Texas Student Data Privacy Legal Compliance Guide

The following chart provides a brief overview of the laws of the state of Texas addressing privacy and security of student data, and the corresponding provisions of Microsoft’s standard operating documents that demonstrate compliance with those laws and regulations.

As an entity that provides online services, Microsoft is an “operator” under Texas law.

Microsoft’s standard Online Services Data Protection Addendum (“DPA”) addresses the requirements imposed on operators by Texas’ statutory framework.  The DPA sets forth Microsoft’s standard obligations with respect to the processing and security of customer data and personal data in connection with Microsoft’s provision of online services. 

The reference chart below briefly identifies those provisions of Texas law that are applicable to operators such as Microsoft, and the relevant provision(s) from Microsoft’s DPA that addresses Microsoft’s compliance with that requirement.

Texas Law ProvisionCompliant Microsoft Provision(s)
Tex. Educ. Code § 32.152(a)(1)
Targeted advertising based on information, including covered information
Microsoft Online Services Data Protection Addendum -> Data Protection Terms -> Nature of Data Processing; Ownership -> Processing to Provide Customer the Online Services
Tex. Educ. Code § 32.152(a)(2)
Use of information to create a profile about a student
Microsoft Online Services Data Protection Addendum -> Data Protection Terms -> Nature of Data Processing; Ownership -> Processing to Provide Customer the Online Services
Tex. Educ. Code § 32.152(a)(3)
Selling or renting a student’s information
Microsoft Online Services Data Protection Addendum -> Data Protection Terms -> Nature of Data Processing; Ownership -> Processing to Provide Customer the Online Services
Tex. Educ. Code § 32.155
Operator’s duty to implement and maintain reasonable security procedures and practices
Microsoft Online Services Data Protection Addendum -> Data Protection Terms -> Data Security -> Security Practices and Policies

See also Microsoft Online Services Data Protection Addendum -> Appendix A – Security Measures
Tex. Educ. Code § 32.156
Deletion of a student’s covered information not later than the 60th day after the date of the request or as specified in the contract or terms of service
Microsoft Online Services Data Protection Addendum -> Data Protection Terms -> Data Retention and Deletion