Pupil records: contracts with third-party digital service providers
Educ. Code 49073.1
Students
Requires school contracts with cloud and education software vendors to keep pupil records under school control and bar vendors from using them for other purposes or targeted advertising, with security, breach notice, and deletion terms.
- Where
- California
- Citation
- Cal. Educ. Code 49073.1
- Status
- In force
- In force since
- 2015-01-01
- Last amended
- 2016-01-01
- Enforced by
- Parties to the contract; local educational agencies
- People can sue
- No
- Penalties
- Noncompliant contracts become void if not cured after notice, and the vendor must return all pupil records (49073.1(c)).
- Applies to
- Local educational agencies (school districts, county offices, charter schools) contracting for digital storage of pupil records or educational software
- Third-party vendors, through mandatory contract terms
Rights it gives people
- Contracts must describe how parents or eligible pupils review and correct records and how pupils keep their own content.Cal. Educ. Code 49073.1(b)(2), (4)
Practices it requires
- Contracts must state pupil records stay the school's property and bar the vendor from using them for any other purpose.Cal. Educ. Code 49073.1(b)(1), (3)
- Contracts must certify that records will not be kept after the contract ends and bar using pupil data for targeted advertising.Cal. Educ. Code 49073.1(b)(7), (9)
Security duties
- Contracts must describe the vendor's security and confidentiality measures and how affected families are notified of unauthorized disclosure.Cal. Educ. Code 49073.1(b)(5)-(6)
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Original effective date (Jan. 1, 2015, AB 1584) from background knowledge; last amendment SB 436 (Stats. 2015, Ch. 386) presumed effective Jan. 1, 2016.
Research reference, not legal advice.