[ GLOSSARY ]
What is a data processing agreement?
Definition
Law and privacyData processing agreement
A data processing agreement (DPA), often called a data privacy agreement in schools, is a contract that sets how a vendor may collect, use, keep and delete a school's personal data.
Why it matters for schools
For AI tools, the agreement is where promises become enforceable. A strong one says the school owns the data; lists the purposes; bars sale, ads and model training; names subprocessors; sets a retention schedule, deletion timelines and breach notice; gives parents a path to request records; and grants audit rights.
In Nexus
We will sign your data privacy agreement or the Student Data Privacy Consortium's National Data Privacy Agreement, before any student data is used.
[ FAQ ]
Questions and answers
Does a school need a DPA for an AI pilot?
Yes. Sign it before any student data is used, even for a short pilot.
What should a DPA with an AI vendor say about training?
That neither the vendor nor its AI providers train or fine-tune models on student data.
What is the difference between a DPA and the NDPA?
The NDPA is a standard DPA from the Student Data Privacy Consortium that many districts use instead of negotiating their own.
[ SOURCES ]
Sources
Facts checked Oct 18, 2026.
- 1Student Data Privacy Consortium, National Data Privacy AgreementRead Oct 18, 2026 · privacy.a4l.org
[ AI FOR SCHOOLS ]
The AI your school can approve.