Privacy and Security

The Technology Department is committed to safeguarding student and staff privacy through maintaining strong data and security protections, as well as adhering to all legal, statutory, and regulatory obligations relevant to our data systems and platforms including but not limited to the following:

Children’s Internet Protection Act (CIPA)

The Children’s Internet Protection Act (CIPA) is a federal law enacted in 2000 to help protect children from harmful online content in schools and libraries. CIPA requires K–12 schools and libraries that receive certain federal funding (like E-rate discounts for internet access) to implement internet safety policies. These policies must include:

Content filtering to block or filter obscene images, child pornography, or content harmful to minors.
Monitoring of students’ online activities.
Education for minors about appropriate online behavior, cyberbullying prevention, and safe social networking practices.

Children’s Online Privacy Protection Act (COPPA)

The Children’s Online Privacy Protection Act (COPPA) is a federal law enacted in 1998 to protect the privacy of children under age 13 online. COPPA requires websites, online services, and apps directed toward children—or those that knowingly collect personal information from children—to:

Obtain verifiable parental consent before collecting, using, or sharing a child’s personal information.
Clearly post a privacy policy explaining what data is collected, how it’s used, and with whom it’s shared.
Allow parents to review and delete their child’s personal information at any time.

Family Educational Rights and Privacy Act (FERPA)

The Family Educational Rights and Privacy Act (FERPA) is a federal law enacted in 1974 that protects the privacy of student education records. FERPA grants parents—and eligible students (age 18 or older or attending postsecondary school)—the right to:

Access and review their education records.
Request corrections to inaccurate or misleading information.
Control disclosure of personally identifiable information from education records, with certain exceptions.

NH Minimum Standards for Privacy and Security of Student and Employee Data

In 2018, New Hampshire enacted House Bill 1612, amending RSA 189:66 to require the Department of Education to develop and enforce minimum privacy and security standards for student and employee data in Local Education Agencies (LEAs).

These standards apply to all LEAs under the New Hampshire Department of Education and cover both digital and physical formats of personally identifiable data for students and employees—referred to as “Covered Information”

The standards draw on a subset of the National Institute of Standards and Technology (NIST) SP 800‑171, focusing on best-practice safeguards in areas such as:

Access Control
Training & Awareness
Audit Logging
Configuration Management
Authentication
Incident Response
Maintenance & Media Protection
Personnel & Physical Security
Risk & Security Assessments
System & Communication Protection
Integrity Controls

More information can be found here

NH State RSA - Student and Teacher Information Protection and Privacy

Under RSA 189:65–68-a, schools and the Department of Education must limit what data is collected, keep it secure, and be transparent about how it’s used. These laws set clear rules for creating annual privacy plans, controlling access to sensitive information, and training staff on data protection. They also outline what types of information cannot be stored in the state’s education data systems, establish strict rules for online tools and service providers, and require prompt notification if a breach occurs. Together, these statutes help ensure that educational technology, data collection, and record-keeping put safety, security, and individual privacy first.

For more information see:

New Hampshire State RSA - Right to Privacy

New Hampshire’s Right to Privacy laws set clear rules for how personal information must be safeguarded and what must happen if that information is exposed in a security breach. These laws define what counts as sensitive data, require prompt notification to individuals and state authorities if a breach occurs, and give you the right to take action if your privacy is violated.