Each educational agency must publish its data security and privacy policy on its website and provide notice of the policy to all its officers and employees. (8 NYCRR 121.5(e)).
Each educational agency must establish and communicate to parents, eligible students, teachers, principals or other staff of an educational agency, its procedures for them to file complaints about breaches or unauthorized releases of student data and/or teacher or principal data. [Interpreted by SED to require that such information be posted on the educational agency’s website.] 8 NYCRR 121.4(a)
Education Law § 2-d requires each educational agency in the State of New York to develop a Parents’ Bill of Rights for Data Privacy and Security and publish it on its website.
The Bill of Rights for Data Privacy and Security (Parents' Bill of Rights) and Supplemental Information for each contract where a third party contractor receives student data and/or teacher or principal data. (8 NYCRR § 121.3).