Connecticut Student Data Privacy: Contract Terms and the 48-Hour Clock
Connecticut's student data statutes are not the longest in the country, but they contain the provision that most changes how a vendor has to be built: a breach notification window measured in hours rather than days, running to the board of education, and then a second window running from the board to families. Most vendor incident processes cannot physically meet it, and most districts do not find that out until they need to.
| Hour | Who acts | What has to happen | What usually goes wrong |
|---|---|---|---|
| H+0 | Vendor | Discovery. The clock starts here, not at confirmation | Discovery is logged informally in a chat channel and the start time is later disputed |
| H+0 to H+4 | Vendor | Scope: which districts, which record classes, which fields | Multi-tenant systems that cannot answer “which districts” quickly |
| H+4 to H+24 | Vendor | Draft the district notice with what is known and what is not | Waiting for certainty that will not arrive inside the window |
| By H+48 | Vendor | Notice delivered to the board of education | Sent to a named individual who has left; no secondary channel |
| H+48 onward | District | Its own notification to students and parents begins | No pre-drafted family notice; the district starts writing from blank |
| Day 3+ | Both | Corrections as the picture firms up | No agreed mechanism for correcting an early notice, so nobody sends one |
Hours here are our operational reading of a 48-hour outer limit, not a quotation of the statute. Confirm the exact trigger, the counting convention and both windows in Conn. Gen. Stat. §§ 10-234aa to 10-234dd before you write them into an agreement.
What Connecticut requires in the contract
Connecticut's student data privacy provisions require a written contract between a board of education and a contractor that receives student information, student records or student-generated content, and they specify what that contract must contain. The recurring elements, paraphrased: a statement that student records remain the property of and under the control of the board; a description of the actions the contractor will take to ensure security and confidentiality; a prohibition on using student information for anything other than the purposes of the contract; a description of how a student or parent may review and correct personally identifiable information; the procedures for breach notification; and terms for the return or destruction of student information at the end of the engagement.
Connecticut also expects the board to publish notice of these contracts on its website within a short window after execution. Confirm the deadline and the required contents of that notice with counsel; the number is short and it is the kind of administrative duty that quietly lapses when the person who used to do it changes role.
The design consequence for a vendor is that Connecticut effectively requires the same artefacts New York requires, on a much faster incident timeline. A vendor that can satisfy New York's per-contract disclosure and Connecticut's clock is inside the requirements of most other states without further work.
Why a 48-hour clock is an architecture question
Any vendor can promise 48 hours. Whether they can deliver it depends on three things that exist or do not exist in the system long before an incident.
- Can the vendor determine which districts are affected without a data-mining exercise? In a system where tenancy is enforced by application-layer filters, answering that question means reasoning about code paths. In a system where tenancy is enforced in the database, it is a query. Kastr enforces isolation with Postgres row-level security under a non-owner, DML-only role set inside every transaction, so table ownership cannot silently bypass the policy, and with no organisation context set the policies evaluate against NULL and return zero rows — it fails closed rather than open. A cross-tenant leakage suite runs in CI against real Postgres, including a regression check for the owner-bypass case.
- Is there a record of who touched what, and can it have been edited? An application log that an administrator can rewrite is not evidence. Kastr's per-district audit log is hash-chained with SHA-256, each entry covering the previous one, with the chain serialised under an advisory transaction lock so it stays correct under concurrency, and with UPDATE and DELETE revoked at the database role in addition to insert-and-select-only row-level security policies.
- Is there a rehearsed notice? The single cheapest improvement to a 48-hour capability is a pre-written district notice template with the unknowns marked as unknown. Districts should ask to see the vendor's, and should write their own family notice at the same time, because the district's clock starts when the vendor's ends.
What a Connecticut district should do with this in an evaluation
Three questions, asked in this order, resolve most of it.
- “Show me the notice you would send us.” Not the policy. The template. A vendor without one will produce a policy document, and that is your answer.
- “Who receives it here, and what is the second channel?” Put a role and a shared mailbox in the contract, plus a phone number. Then test it once a year with a scheduled non-incident message, the way you test a fire alarm.
- “What does your system record, and can it be altered?” The honest answers range from “application logs, 30 days, engineers can edit them” to something append-only. Both are acceptable positions for a district to accept knowingly. Neither is acceptable to discover afterwards.
Our gaps, since you will ask. Kastr is pre-launch with no customers, no SOC 2 audit, no VPAT and no SSO of any kind — magic link is the only authentication we implement. Export is a contract right under clause 7.1 rather than a self-serve tool, and we say it that way deliberately because a right you have to email someone to exercise is not a button. If any of those is disqualifying for a Connecticut district, it should be, and we would rather you knew now.
This page describes what a statute asks of a vendor. It is not legal advice, statutes are amended, and section numbering moves. Confirm the current text with your own counsel or your state education agency before you rely on any of it in a contract or a procurement file.
Questions people actually ask
How fast must a vendor report a data breach to a Connecticut school district?
Connecticut's student data provisions set a very short outer limit — widely understood as 48 hours from discovery for the contractor to notify the board of education, with a further short window for the board to notify students and parents. Confirm the current text and the counting convention, then write the requirement, the recipient role and a second channel into the contract.
Does Connecticut require districts to publish student data contracts?
Connecticut requires boards of education to give public notice of contracts covered by the student data provisions, on the board's website, within a short period after execution. Confirm the deadline and required contents with counsel, and assign the task to a role rather than a person.
What has to be in a Connecticut student data contract?
The recurring elements are ownership and control of student records remaining with the board, a security and confidentiality description, a use limitation, a review-and-correction route for parents and students, breach notification procedures, and terms for return or destruction at the end. Work from the current statutory text or your regional service centre's model contract rather than from a vendor's summary.
Can a vendor meet a 48-hour breach clock in practice?
Only if the architecture supports it. The vendor must be able to identify affected districts quickly, must hold a record of access that cannot be quietly edited, and must be willing to send a notice that says what is not yet known. Ask for the notice template during evaluation; the presence or absence of one tells you most of what you need.
One price. Every feature. Locked for three years.
$3.50 per student per year under 5,000 students. No tiers, no add-on modules, no per-message fees. Published on the site because you should not have to book a call to learn a price.