What Belongs in an EdTech Data Privacy Agreement: A 34-Clause Checklist
Most districts sign the vendor's paper or their state alliance's paper, and both are better than nothing. What neither gives you is a reason for each clause. This checklist exists so that when a vendor asks to strike a clause — and they will — you know what you are giving up rather than negotiating on instinct.
| # | Clause | Defends against | Wording that should stop you |
|---|---|---|---|
| 1 | Definition of student data | Arguments about scope during an incident | A definition narrower than your field inventory |
| 2 | Field inventory appendix | Undisclosed data flows | “As provided by the District from time to time” |
| 3 | Ownership statement | Any claim of vendor ownership | “Joint ownership” of anything |
| 4 | Purpose limitation | Secondary use | “And to improve our products and services” |
| 5 | Prohibition on sale | Data brokerage on exit | An exception for “business transfers” with no successor obligation |
| 6 | Prohibition on advertising | Targeted advertising to families | “Non-personalised” advertising carve-outs |
| 7 | Prohibition on family monetisation | A paid parent tier appearing later | Silence. Most agreements are silent here |
| 8 | Model training restriction | Your data in someone's training corpus | “De-identified or aggregated data” with no definition |
| 9 | Sub-processor list, named | Untracked onward flows | “Including but not limited to” |
| 10 | Sub-processor change notice | Silent substitution | Notice with no right to object |
| 11 | Flow-down terms | Weaker terms downstream | “Substantially similar” with no test |
| 12 | Data location | Unexpected jurisdictions | “Primarily in the United States” |
| 13 | Encryption in transit | Interception | Nothing — this is table stakes |
| 14 | Encryption at rest | Media and backup exposure | An answer that only describes transit |
| 15 | Access control statement | Broad internal access | “Role-based access” with no description of the roles |
| 16 | Tenant isolation mechanism | Cross-district leakage | “Logically separated” with no mechanism named |
| 17 | Audit log properties | Unprovable incidents | Logs an administrator can edit |
| 18 | Breach definition | Disputes about whether the clock started | A definition requiring “confirmed harm” |
| 19 | Breach notice window | Late notice | “Without undue delay” alone |
| 20 | Breach notice recipient | Notice to a departed employee | A single named individual |
| 21 | Incident cooperation | Being left to investigate alone | Cooperation “at the District's expense” |
| 22 | Parent access and correction route | Unanswerable parent requests | “Contact the District” where the district cannot edit the field |
| 23 | Deletion on request | Data that outlives its purpose | Deletion “subject to our retention policy”, unattached |
| 24 | Definition of deletion | Backups, caches, logs | No mention of backups at all |
| 25 | Retention schedule per record class | Indefinite holding | “As long as necessary” |
| 26 | Export right, with format | Hostage data at renewal | Export “in a format determined by Vendor” |
| 27 | Export survival after termination | A closed door on day one | Any survival period under 30 days |
| 28 | Transition assistance | A migration you do alone | Assistance only at professional-services rates |
| 29 | Change-of-control right | An acquirer you did not choose | Assignment permitted with no notice and no exit |
| 30 | Material change to data terms | Terms amended by web page | “We may update this policy at any time” |
| 31 | Price protection and renewal cap | The year-four increase | Renewal “at then-current list price” |
| 32 | Compliance representations | Overstated certifications | “SOC 2 compliant” without a report and a date |
| 33 | Accessibility commitment | An inaccessible parent surface | A VPAT that is a marketing document |
| 34 | State-specific addendum hook | A base agreement that ignores your state | No mechanism to attach one |
Thirty-four is not a magic number; it is what is left after removing clauses that duplicate each other. If your state alliance addendum covers a row, use theirs. The value here is the third and fourth columns.
The six clauses that decide the next five years
If you only negotiate six, negotiate these.
Purpose limitation (4) and model training (8). These two together determine whether your district's communication patterns become someone's product. The phrase to remove is “improve our services”. The phrase to define is “de-identified”, because in a district of 900 students, the number of families served in Marshallese is not a de-identified statistic.
Family monetisation (7). Almost nobody has this clause and it is the one that ages worst. A vendor free to sell to your families later will eventually have a quarter where that looks attractive. Ours is clause 9.4: no marketing or selling to district families, no family-facing subscription revenue, permanently. Ask for the equivalent from every vendor and note who declines.
