Privacy Law Library

Student Data Accessibility, Transparency and Accountability Act of 2013

Student DATA Act

Students · Government records · Data security

Governs Oklahoma's statewide student data system. It requires a public inventory of student data elements, FERPA-compliant access and release policies, a data security plan, and legislative approval of new data collections, and it bars most out-of-state transfers of confidential student data. Student data excludes Social Security numbers and biometric information unless in the educational record.

Where
Oklahoma
Citation
70 O.S. § 3-168
Status
In force
In force since
2013-07-01
Enforced by
State Board of Education (rulemaking and compliance oversight); reports to the Governor and Legislature
People can sue
No
Penalties
No statutory penalties; vendor contracts must include penalties for noncompliance with privacy and security safeguards.
Applies to
  • The State Board of Education and State Department of Education and the statewide student data system
  • Indirectly binds private vendors: outsourced contracts involving student or de-identified data must contain privacy and security safeguards and penalties

What a privacy notice must say

  • Notify students and parents of their rights under federal and state law.70 O.S. § 3-168(C)(2)(d)
  • Publish a data inventory and dictionary of student data elements, including proposed collections and data kept with no current purpose.70 O.S. § 3-168(C)(1)
  • Report annually to the Governor and Legislature on proposed new data collections, changes, release exceptions, and audit results; new collections lapse unless approved.70 O.S. § 3-168(C)(7)

Practices it requires

  • Restrict access to student data to authorized department staff and contractors, school personnel with a need, students and parents, and other agencies under law or data-sharing agreements; use only aggregate data in public reports unless the Board approves otherwise.70 O.S. § 3-168(C)(2)(a)-(c)
  • Do not transfer confidential student or de-identified data outside Oklahoma except for listed purposes (student transfers, national assessments, out-of-state vendor contracts, migrant or military reporting) unless the Board approves.70 O.S. § 3-168(C)(3)

Security duties

  • Develop a data security plan covering access authorization and authentication, privacy compliance standards, audits, breach planning and notification, and retention and disposal.70 O.S. § 3-168(C)(4)

Other duties

  • Contracts outsourcing databases, assessments, or instructional supports that include student data must contain express privacy and security safeguards and penalties for noncompliance.70 O.S. § 3-168(C)(6)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Latest amendment is Laws 2021, HB 1104, c. 66; the enrolled bill has no effective-date clause, so its exact effective date (likely 90 days after 2021 sine die) was not confirmed and last_amended is left null.

Research reference, not legal advice.