The National Data Privacy Agreement (NDPA) is a common contract template that school districts and software vendors can use to set student data privacy terms. The Student Data Privacy Consortium offers it so each district does not draft its own. Vendors that handle student data may be asked to sign it. This is not legal advice.
What the Consortium says it offers
The Student Data Privacy Consortium (SDPC) describes three things on its site. Shared agreements: a common contract so districts and vendors do not build their own, with the NDPA named as the way to streamline expectations. Practical tools: a Resource Registry where you can search existing agreements and avoid starting from scratch. And member benefits: membership gives access to tools such as the NDPA and the registry.
That is the extent of what the SDPC home page confirms. Details such as exhibits, state variations and term length differ by district and state, so read the agreement a district actually sends.
Why a district prefers a template
- Consistency. Every vendor answers the same questions in the same order.
- Speed. Reviewers learn one document instead of many.
- Reuse. The registry lets a district see what other schools have already signed.
For a vendor the same logic holds. One reviewed agreement answers many requests, and your team learns which clauses cause questions.
Does a code or security tool touch student data?
Often not directly. A scanner reads source code and dependency lists, not student records. But the question is still asked, because some tools see logs, test data or screenshots. Before you answer, map what your product could receive:
| Data type | Could a security tool see it? | What to say |
|---|---|---|
| Source code | Yes, if scanned | Describe where it is processed and stored |
| Dependency manifests | Yes | Usually no personal data |
| Logs or error traces | Only if the customer sends them | Ask customers not to send student data |
| Test data | Only if committed in a repo | Advise cleaning it out first |
| Account details for staff users | Yes | Describe retention and access |
Steps for a vendor
- Read the district's version of the agreement start to finish.
- List every data type your product might receive and where each is stored.
- Name your subprocessors and their roles.
- Describe deletion at the end of the contract in practical terms: what is deleted, how long it takes, how you confirm.
- Write down who answers privacy questions and how fast.
- Keep a copy of every signed version and its date.
Steps for a district IT lead
- Ask whether the tool will ever hold student data. If not, say so in the record.
- If yes, require the template or an equivalent before any pilot starts.
- Check the registry for an existing agreement.
- Save the signed copy with the product record.
The U.S. Department of Education's student privacy office also recommends written agreements with online service providers as a best practice. See PTAC contract provisions for school software.
Quick check
Is the NDPA a law?
No. It is a contract template offered by the Student Data Privacy Consortium. Districts add their own terms.
Does a vulnerability scanner need an NDPA?
It depends on whether it can receive student data. Map the data first, then ask the district.
Sources
- Student Data Privacy Consortium
- U.S. Department of Education PTAC: Protecting Student Privacy While Using Online Educational Services
Last reviewed: 19 October 2026.
