Ed Law 2-d checklist for any edtech tool

A visual checklist for district data protection officers and technology directors reviewing any edtech product under New York Education Law § 2-d and Part 121 of the Commissioner's Regulations. Each item shows how Goal100 answers it, using only what our privacy pages say.

General information, not legal advice. Your district's counsel and NYSED's Privacy Office are the official word. Goal100 is designed to support compliance; we do not claim automatic compliance, and the district and its counsel review every agreement.

The checklist

Use it for any product. Check marks stay only on this device. Print it for your vendor file.

• Does the tool receive student PII, or teacher or principal data?
  If yes, Education Law 2-d and Part 121 apply to the contract.
  Rule: Ed Law § 2-d; 8 NYCRR 121.1
  How Goal100 answers: Today: no. No student accounts and no student personal information. Progress stays on the device; students share a code only if they choose. Read more
• Written contract with a data privacy agreement (DPA)
  A signed agreement before any PII is shared.
  Rule: 8 NYCRR 121.2, 121.6, 121.9
  How Goal100 answers: Goal100 will not receive student, teacher or principal data until the school or district signs a DPA. Template ready: one standard agreement based on NYSED's model, the same for every district. Read more
• Parents' Bill of Rights included with the contract
  The district's Bill of Rights must be part of every contract with a vendor that receives PII.
  Rule: 8 NYCRR 121.3; NYSED PBOR guidance (Feb. 2025)
  How Goal100 answers: Included as an exhibit in our DPA template (the district's own Bill of Rights). Summary on our privacy page. Read more
• Supplemental information posted on the district website
  Six items: purpose; how the vendor meets 2-d and FERPA; contract end date and what happens to data; how to challenge accuracy; where data is stored and how; encryption at rest and in transit.
  Rule: 8 NYCRR 121.3(c)
  How Goal100 answers: Our privacy page lists our supplemental information for all six items, ready for the district to post. Read more
• Data security and privacy plan
  Seven elements: how laws are met; safeguards; 121.3(c) compliance; staff training; subcontractors; incident handling; return or deletion at the end.
  Rule: 8 NYCRR 121.6(a)
  How Goal100 answers: Our plan is an exhibit to the DPA template. Security practices are described on our Security page. Read more
• Encryption at rest and in transit
  PII must be encrypted while stored and while moving.
  Rule: 8 NYCRR 121.9(a)(6); NYSED PBOR guidance
  How Goal100 answers: Today: HTTPS on every page; no PII stored. When accounts open: HTTPS/TLS in motion and encryption at rest by the database provider. Read more
• NIST Cybersecurity Framework
  Part 121 references the NIST Cybersecurity Framework (version 2.0 under the amendment).
  Rule: 8 NYCRR Part 121 amendment
  How Goal100 answers: We follow NIST CSF 2.0 practices, as our Security page describes. Read more
• No sale, no marketing or commercial use
  PII may not be sold or used or disclosed for marketing or commercial purposes.
  Rule: Ed Law § 2-d; 8 NYCRR 121.9(a)(8)
  How Goal100 answers: Never sold, never used for ads or marketing, never used to train AI. Read more
• Subcontractors bound by the same duties
  Any subcontractor that touches PII must follow the same rules.
  Rule: 8 NYCRR 121.6(a), 121.9
  How Goal100 answers: We disclose PII only to authorized subcontractors bound by the same duties, or as a statute or court order requires. Read more
• Breach notice timelines
  Vendor → district: no more than 7 calendar days after discovery. District → NYSED Chief Privacy Officer: within 10 calendar days. District → affected parents, students, teachers or principals: within 60 calendar days.
  Rule: 8 NYCRR 121.10
  How Goal100 answers: We commit to notify the school within 7 calendar days and to pay for required notifications when a breach is attributed to us. Read more
• Return or deletion at contract end
  What happens to data when the contract ends.
  Rule: 8 NYCRR 121.3(c), 121.6(a)
  How Goal100 answers: Return or delete, as the school chooses, with written confirmation of deletion. Read more
• Staff training before access
  Vendor staff with access must be trained on the laws first.
  Rule: 8 NYCRR 121.6(a)
  How Goal100 answers: Access limited to people who need it, after training on the laws that protect student data. Read more
• District side: Data Protection Officer named
  Each educational agency names a DPO, the main contact for data privacy.
  Rule: 8 NYCRR 121.8
  How Goal100 answers: District responsibility. We work with your DPO on every review. Read more

Breach notice timeline

1. Day 0 · vendor discovers a breachThe clock starts.
2. ≤ 7 calendar daysVendor notifies each educational agency it has a contract with (8 NYCRR 121.10(a)).
3. ≤ 10 calendar days after the district receives the vendor's noticeDistrict notifies NYSED's Chief Privacy Officer (121.10(b)).
4. ≤ 60 calendar daysDistrict notifies affected parents, eligible students, teachers or principals (121.10(e)). Notice may be delayed for a law-enforcement investigation or an unfixed security vulnerability, then must go out within 7 calendar days after that ends.

Goal100 at a glance

Official sources

Rules can change. If a link and this page ever disagree, the official page wins.

• New York Education Law § 2-d: https://www.nysenate.gov/legislation/laws/EDN/2-D (checked Nov 7, 2026)
• 8 NYCRR § 121.6 (data security and privacy plan): https://www.law.cornell.edu/regulations/new-york/8-NYCRR-121.6 (checked Nov 7, 2026)
• 8 NYCRR § 121.8 (data protection officer): https://www.law.cornell.edu/regulations/new-york/8-NYCRR-121.8 (checked Nov 7, 2026)
• 8 NYCRR § 121.10 (breach and unauthorized release reporting): https://www.law.cornell.edu/regulations/new-york/8-NYCRR-121.10 (checked Nov 7, 2026)
• NYSED Parents' Bill of Rights guidance for schools (Feb. 2025): https://nysed.gov/sites/default/files/programs/data-privacy-security/final-pbor-guidance-for-schools-on-2.24.25.pdf (checked Nov 7, 2026)
• NYSED Bill of Rights for Data Privacy and Security: https://www.nysed.gov/data-privacy-security/bill-rights-data-privacy-and-security-parents-bill-rights (checked Nov 7, 2026)
• NYSED model forms and policies (model DPA): https://www.nysed.gov/data-privacy-security/model-forms-and-policies (checked Nov 7, 2026)
• Part 121 amendment (NIST Cybersecurity Framework 2.0): https://www.counsel.nysed.gov/sites/counsel/files/rulesandregs/terms-part-121.pdf (checked Nov 7, 2026)
• NYSED: file a privacy complaint: https://www.nysed.gov/data-privacy-security/parents-and-students-file-privacy-complaint (checked Nov 7, 2026)