New York Education Law 2-d and ClassSense

Education Law section 2-d, with the Commissioner's regulations at 8 NYCRR Part 121, governs how New York educational agencies share personally identifiable student information, and certain teacher and principal data, with outside contractors. If you teach in a New York public school or BOCES, your district almost certainly has its own process for this. Nobody should add students to a tool before that process runs.

What Part 121 asks of a contractor

• Parents' Bill of Rights (section 121.3). The agency publishes it, and for each contract the agency attaches supplemental information: the exclusive purposes for the data, how subcontractors are handled, how long the data is kept and what happens to it at the end, how a parent can challenge the accuracy of data, where it is stored and how it is protected, and how encryption is used.
• Data security and privacy plan (section 121.6). The contractor supplies a plan covering safeguards, staff training, management of subcontractors, handling of incidents, and return or deletion of data at the end.
• Contractor duties (section 121.9). Align with the NIST Cybersecurity Framework, limit internal access to those who need it, use the data only for the authorized purposes, not disclose it without consent except as the rules permit, maintain safeguards, use encryption in motion or at rest, and not sell it or use it for marketing or other commercial purposes.
• Breach notice (section 121.10). The contractor notifies the educational agency of a breach or unauthorized release in the most expedient way possible and no more than seven calendar days after discovery. The agency then has its own deadlines to the state Chief Privacy Officer and to affected people.
• Penalties (section 121.11). Civil penalties can apply to a contractor that violates the law.

Answering the Parents' Bill of Rights supplement

The gaps a New York district should raise

• The seven-day deadline. Our public statement says affected account holders are emailed without undue delay after confirmation, with no day count. A New York contract will need a number. We have not agreed to one in advance.
• NIST Cybersecurity Framework. We have not published an assessment against it, and no outside party has evaluated us against it.
• The data security and privacy plan. We have not published a standalone plan document under that title. The security overview is the closest thing; a district that needs the formal plan should say so.
• Encryption at rest. Part 121 asks for encryption in motion or at rest. Our documentation covers motion.
• Training and access limits. We have not published a staff training program or an internal-access policy, so ask if you need them.

What we have not done

We have not signed a New York district agreement, we have not been through any state review, and we are not on a list of approved vendors. A district listing ClassSense on a vendor page would be the district's decision, not a state certification. Our public documents say uploaded curriculum and student answers may be processed by an AI service, which a New York privacy officer will want to review; see student data and AI.

If your district sends a Part 121 questionnaire, email the contact address on the data practices page and see what a signed agreement with us looks like.

Common questions