New York Private School Data Security and Privacy Addendum
Part 3 of the packet for a private or independent school — the instrument that replaces the NY §2-d Addendum, because §2-d binds educational agencies and a private school is not one.
Why §2-d does not apply
NY Education Law §2-d and 8 NYCRR Part 121 bind an “educational agency” — a school district, a BOCES, or a charter school — and the third-party contractors that receive protected data from one. A private or independent school is none of those. Signing the §2-d Addendum would have your school accept obligations the statute does not place on it, and would leave out the law that does govern: the New York SHIELD Act.
What replaces it
The same commitments, rested on the law that reaches a private school. N.Y. General Business Law §899-bb requires a data security program with named administrative, technical and physical safeguards; §4(b) of this Addendum prints a table mapping every element the statute lists to the section of our Data Security and Privacy Plan that implements it, so you can check coverage without reading the Plan end to end.
FERPA is a question, not an assumption
FERPA reaches a school that receives U.S. Department of Education program funds. Most private schools do not. §9(b) asks your school to state which it is, on the face of the instrument. If you do receive them, we act as a school official under 34 CFR §99.31(a)(1). If you do not, the identical commitments still bind us — as a matter of contract, enforceable by you as though FERPA applied.
No Parents’ Bill of Rights condition
8 NYCRR §121.3(b) makes a district attach its adopted Parents’ Bill of Rights before the §2-d Addendum takes effect. It does not reach a private school, so that condition does not carry over. In its place, Exhibit B is a Family Data Rights Statement written for you to adopt, edit, or decline to publish. Publishing it is not a condition of this Addendum taking effect and not a condition of service.
One security plan, not two
Exhibit A is our Data Security and Privacy Plan, incorporated by reference rather than reprinted. There is one Plan and one version of it; a copy printed inside a signed contract becomes a second version the first time the Plan is updated. We give you 30 days’ written notice before a material change, and a dated PDF of the version in force on your effective date for your own records.
The 48-hour clock is unchanged
If family data we hold is exposed, we tell your school within 48 hours of discovering it, and we pay or reimburse the cost of the notices you then have to send under GBL §899-aa. That obligation sits outside every liability cap in the packet.
Texting rules are identical
The TCPA applies the same way to a private school as to a public one: the same consent pathways, the same New York school-day calling window, the same caller identity and callback number, the same permanent STOP. Nothing about outreach is looser because the school is independent.
No certification is claimed
§4(c) says it in the instrument: the Plan is a plan. We hold no SOC 2 report, no ISO 27001 certificate, and no third-party security certification, and nothing in this packet may be read as claiming one.