The Student Online Personal Protection Act (SOPPA) is the data privacy law that regulates student data collection and use by schools, the Illinois State Board of Education, and third-party vendors. As part of SOPPA, these vendors must enter into Data Privacy Agreements (DPA) with each district they work with. These agreements outline what data is store, how it is protected, what the company can and cannot do with the data, and what they will do in the event of a data breach.
The changes to SOPPA mandate that by July 2021, schools must have written agreements with all EdTech software vendors in use. Districts must also make readily available via their websites an overview of security practices, a description of how parents can ensure their student data privacy rights are being met, a list of approved vendors and their corresponding written agreements, and a list of any student data breaches that have impacted more than 10% of students. SOPPA full text.
