SOC 2 for edtech: what school districts and universities ask

The table sets what a district or university asks for against what answers it. Some rows a SOC 2 report answers directly. Others only your contract can. This is not legal advice about any agreement, and the school’s counsel decides what it signs.

How FERPA reaches a vendor

The general rule is consent. A school or district may not disclose personally identifiable information from education records to a provider without written consent from the parent or eligible student, unless an exception applies.² The Department’s guidance names the exception that usually fits online services: the school official exception. It applies when the provider:

• performs a service or function the school would otherwise use its own employees for;
• meets the criteria in the school’s annual FERPA notice for a school official with a legitimate educational interest;
• is under the school’s direct control over the use and maintenance of education records;
• uses the records only for the authorized purposes, and does not redisclose them without the school’s authorization.

Direct control is the part your contract carries. FERPA’s regulations do not require a written agreement for this exception. In practice, the guidance says, a contract signed by both sides usually establishes it, and terms of service can in some cases. The Department recommends written agreements as a best practice even when FERPA does not apply.

Two consequences follow. Terms you can amend without notice sit badly with direct control, and the guidance tells schools to be cautious about click-through terms that allow it. And data you receive this way is for the school’s purpose only. Using it to target ads to a student is outside that purpose.

What the agreement asks of you

The Department lists the provisions it recommends schools put in contracts with providers.² Read it as the shape of the agreement you will be asked to sign.

Security and data stewardship

Who owns the data, each side’s duties after a breach, and, when appropriate, minimum security controls and the right to a security audit. This is the clause a SOC 2 report answers best.

Collection

Exactly what you collect, including logs, cookies and tracking pixels.

Use, retention, disclosure and destruction

The purposes you may use data for, who you may share it with, and how it is destroyed when the contract ends.

Access

Whether the school, parents or eligible students can reach the data, and how. The Department suggests the school act as the go-between for parent requests.

Modification, duration and termination

How the terms change, how long they last, and what happens to the data at the end.

A district may hand you its own data privacy agreement to sign. The Student Data Privacy Consortium publishes a National Data Privacy Agreement as a common contract between districts and vendors, and keeps a registry of signed agreements.⁴ Check the registry for your product before you negotiate from scratch.

State law: California as an example

FERPA is a floor. The Department’s guidance reminds schools that other federal, state, tribal and local laws may apply to online educational services.² California shows what that can add.

Under Education Code section 49073.1, a local educational agency’s contract with a third party for digital storage of pupil records, or for educational software that uses them, must contain specific terms.⁵ The records stay the agency’s property. The vendor may not use them beyond the contract or for targeted advertising. The contract must describe the vendor’s security actions, including designating and training responsible people, and its breach notice procedure. It must also certify that records are not kept once the contract ends. A contract that fails those terms can be voided if the defect is not cured after notice.

Business and Professions Code section 22584 goes further for K-12 products.⁶ An operator of a site or app designed and marketed for K-12 school purposes may not use student information for targeted advertising or sell it. It must keep reasonable security procedures and delete a student’s information when the school asks. Other states may have their own statutes. Read the law of each state you sell into, or ask the district which agreement it uses.

One federal law sits beside FERPA for young students. The Department tells schools to consider the Children’s Online Privacy Protection Act (COPPA) before using a service with children under 13, and notes that the Federal Trade Commission allows schools to consent for parents in certain limited circumstances.²

Which Trust Services Criteria to put in scope

Security is in every SOC 2 report. The optional categories follow your contract.⁷ Confidentiality tests how you protect information designated as confidential and dispose of it as committed, which matches the destruction terms above. Privacy tests collection, use, retention, disclosure and disposal against the notice you publish, and fits a product that students or parents use under your own privacy notice. Availability fits a contract that commits you to uptime during the school day.

The scoping tool walks each one. In Polara GRC you add them in the assessment or from your account settings, until the engagement letter is signed or the audit is requested. A data retention policy and an incident response plan are where the destruction and breach terms land. The same structure applies to healthtech and HR software, with a different law behind the buyer.