Data Processing Agreement

FERPA & school-official designation

When a school or district uses IEP Casemate under a signed agreement, we operate as a school official with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)). We process student education records only to provide the contracted service, under the direction and control of the educational agency. We do not use student data for our own purposes, re-disclose it except as permitted by the agreement, or use it for advertising or model training.

What the DPA covers

• Types of student data processed and purpose limitations
• Subprocessor list and notification requirements
• Security measures, breach notification, and audit rights
• Data return and deletion on termination
• State-specific exhibits where applicable (e.g., NY § 2-d, SOPPA, California)

Request a signed copy

For a countersigned agreement or to submit your district's own DPA for review, email privacy@iepcasemate.com. Include your district or school name, contact person, and any state privacy requirements. We typically respond within five business days.

Related documents

See our student data handling flowchart, Trust Center, Privacy Policy, and Security & Data Practices for subprocessors, encryption, and AI data governance details.