What §2-d requires

Third-party vendors handling NY K-12 student personally identifiable information (PII) must: (1) sign a Parents' Bill of Rights Addendum, (2) commit to specific data security standards (NIST CSF aligned), (3) report data incidents to the school + the NY State Department of Education within 7 days, (4) comply with deletion + return requirements at contract termination.

The Parents' Bill of Rights Addendum

Koydo signs the standard NY State Parents' Bill of Rights Addendum as part of every NY K-12 contract. The addendum commits to: data not sold for marketing, data not used outside the educational purpose, data deletion or return at contract end, data security aligned to NIST CSF or comparable framework, parents informed of their rights.

NIST CSF alignment

Koydo's security program aligns to NIST Cybersecurity Framework: Identify (asset inventory, access-control scoping), Protect (encryption at rest + transit, MFA, least-privilege), Detect (anomaly detection, audit logging), Respond (incident response runbook, 7-day NY notification), Recover (backup + restore procedures, business continuity).

7-day incident notification (NY-specific)

Koydo's standard breach protocol gives DPOs 48-hour notice of material breaches. For NY K-12 contracts specifically, Koydo also notifies the school's privacy officer within 7 days as §2-d requires, plus the NY State Department of Education when the incident meets §2-d's threshold.

Data deletion at contract termination

Per §2-d, vendors must delete OR return student data when the contract terminates. Koydo's default is delete (PII purge within 30 days of contract termination). Schools can request return-in-machine-readable-format alternative if the school will continue using the data internally.

How NY K-12 schools typically engage

Most NY K-12 contracts use the standard NY School Boards Association vendor agreement plus Koydo's DPA + §2-d addendum. Total review cycle typically 4-8 weeks at district level. We provide the §2-d addendum + signed Parents' Bill of Rights template ready to insert.