By Robert Iskander
Personally identifiable information (PII) represents an urgent and ongoing risk for every school and district, especially when it concerns students and minors. PII includes any data that could reasonably identify an individual, and that broad definition demands that districts critically examine how they collect, store, and share data. Strong data governance is no longer optional—it is essential to protect students, meet regulatory requirements, and reduce the risk of costly breaches.
Potential pitfalls
When schools or vendors collect and store PII in applications or platforms—whether intentionally or inadvertently—they trigger a higher bar for regulatory compliance. Vendors that access student data typically must agree to strict data privacy terms through a Data Privacy Agreement (DPA). Industry initiatives, such as the Student Data Privacy Consortium (SDPC) coordinated by A4L, have worked to standardize DPA language so school districts and vendors can adopt consistent, enforceable privacy commitments.
Beyond DPAs, vendors increasingly face rigorous security standards and third-party audits, including frameworks such as ISO 27001/27002, NIST, and SOC 2 Type 1 and Type 2 examinations. These compliance programs are expensive and time-consuming to achieve, creating significant barriers to entry for early-stage EdTech startups and even imposing heavy costs on larger providers. The result can be reduced competition and slower innovation in educational technology.
Districts themselves face a parallel challenge: auditing each application for PII collection and vetting vendors that handle sensitive student information. Many current vetting tools are still immature and often driven by state requirements. Numerous districts lack the internal expertise, time, or budget to perform thorough privacy and security reviews. Standards organizations, including IMS Global, are working to improve vendor evaluation practices and develop better assessment tools, but implementation across districts remains uneven.
Real-time risks of getting it wrong
Failure to manage PII properly exposes districts to regulatory penalties at both federal and state levels, but cyber threats present the most immediate financial danger. Ransomware attacks targeting schools and vendors have surged in recent years, resulting in millions of dollars in remediation costs and operational disruption. Beyond financial loss, breaches carry long-term reputational harm and personal liability for district leaders, including superintendents, who may face legal and professional consequences following a data incident.
How remote learning increases student data vulnerability
As remote and hybrid learning expands, students and teachers spend more time online outside the protections of school firewalls and filtered networks. Without school-managed internet environments, learners and staff are more exposed to phishing, scams, and other cybersecurity threats. Untrained users may fall victim to credential theft or identity fraud, which can give attackers access to additional systems and sensitive information.
Creating a secure digital learning environment requires multiple layers of protection. Managed access devices such as Chromebooks or school-issued PCs, filtered internet connections at home, and secure integration platforms that govern data exchanges between schools and vendors are all part of a robust defense strategy. Integration Platform-as-a-Service (iPaaS) solutions that mediate and monitor third-party data requests can limit unnecessary data sharing and reduce the overall risk surface.
With most students using digital devices multiple days per week, the proliferation of EdTech platforms—accelerated by the pandemic—has increased both learning opportunities and potential attack vectors. Every EdTech provider should adopt sound security practices and maintain an incident response plan to react quickly to breaches or service interruptions.
The most practical approach for districts is to minimize the amount of PII collected and to strictly govern the data shared with vendors. Share only the information that is necessary for a vendor’s service to operate, and ensure contracts and technical controls enforce that principle.
About the author
Robert Iskander is a global business transformation leader focused on using technology to improve quality of life, with a particular emphasis on K–12 education. Recognized as one of the Top 100 EdTech Influencers by EdTech Magazine in 2017, he has held senior roles over three decades, including General Manager for Sun Microsystems in the Middle East and Global Director of Education at Sun Microsystems (now Oracle). He also led SchoolMessenger, growing its customer base to 63,000 schools across the U.S. and Canada. Robert currently serves as CEO of GG4L.
This article was originally published by The Learning Counsel, a research institute and news media organization focused on the shift to digital curriculum in education.