Washington § 28A.604.040 Comprehensive information security program—Deletion of student personal information.

Washington Statutes

§ 28A.604.040 — Comprehensive information security program—Deletion of student personal information.

Washington § 28A.604.040

Title 28ACOMMON SCHOOL PROVISIONS

Ch. 28A.604STUDENT USER PRIVACY IN EDUCATION RIGHTS

This text of Washington § 28A.604.040 (Comprehensive information security program—Deletion of student personal information.) is published on Counsel Stack Legal Research, covering Washington primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

Wash. Rev. Code § 28A.604.040 (2026).

Text

(1)School service providers must maintain a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of student personal information. The information security program should make use of appropriate administrative, technological, and physical safeguards.

(2)School service providers must delete student personal information within a reasonable period of time if the relevant educational institution requests deletion of the data under the control of the educational institution unless:

(a)The school service provider has obtained student consent or the consent of the student's parent or guardian to retain information related to that student; or

(b)The student has transferred to another educational institution an

Free access — add to your briefcase to read the full text and ask questions with AI

(1) School service providers must maintain a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of student personal information. The information security program should make use of appropriate administrative, technological, and physical safeguards.

(2) School service providers must delete student personal information within a reasonable period of time if the relevant educational institution requests deletion of the data under the control of the educational institution unless:

(a) The school service provider has obtained student consent or the consent of the student's parent or guardian to retain information related to that student; or

(b) The student has transferred to another educational institution and that educational institution has requested that the school service provider retain information related to that student.