Nebraska Student Data Privacy

Requires Signed Agreement

Does not require signed agreement

Nebraska’s student records law (79-2,104) limits disclosure and supports FERPA-aligned data sharing and governance.

‍Nebraska Student Data Privacy Guide

Primary Law: Access to school files or records; limitation; fees; disciplinary material; and sharing of student data, records, and information
Citation: Neb. Rev. Stat. § 79-2,104 (and Nebraska Department of Education Rule 6)
Official Text: https://nebraskalegislature.gov/laws/statutes.php?statute=79-2,104

‍

Nebraska’s student data privacy framework is grounded in the federal Family Educational Rights and Privacy Act (FERPA) and Nebraska’s student records statute, Neb. Rev. Stat. § 79-2,104, which governs access to student files/records and limits disclosure to unauthorized persons. Nebraska Legislature+1

Crucially for district leaders: Nebraska’s statute is disclosure- and governance-focused (student records), and districts typically manage vendor access to student data through FERPA-aligned controls and written agreements. Nebraska Department of Education guidance emphasizes that districts should ensure agreements are in place before sharing student data with third parties under FERPA exceptions. Nebraska DOE+1

Core scope and definitions

Under Neb. Rev. Stat. § 79-2,104, a student and the student’s parents/guardians (and certain school personnel) have access to the school’s files or records maintained concerning the student, including the right to inspect, review, and obtain copies of such files or records. Nebraska Legislature

No other person may access these records except when a parent/guardian or eligible student provides written consent; and
Records may also be disclosed in limited circumstances permitted under Nebraska law and FERPA.

Personally identifiable information (PII) under FERPA is broad and generally includes identifiers and information that can reasonably be linked to a student (e.g., names, addresses, contact information, student ID numbers, online identifiers, and related data elements). Nebraska DOE provides practical guidance on common FERPA concepts and exceptions. Nebraska DOE+1

Name of a student or family members; addresses and contact information.
Student ID numbers and other identifiers, including online identifiers used to recognize a user over time.
Date/place of birth and related demographic information.
Records, data, or combinations of data that could reasonably identify a student.
Other information maintained in education records or shared for authorized educational purposes under FERPA.

If information is part of an education record or can reasonably be linked to an identifiable student, districts should treat it as protected under FERPA and manage access accordingly.

Restrictions on operators (ed-tech vendors)

Nebraska’s student records statute does not operate like an “operator-focused” edtech privacy law. In practice, Nebraska districts manage edtech vendors by controlling disclosure of student records/PII and ensuring any third party that receives student information uses it only for district-authorized purposes under FERPA. Nebraska DOE+1

Prohibited uses without consent

Without appropriate consent or a valid FERPA exception, districts should treat the following as prohibited:

Disclosure of student records/PII to unauthorized persons.
Use of student data by a vendor for purposes beyond the district-authorized educational purpose (including marketing/advertising or resale).
Re-disclosure of student data by a third party outside the scope of the lawful disclosure basis.
Collection or sharing of student data that exceeds what is necessary for the authorized purpose.

These limits should be enforced through district policies, access controls, and written agreements with vendors and service providers.

Security and deletion

Neb. Rev. Stat. § 79-2,104 requires that student record contents not be divulged to unauthorized persons, and districts should implement reasonable administrative and technical safeguards to protect student data. Nebraska Legislature+1

Maintain access controls and procedures that limit who can view student records and why.
Remove and destroy disciplinary material after a student’s continuous absence for three years (per statute).

Permitted uses and disclosures

Nebraska law permits certain disclosures consistent with FERPA, including disclosures to authorized representatives for audits/evaluations of supported education programs and enforcement of related legal requirements. Where personally identifiable data is collected for these purposes, it must be protected and destroyed when no longer needed. Nebraska Legislature+1

Disclosures to designated “school officials” with legitimate educational interests (as structured under FERPA).
Disclosures for studies conducted on behalf of educational agencies/institutions (FERPA studies exception).
Disclosures for audit/evaluation of education programs (FERPA audit/evaluation exception).
Directory information disclosures when properly designated and noticed under FERPA.

Nebraska also supports uniform sharing of student data among districts, educational service units, learning communities, and the Nebraska Department of Education when permitted by applicable law. Nebraska Legislature+1

Relationship to other Nebraska student-record rules

Nebraska’s student records requirements sit on top of FERPA and related federal student privacy obligations. Nebraska Department of Education guidance summarizes common FERPA exceptions and emphasizes that districts should use reasonable methods (including agreements) to ensure third parties use student information only for district-authorized purposes and destroy the data when it is no longer needed. Nebraska DOE+1

Are signed district–vendor contracts required under Nebraska law?

No, Nebraska law does not require a signed data-privacy contract with every vendor as a standalone statewide mandate.

Neb. Rev. Stat. § 79-2,104 focuses on access and disclosure of student records, not a universal vendor contract template. Nebraska Legislature+1
When Nebraska school districts disclose student data to third parties, they should rely on written agreements or a robust vendor vetting and monitoring system to document purpose limitations, required safeguards, and data retention and deletion expectations, and to maintain consistent oversight as vendor practices and technologies evolve.

Nothing in Nebraska’s approach prevents districts from requiring contracts; written agreements are often the practical mechanism for governing vendor access and demonstrating compliance.

Practical implications for Nebraska districts

Because Nebraska’s approach is student-records and disclosure focused, Nebraska districts should pay particular attention to:

Controlling access to records
Limit access to authorized individuals and ensure disclosures are consistent with FERPA and state law.
Separating academic and disciplinary records
Maintain records so academic and disciplinary matters are kept separate, as required by statute.
Documenting disclosures and agreements
When sharing student data with vendors or third parties, document the lawful basis (consent or FERPA exception) and ensure agreements constrain use and require deletion when data is no longer needed. Nebraska DOE+1
Applying retention and destruction rules
Ensure disciplinary materials are removed and destroyed after the statutory timeline and that audit/evaluation data is destroyed when no longer needed.
Aligning local practice with FERPA
Use consistent processes for parent access, record review, and permissible disclosures under FERPA.

How EdPrivacy Supports Nebraska Schools

Even without a single statewide “operator contract” requirement, Nebraska districts still need a clear process for evaluating and managing the vendors and services that receive student data. EdPrivacy helps by giving districts a consolidated, easy-to-maintain view of all apps used in classrooms, supporting:

FERPA-aligned vendor oversight, with quick access to district approval records and vendor documentation.
Purpose limitation and evidence tracking, so districts can document why data is shared and under what authority.
Agreement and retention tracking, so districts can maintain organized records of vendor terms and deletion expectations over time.

This gives Nebraska administrators a dependable, structured way to manage disclosure decisions and strengthen vendor accountability, without adding unnecessary administrative burden.

‍