It depends, and the agreement must cover education records, FERPA personally identifiable information (FERPA PII), and any access, maintenance, or support activities performed for the institution. The scope is to establish direct control, legitimate educational interest, and purpose limitation, then operationalize those controls through access restrictions, instructions, and subprocessor flow-downs under 34 C.F.R. § 99.31(a)(1) and 34 C.F.R. § 99.33. The hidden risk is that vague “service improvement” or broad analytics rights can undercut purpose limitation and make the disclosure look like a non-exempt transfer. Law Laguna drafts direct control and restricted-use language and aligns it to the district’s procurement template and your product realities.

Yes, if you operate a covered service with actual knowledge it is used for California K to 12 school purposes, the contract should restrict covered information, identifiers, usage data, and student account data from being used for targeted advertising. The scope is both on-service and off-service uses, including prohibiting ads based on student data and limiting disclosures except where allowed under Cal. Bus. & Prof. Code § 22584. The hidden risk is that standard marketing clauses, cross-product analytics, or third-party ad tech integrations can be read as profile-building or targeted advertising even if unintentional. Law Laguna inserts clear prohibitions and permitted-use carveouts that match Cal. Bus. & Prof. Code § 22584 and district requirements under Cal. Educ. Code § 49073.1.

It depends, and the deletion framework should address covered information, account identifiers, education records received from a school, and student-generated content where applicable. The scope includes deletion on request by a school district or local educational agency, and additional deletion on request by a parent or former student (18 or older) in the circumstances described by Cal. Bus. & Prof. Code § 22586 and related provisions, including conditions tied to enrollment status and documentation. The hidden risk is that vendors promise absolute deletion without defining how backups, logs, and security archives are handled, creating gaps between contract language and technical reality. Law Laguna drafts deletion and certification clauses that meet statutory expectations while reflecting implementable retention and destruction workflows.

Yes, Cal. Civ. Code § 1798.82 can require notice when there is unauthorized acquisition of unencrypted computerized data that compromises security, confidentiality, or integrity, and the definition can implicate student-related personal information such as name plus account credentials or other listed data elements. The scope is incident response, including investigation, containment, determination of whether encryption and key compromise affect notice, and coordination with district contractual notice timelines under Cal. Civ. Code § 1798.82(a), Cal. Civ. Code § 1798.82(d), and Cal. Civ. Code § 1798.82(h). The hidden risk is that a contract can impose tighter deadlines or broader definitions than the statute, creating avoidable breach-of-contract exposure. Law Laguna aligns breach clauses and playbooks so legal triggers and operational steps match.

Yes, if your Terms of Use govern student accounts, they can conflict with education records handling, FERPA personally identifiable information (FERPA PII) restrictions, and district control requirements. The scope is to ensure the district agreement controls data use and re-disclosure, and that consumer-facing terms do not require parents or eligible students to waive statutory rights or accept uses beyond the authorized educational purpose under 20 U.S.C. § 1232g(b)(1) and 34 C.F.R. §§ 99.1 to 99.67. The hidden risk is that a “one size” clickwrap can introduce marketing permissions, arbitration, or data sharing that procurement will reject or that undermines the “school official” exception posture. Law Laguna harmonizes platform terms with the district addendum and the FERPA disclosure framework.

It depends, and PPRA can be implicated by surveys, analyses, evaluations, psychological exams, or marketing activities that use student information, identifiers, responses, or other sensitive categories. The scope is to allocate responsibilities for notice, consent where required, and opt-out handling, and to ensure your product features and reporting align with institutional policies under 20 U.S.C. § 1232h(b) and 34 C.F.R. § 98.4. The hidden risk is that a feature designed as “engagement” can be treated as marketing or data collection requiring specific notice, and the contract may not clarify who provides it. Law Laguna drafts PPRA allocation language and builds implementation steps that procurement teams can validate.

Improper release or failure to destroy can lead to enforcement outcomes that affect education records and FERPA personally identifiable information (FERPA PII) access, including the possibility that a third party may be barred from receiving protected information for at least five years under 34 C.F.R. § 99.67(c) to (e). The scope is both contract compliance and operational controls, meaning access limitation, purpose limitation, re-disclosure restrictions, and end-of-service deletion processes must be real and provable. The hidden risk is that a contract might state deletion or restricted use, but internal workflows, subprocessors, or support tools can create uncontrolled copies or disclosures. Law Laguna aligns clauses, playbooks, and vendor management practices to reduce this exposure and keep district eligibility intact.