Most general-purpose AI tools are not automatically FERPA-compliant. Before any AI vendor touches student data, your district needs a signed Data Processing Agreement \u2014 and not all DPAs are written the same way.<\/p>\n\n\n\n
This checklist walks IT directors, privacy officers, and district administrators through every clause that matters: what’s required under federal law, what’s strong practice, and what red flags to walk away from.<\/p>\n\n\n\n
9 Sections. Every Clause That Matters.<\/strong><\/p>\n\n\n\n Parties and Scope Permitted Use of Data Data Security Data Retention and Deletion Subprocessors and Third Parties COPPA Compliance<\/strong> State Privacy Law Compliance Audit and Accountability AI-Specific Clauses A vendor unwilling to satisfy the required items is a vendor you cannot trust with student data. This checklist is built to make that determination fast \u2014 before a tool reaches a single classroom.<\/p>\n\n\n\n Run through it before signing any agreement with an AI tool vendor.<\/p>\n\n\n\n <\/p>","protected":false},"excerpt":{"rendered":" This checklist walks IT directors, privacy officers, and district administrators through every clause that matters: what’s required under federal law, what’s strong practice, and what red flags to walk away from.<\/p>","protected":false},"featured_media":46449,"parent":0,"menu_order":0,"template":"","meta":{"_acf_changed":true,"_yoast_wpseo_focuskw":"AI Vendor DPA Checklist","_yoast_wpseo_title":"","_yoast_wpseo_metadesc":"AI vendor DPA checklist \u2014 9 sections covering FERPA, COPPA, data security, AI-specific clauses, and what to do if a vendor won't sign."},"tags":[25],"ebook_category":[],"class_list":["post-46448","ebook","type-ebook","status-publish","has-post-thumbnail","hentry","tag-ai"],"acf":{"download_link":"https:\/\/pwp.lightspeedsystems.com\/Vendor-DPA-Checklist","lss_gated_override":false},"yoast_head":"\n
<\/strong>Confirms the vendor is named as the data processor, specifies exactly which student data they’ll handle, and defines what constitutes an education record under FERPA. Vague language doesn’t cut it.<\/p>\n\n\n\n
<\/strong>The most critical section for AI tools specifically. Covers prohibitions on selling student data, advertising profiling, and \u2014 the clause most generic DPAs miss \u2014 using student data to train AI models without explicit district consent.<\/p>\n\n\n\n
<\/strong>Encryption requirements, access controls, breach notification timelines, and third-party audit certifications. Best practice is a 72-hour breach notification window; anything vague or unlimited is a red flag.<\/p>\n\n\n\n
<\/strong>Defines maximum retention periods, requires deletion upon contract termination (30\u201360 days maximum), and \u2014 critically for AI tools \u2014 addresses whether AI-generated outputs derived from student data are also subject to deletion.<\/p>\n\n\n\n
<\/strong>AI tools often run on large cloud and AI infrastructure vendors. This section requires full subprocessor disclosure, equivalent data protections down the chain, and district notification before new subprocessors are added.<\/p>\n\n\n\n
Required for any tool used with students under 13. Covers school authorization language, data minimization, and public availability restrictions.<\/p>\n\n\n\n
<\/strong>Federal law is the floor, not the ceiling. This section covers state-specific requirements \u2014 including CA SOPIPA, TX HB 4, and NY Ed Law 2-d \u2014 and flags where many DPAs fall short.<\/p>\n\n\n\n
<\/strong>Audit rights, transparency reporting, cyber liability insurance, and consequences for non-compliance beyond just termination.<\/p>\n\n\n\n
<\/strong>The section most legacy DPAs don’t have. Covers how AI\/ML models interact with student data, model training prohibitions, treatment of AI-generated outputs, and subprocessor disclosure for the AI providers powering the product.<\/p>\n\n\n\nIf a Vendor Won’t Sign, That’s Your Answer<\/h2>\n\n\n\n
Download the AI Vendor DPA Checklist<\/h2>\n\n\n\n