The National Data Privacy Agreement, a model contract many school districts use with edtech providers, includes restrictions on sub-processors, along with terms on data breaches, advertising limits, and de-identified data. For you, that means knowing every service that touches student data, and being able to list it.
What the NDPA is
The Student Data Privacy Consortium, which began with a group of Massachusetts school districts and now has alliances in many states, released the first National Data Privacy Agreement in 2020. A working group of attorneys, district officials, company representatives, and nonprofit organizations drafted it. The Future of Privacy Forum's write-up says its goal is "common expectations" between schools and providers, and that state alliances add clauses for their own laws.
The same write-up notes limits: definitions overlap, an audit clause could let several districts audit one company, a data breach is not explicitly defined, and smaller companies may face barriers. Read your actual signed version, because state terms differ. Nothing here is legal advice.
Sub-processor versus dependency
These are different things, and mixing them up causes confusion in reviews.
| Term | Typical meaning | Example |
|---|---|---|
| Sub-processor | A third party service that processes student data for you | Cloud host, email sender, support tool |
| Dependency | Code you include and run inside your own system | A web framework, a PDF library |
A dependency usually is not a separate company holding data. But a dependency can send data to one. A telemetry library that posts events to an outside server turns a "just a library" into a data flow to a third party.
How to keep your sub-processor list true
- Start from your architecture, not your invoices. List every external service that receives student data in any form.
- Add data flows hidden in code. Search your dependencies and your own code for outbound network calls to domains you do not run.
- Compare the result with the list you gave your district customers.
- Set a rule: a new outbound destination requires a review before release.
- Date the list and keep an owner, so a district question about it has a quick answer.
This turns a static contract clause into a process you can demonstrate.
What to do when an update adds a destination
Library updates occasionally add network calls, such as crash reporting or usage statistics, often enabled by default. Reading release notes for libraries that sit in student-facing code is cheap insurance. If a new destination appears, either disable it in configuration, replace the library, or update your sub-processor disclosure before release.
Try it yourself
Open the demo and notice how a single package leads to a chain of further packages. Any link in that chain could contain an outbound call you did not expect.
Click through it at your own pace, or open it full screen.
Safeguard's SBOM and dependency scanning helps you see what is in a build, and the free scan is a no-cost starting point.
Quick check
Is an open source library a sub-processor?
Usually no, since it runs inside your system. If it transmits student data to an outside party, that party may be a sub-processor. Ask counsel how your agreement defines the term.
Who maintains the NDPA?
The Student Data Privacy Consortium published it, with input from schools, state groups, providers, and legal organizations, according to the Future of Privacy Forum.
Sources
Last reviewed: 19 October 2026.
