Georgia Student Data Privacy, Accessibility, and Transparency Guide

Primary Law
Student Data Privacy, Accessibility, and Transparency Act

Citation
O.C.G.A. 20-2-660 through 20-2-668 (effective July 1, 2016)

Official Text
https://georgiainsights.gadoe.org/data-privacy/student-data-privacy-accessibility-and-transparency-act/
http://www.legis.ga.gov/Legislation/20152016/153829.pdf

Overview

Georgia has a dedicated K-12 student data privacy law: the Student Data Privacy, Accessibility, and Transparency Act. The law is designed to keep student information protected and used only for authorized educational purposes, while placing clear limits on how operators of online services may use student data when their tools are used in Georgia public schools.

Compared with states that focus only on contracts, Georgia combines district responsibilities with operator restrictions, including limits on certain sensitive data collection and requirements for reasonable security practices.

Applicability and Scope

Georgia's student data privacy law is most relevant when a district or school uses online services, websites, or applications that collect or process student data for K-12 educational purposes.

District teams should treat the law as in-scope when:

• A product is used by students or staff as part of instruction, assessment, or school operations
• The vendor collects student data through accounts, usage analytics, device identifiers, or content created in the service
• The tool is adopted or approved by a district, school, or teacher for classroom use

Operator Limitations and Prohibited Uses

Georgia places direct limits on how operators may use student data. In practice, districts should confirm that vendors do not use student data for activities that are not aligned to school-authorized educational purposes, such as targeted advertising or building non-educational profiles.

District reviews commonly document:

• Whether the vendor prohibits targeted advertising based on student data
• Whether the vendor prohibits selling student data
• Whether the vendor limits profiling to educational purposes
• Whether the vendor restricts disclosure to what is necessary to provide the service

Safeguarding and Security Expectations

Georgia's framework expects student data to be protected with reasonable security procedures and practices appropriate to the nature of the student data involved.

District review commonly considers:

• Access controls for staff and vendor administrators
• Secure handling of credentials and student identifiers
• Incident response expectations and how the vendor communicates security events
• Retention, deletion, and account removal processes when use ends

Parent Access and Transparency

Georgia also emphasizes transparency and parent rights, including the ability for parents to inspect and review education records maintained by schools or districts.

Districts should ensure they have repeatable processes for:

• Responding to parent requests related to student education records
• Maintaining clear ownership of student data governance responsibilities
• Documenting which tools are approved and what student data they touch

How Georgia Districts Commonly Implement Compliance

Georgia districts typically operationalize compliance by combining vendor vetting with internal governance. A scalable approach often includes:

• Maintaining an inventory of tools and services used with students
• Using consistent review questions for privacy, security, and data use limitations
• Documenting approvals and the evidence used to support decisions
• Revisiting approvals when vendor policies, features, or subprocessors change

How Can EdPrivacy Help Georgia Schools

Georgia's law requires districts to manage both vendor behavior expectations and internal oversight. EdPrivacy helps Georgia schools centralize the documentation used to evaluate tools, apply consistent approval criteria, and maintain defensible records over time.

The platform helps districts:

• Maintain a searchable inventory of apps and services used across the district
• Capture vendor privacy and security documentation in a consistent format
• Record approval rationale tied to operator limitations, security controls, and data governance expectations
• Monitor vendor policy changes so reviews can be refreshed when risk changes

Summary

Georgia districts should be prepared to:

• Evaluate edtech vendors for compliance with operator limitations on student data use
• Implement reasonable safeguards and security expectations for student data
• Maintain transparency practices and processes that support parent access to education records
• Use a repeatable approval and monitoring process that scales across many tools

Georgia's Student Data Privacy, Accessibility, and Transparency Act supports a governance-focused approach that combines vendor restrictions with district oversight and documentation.