Export (26, 27) and change of control (29). These are the clauses that decide what leaving costs. An export right with no format, no survival period and no transition obligation is a right you cannot exercise. Read our own honest note below on this.
Renewal cap (31). The single largest avoidable cost in this category is the year-four increase on a platform you can no longer leave. Ours is fixed for 36 months and capped thereafter at the lesser of CPI-U or 5 per cent, in clause 3.2. Any vendor unwilling to cap should be asked what they expect to charge in year five, in writing.
How to negotiate when you have no leverage
A district of 2,000 students negotiating with a vendor that has 3,000 districts has no commercial leverage, and pretending otherwise wastes everyone's time. Three tactics that work anyway.
- Use the state alliance paper as the default. A vendor that has already signed your state's addendum for another district has no principled basis for refusing yours. Ask which districts in your state they have signed for.
- Trade term for terms. Vendors care about contract length and payment timing far more than about most clauses. A three-year commitment is worth several clauses to a sales team and costs you little if the exit rights are real.
- Put the refusals in the file. Where a vendor declines a clause, record the decline and the reason in the evaluation record. It costs nothing, it occasionally changes the answer, and it is the document that protects you if the risk materialises.
Where Kastr fails this checklist
We wrote the checklist, so it would be poor form to skip our own scorecard.
- Clause 26 and 27, export. The right exists at 7.1 and it survives termination. The tooling does not exist. Today an export is a request to us, not a button you press, and we are not going to describe a contract right as self-serve tooling.
- Clause 24 and 25, deletion and retention. We publish retention defaults per record class. There is no automated purge job behind them yet, which means today they are a policy commitment rather than an enforced mechanism. That is a real gap and it is on the roadmap.
- Clause 32, compliance representations. No SOC 2 report. Not in observation, not in audit. Pre-launch.
- Clause 33, accessibility. No VPAT. We can describe our position; we cannot hand you a conformance report we have not produced.
- Clause 15, access control. There is no SSO, SAML, OIDC or MFA. Magic link is the only authentication mechanism — 32 random bytes, 15-minute expiry, single use, device-bound, no account enumeration. Well-built, and not what an identity-provider mandate requires.
Where we do well: clause 7 exists and is permanent, clause 29 is a real 90-day exit with export and a prorated refund, clause 31 is a hard cap, clause 16 is Postgres row-level security under a non-owner role that fails closed with a cross-tenant leakage suite in CI, and clause 17 is an append-only SHA-256 hash chain with UPDATE and DELETE revoked at the database role. Five strong, five weak, all checkable.
This page describes what a statute asks of a vendor. It is not legal advice, statutes are amended, and section numbering moves. Confirm the current text with your own counsel or your state education agency before you rely on any of it in a contract or a procurement file.
Questions people actually ask
What is the difference between a DPA and a contract?
The contract governs the commercial relationship — price, term, service levels. The data privacy agreement governs what happens to student data: purposes, security, sub-processors, breach, deletion and export. They are often separate documents, and the DPA is the one that outlives the commercial relationship, because your data does.
Should we use our state alliance's DPA template?
Usually yes. A state addendum is negotiated once by people with more leverage than any single district has, and vendors who have already signed it for another district in your state find it hard to refuse. Add your own clauses on top for anything the template is silent about — family monetisation and renewal caps are the usual gaps.
What should we do if a vendor refuses a clause?
Record the refusal and the stated reason in the evaluation file, then decide whether the risk is acceptable rather than whether the vendor is agreeable. Some refusals are reasonable and some are diagnostic. A vendor that will not commit never to monetise your families is telling you about their business model.
How long should a DPA let us export data after termination?
Long enough to migrate, which in K-12 means long enough to cross a summer. Thirty days is the common floor and it is short for a district that terminates in May. Ask for the export right to survive termination by a defined period and for the format to be specified in the agreement rather than chosen later by the vendor.
One price. Every feature. Locked for three years.
$3.50 per student per year under 5,000 students. No tiers, no add-on modules, no per-message fees. Published on the site because you should not have to book a call to learn a price.