Louisiana Student Information Privacy and Data Governance Guide

Primary Law
Student information privacy, limits on collection and disclosure, access control, and penalties

Citation
Louisiana Revised Statutes 17:3914

Official Text
https://legis.la.gov/legis/Law.aspx?d=920124

Overview

Louisiana has a statewide student data privacy law that focuses on protecting personally identifiable student information through limits on collection, strict disclosure rules, and controlled access to systems where student information is stored. R.S. 17:3914 frames student privacy as a protected right and establishes practical requirements for how schools, districts, and authorized service providers handle student data.

Compared with laws that focus mainly on vendor advertising restrictions, Louisiana places strong emphasis on governance: what categories of sensitive information schools may collect, who may access student information systems, and how disclosures must be authorized and controlled.

Applicability and Scope

R.S. 17:3914 is relevant when student information is collected, stored, accessed, or shared by local public school systems and when any person or entity is given access to student information through school systems.

District teams should treat the law as in-scope when:

• Student information is stored in district systems, including student information systems and assessment platforms
• Staff access student data as part of instruction, support, administration, or reporting
• Vendors or service providers require access to district systems to deliver services the district would otherwise provide
• Requests are made to disclose student information outside the district

Limits on Collection of Sensitive Student Information

Louisiana restricts the collection of certain categories of sensitive student information unless it is voluntarily disclosed by the parent or legal guardian. This reinforces a minimum-necessary approach and reduces the risk of collecting information that is not required for educational purposes.

District review commonly considers:

• Whether a tool or form requests sensitive categories of information beyond what is needed for school purposes
• Whether collection can be minimized through configuration or workflow changes
• Whether staff understand what data should not be required or solicited

Disclosure Rules and Commercial Use Limitations

Louisiana limits disclosure of personally identifiable student information and includes restrictions on using student data for commercial advertising, marketing, or other commercial purposes, except where allowed under applicable service arrangements and law.

Districts should ensure they can document:

• Why a disclosure is needed and what educational purpose it serves
• Whether written authorization is required for a particular disclosure
• How recipients are required to maintain confidentiality
• Whether disclosures can be satisfied using aggregate or de-identified information

Access Control to Student Information Systems

Louisiana specifies who may access computer systems where student information is stored and limits access based on role and need. This makes role-based access and documented authorization central to compliance.

District review commonly considers:

• Which roles have access to student data and what student populations are visible to each role
• How access is approved, reviewed, and revoked
• How vendor access is granted and monitored when vendors provide district services
• How audit access is handled for authorized state auditing and compliance functions

District Governance and Practical Implementation

Louisiana districts commonly implement compliance by combining policy controls with operational practices that can scale across many tools:

• Maintain a current inventory of systems and apps that touch student information
• Standardize vendor review questions for use, disclosure, security, and retention
• Document access approvals and ensure the minimum-necessary approach is applied
• Use consistent processes for external requests for student information
• Revisit approvals when vendor terms, features, or integrations change

How Can EdPrivacy Help Louisiana Schools

Louisiana's framework requires districts to manage student data through disciplined governance: limiting sensitive collection, controlling access to student information systems, and documenting disclosures and confidentiality expectations. EdPrivacy helps Louisiana schools centralize vendor documentation and approval decisions so reviews are consistent and easy to revisit.

The platform helps districts:

• Maintain a searchable inventory of apps and services that handle student information
• Capture vendor privacy and security documentation in a consistent format
• Record approval rationale tied to access control, disclosure limits, and data governance expectations
• Monitor vendor policy changes so reviews can be refreshed when risk changes

Summary

Louisiana districts should be prepared to:

• Limit collection of sensitive student information and apply a minimum-necessary approach
• Control access to student information systems through role-based authorization
• Apply disciplined disclosure practices, including confidentiality expectations for recipients
• Use repeatable vendor review and monitoring processes for tools that access student data

R.S. 17:3914 supports a governance-focused approach that prioritizes privacy protections, controlled access, and documented decision-making for student information.