Data Processing Agreement (DPA) — Template Outline

DRAFT FOR COUNSEL — align to SDPC National Data Privacy Agreement (NDPA) exhibits
Provider: The AI Systems Architect LLC (“Provider”)
Customer: [Institution legal name] (“Institution”)

This outline is the Company’s preferred commercial DPA structure. Counsel should map clauses to the current SDPC NDPA form and attach state exhibits (including California AB 1584 and New York Education Law § 2-d) as required by the Institution.

1. Purpose and FERPA school-official designation

Provider processes education records solely to deliver Coursekit/Studian under the Institution’s written instructions. Institution designates Provider as a school official with a legitimate educational interest under 34 CFR § 99.31(a)(1), and Provider will not redisclose education records except as permitted by FERPA and this DPA.

2. Ownership and control

Institution owns and controls education records. Provider acquires no ownership rights in Institution data. Provider will not sell student data or use it for targeted advertising.

3. Permitted uses

Limited to: providing the Services; securing the Services; complying with law; and aggregate/de-identified analytics that cannot reasonably identify a student, if allowed by the NDPA/state exhibits.

4. Security

Provider will maintain administrative, technical, and physical safeguards consistent with industry practice for ed-tech SaaS, including encryption in transit, access controls, MFA availability for privileged roles, logging, vulnerability management, and a documented incident response process.

5. Breach / security incident notice

Provider will notify Institution of a confirmed security incident affecting Institution education records without undue delay and no later than seventy-two (72) hours after confirmation, including known facts, affected data categories, mitigation steps, and a point of contact. Provider will cooperate with Institution’s investigation and legally required notices.

6. Subprocessors

Provider may use subprocessors listed in the public registry (/legal/subprocessors). Provider will impose data-protection obligations no less protective than this DPA and remain responsible for subprocessors’ performance. Material changes: advance notice per NDPA timelines.

7. Access, export, and deletion

Upon request or contract end, Provider will export available Institution data in a reasonable machine-readable form and delete or return education records per the agreed timeline, providing written confirmation of deletion when requested. De-identified security/audit records may be retained as permitted.

8. Audit rights

Upon reasonable notice, Provider will make available information reasonably necessary to demonstrate compliance (security overview, HECVAT responses, SOC reports when available, policies) and will cooperate with Institution audits as set forth in the NDPA (remote questionnaire first; on-site only if justified).

9. Student / parent rights

Institution remains responsible for responding to FERPA inspection/amendment requests. Provider will assist Institution with technical retrieval within product capabilities.

10. Term

Coterminous with the Services agreement; survival for confidentiality, deletion, and liability clauses as drafted by counsel.

11. State exhibits

Attach SDPC state exhibits as required (e.g., CA, NY). Provider intends to accept standard SDPC exhibits without commercial carve-outs that weaken student-privacy protections.

Signature block

Institution: ________________________ Date: ________
Provider: The AI Systems Architect LLC Date: ________

Not an executable contract until counsel finalizes and parties sign.