NDPA for Districts
Last updated: 6 August 2026 · Contact: privacy@canoanumis.org
We sign the National Data Privacy Agreement (NDPA), SDPC Standard Version, unmodified wherever a district can use it as published. This page tells your privacy officer what to expect before they open the template, so the review is a formality rather than a negotiation.
What we sign, and how fast
- Version: NDPA Standard Version 1.0 (Student Data Privacy Consortium), or your state's published alternate version where one exists.
- Turnaround: we return a signed agreement within two business days of receiving it. If we need a clarification, you hear from us inside those two days rather than at the end of them.
- Redlines: we accept district-specific riders where they do not conflict with commitments already published on this site. We do not ask districts to weaken their own template.
- Before any student launches: the agreement is signed first. A pilot never begins with data flowing under an unsigned template.
The exhibits, answered in advance
| Exhibit | How we complete it |
|---|---|
| Exhibit A — Description of services | CANOA Edu: LTI 1.3 assignments on an open catalog of ancient coinage for Latin, history, art, and data-literacy classes. |
| Exhibit B — Schedule of data | Checked: none of the categories requiring student identifiers. We receive an opaque LTI identifier, a course context id, student answers, and scores — and nothing else. The full inventory is in our privacy policy. |
| Exhibit C — Definitions | Accepted as published. |
| Exhibit D — Data security requirements | TLS 1.2+ in transit, encryption at rest, per-deployment isolation, no passwords in existence (cryptographic LTI launch), limited and logged staff access, backups rotating out within 35 days, breach notification per the agreement. |
| Exhibit E — General Offer of privacy terms | Signed where the state's process supports it, so that other districts in your state may accept the same terms without renegotiating with us. |
| Exhibit F — Data deletion request | Honoured on the timeline in our deletion procedure, with written confirmation. A copy-paste request template is published there. |
SDPC registry status
We are not yet listed in a state SDPC alliance registry, because a listing follows a first signed district agreement rather than preceding it. We say this plainly rather than implying coverage we do not have: if your district would be the first in your state, the General Offer in Exhibit E means your work benefits every district that follows. Ask us for the current status in your state at privacy@canoanumis.org.
If your district uses a different instrument
Many districts use their own data privacy addendum, a state form, or a consortium agreement instead of the NDPA. That is fine — send it. We also publish a GDPR Article 28 DPA for international schools and a Parents' Bill of Rights for New York districts under Ed Law 2-d. The rest of the vendor packet is on for districts.
Request the agreement
Email privacy@canoanumis.org with your district name, state, and the template you use, or start from the pilot form — it collects the same information and routes district requests straight to the privacy queue.
Start a district pilot request Download the review packet (PDF)