECTIVE DATE OF THIS ARTICLE.

Parent Rights

The Law also defines a Parent's Rights.

The parent of a student enrolled by a Local Education Provider has the right
- To inspect and review his or her child's Student Personally Identifiable Information maintained by the Local Education Provider
- To request from the Local Education Provider a paper or electronic copy of his or her child's Student Personally Identifiable Information, including Student Personally Identifiable Information maintained by a School Service Contract Provider. If a parent requests an electronic copy of the parent's child's Student Personally Identifiable Information, the Local Education Provider shall provide an electronic copy of the Student Personally Identifiable Information unless the Local Education Provider does not maintain Student Personally Identifiable Information in electronic format and reproducing the Student Personally Identifiable Information in an electronic format would be unduly burdensome.
- To request corrections to factually inaccurate Student Personally Identifiable Information maintained by a Local Education Provider. After receiving a request for correction that documents the factual inaccuracy, the Local Education Provider that mains the Student Personally Identifiable Information shall correct the factual inaccuracy and confirm the correction to the parent within a reasonable amount of time.
The governing board of each Local Education Provider shall adopt a policy for hearing complaints from parents regarding the Local Education Provider's Compliance with the requirements of this article. At a minimum, the policy must provide a parent the opportunity to submit information to the governing board and receive a hearing by the governing board and must require the governing board to take action on the parent's complain within sixty days after the hearing.
- If a Local Education Provider does not comply with the requirements specified in this article, a student's parent may submit a complaint to the governing board of the Local Education Provider in accordance with the complaint policy adopted by the governing board of each Local Education Provider

Student Personally Identifiable Information

At the heart of this Law is Student PII (Personally Identifiable Information). PII, as defined by this Law is information that, alone or in combination, personally identifies an individual student or the student's parent or family, and that is collected, maintained, generated, or inferred by a public education entity, either directly or:

through a school service, or
by a school service contract provider or
by a school service on-demand provider.

FERPA (Family Educational Rights and Privacy Act)

In addition to Colorado law, schools and families rely on FERPA (Family Education Rights and Privacy Act), a federal law passed in 1974.

FERPA protects the privacy of student education records and gives parents and eligible students important rights.

Under FERPA, parents and eligible students have the right to:

Review education records
Ask for corrections if information is inaccurate
Control when student information is shared

Schools usually need parent consent before sharing student personal information with a third party, unless a FERPA exception applies.

FERPA Fundamentals

FERPA Exceptions

FERPA Support for Parents and Educators

These resources can help families and educators better understand student data privacy:

A Parent's Guide to Student Data Privacy (PDF) (created by ConnectSafely, Future of Privacy Forum and the PTA)
FERPA: General Guidance for Parents
Family Policy Compliance Office (FPCO)

FERPA Training Videos for Teachers (produced by the Utah State Board of Education):

FERPA Basics (YouTube 3:32m)
Parental Rights (YouTube 1:30m)
Exceptions Overview (YouTube 1:57m)
FERPA and Technology (YouTube 2:19m)
Websites and Apps for the Classroom (YouTube 3:35m)
Data Security Basics for the Classroom (YouTube 4:05m)
Storing Educational Records Safely (YouTube 3:35m)
Malware Attacks on Schools (YouTube 2:27m)

Data Breach Notification Law

Our Commitment to Privacy Encompasses Staff

CDE is sometimes asked to share information about individual students or school district employees. Colorado law protects this information.

Since 1963, state law has set clear limits on what can be shared. Colorado Revised Statute 22-2-111(3) outlines these privacy protections and guides how CDE handles requests for personal information.

How the Law Shapes CDE’s Work

Data Collections

CDE collects and uses student data to understand how students are doing and how schools can improve. This information helps guide decisions at the classroom, state board, and policy levels.

You can see the types of data CDE collects on the Data Collections page. Resources in SchoolView help educators use this information to support student learning, including standards, assessments, and educator effectiveness.

Data Requests

Protecting personal information is a top priority for CDE. Because of this, there is a careful review process for any request that includes personally identifiable information (PII).

Learn more about this process on the Data Request page.