Data Processing Agreement

FERPA & school-official designation

When a school or district uses IEP Casemate under a signed agreement, we operate as a school official with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)). We process student education records only to provide the contracted service, under the direction and control of the educational agency. We do not use student data for our own purposes, re-disclose it except as permitted by the agreement, or use it for advertising or model training.

What the DPA covers

• Types of student data processed and purpose limitations
• Subprocessor list and notification requirements
• Security measures, breach notification, and audit rights
• Data return and deletion on termination
• State-specific exhibits where applicable (e.g., NY § 2-d, SOPPA, California)

Request a signed copy

For a countersigned agreement or to submit your district's own DPA for review, email privacy@iepcasemate.com. Include your district or school name, contact person, and any state privacy requirements. We typically respond within five business days.

Related documents

See our Trust Center, Privacy Policy, and Security & Data Practices for subprocessors, encryption, and AI data governance details.