{"id":1557,"date":"2020-02-27T00:26:00","date_gmt":"2020-02-27T00:26:00","guid":{"rendered":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/?p=1557"},"modified":"2020-02-27T00:26:00","modified_gmt":"2020-02-27T00:26:00","slug":"new-regulations-education-vendors","status":"publish","type":"post","link":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/new-regulations-education-vendors\/","title":{"rendered":"New Regulations. Education Vendors."},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Where: New York<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What new requirements are being placed on education vendors?<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Contracts<\/strong>  with vendors who receive PII must state that the vendor will maintain all information in accordance with federal and state law and the school\u2019s security and privacy policy.<\/li><li><strong>Parent\u2019s Bill of Rights<\/strong> in every contract with vendors who receive PII.<\/li><li><strong>National Institute for Standards and Technology Cybersecurity Framework<\/strong> (\u201cNIST CSF\u201d) is the standard for data security and privacy.<\/li><li><strong>July 1, 2020<\/strong> deadline for all schools to adopt a data security and privacy policy<\/li><li><strong>Online Privacy Policies. <\/strong>Schools must publish their data security and privacy policies on their websites.<\/li><li><strong>Schools Must Train Staff.<\/strong> Schools must provide data privacy and security awareness training to officers and employees with access to PII.<\/li><li><strong>Designate a Data Protection Officer <\/strong>(\u201cDPO\u201d)  at each school to be responsible for the compliance program and to otherwise serve as a point of contact for the schools on data security and privacy matters.<\/li><li><strong>Vendor Notification. <\/strong>Vendors that suffer a breach of PII must notify the affected schools within 7 calendar days<\/li><li><strong>School Notification.<\/strong> schools must in turn notify  within 10 calendar days of receipt of notification of a breach from the vendor &amp;  the schools must notify affected individuals <strong><span style=\"text-decoration: underline;\">without unreasonable delay<\/span><\/strong> but in no case later than sixty (60) days of discovery or receipt of breach notification from the vendor.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.jdsupra.com\/legalnews\/new-york-adopts-new-data-security-and-64996\/\">Jackson Lewis | New York Adopts New Data Security And Privacy Regulations For Schools And Their Vendors<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Where: New York What new requirements are being placed on education vendors? Contracts with vendors who receive PII must state that the vendor will maintain all information in accordance with federal and state law and the school\u2019s security and privacy policy. Parent\u2019s Bill of Rights in every contract with vendors who receive PII. National Institute [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1557","post","type-post","status-publish","format-standard","hentry","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts\/1557","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/comments?post=1557"}],"version-history":[{"count":1,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts\/1557\/revisions"}],"predecessor-version":[{"id":1558,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts\/1557\/revisions\/1558"}],"wp:attachment":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/media?parent=1557"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/categories?post=1557"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/tags?post=1557"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}