How should a district address data privacy during cloud-based learning deployments?

• A. Ignore data collection limits to maximize ease of use
• B. Store all data on local servers only
• C. Conduct DPIA or risk assessment, limit data collection, use encryption, access controls, vendor contracts, and staff training
• D. Disregard vendor contracts

Answer: (C)

When a district moves learning to the cloud, the focus should be on proactively protecting privacy through a layered governance and technical approach. Start with a data protection impact assessment to map what data is collected, where it goes, who can access it, and what the privacy risks are. Then limit data collection to what’s truly necessary, and protect information with encryption both in transit and at rest. Enforce strong access controls and least-privilege permissions so only authorized staff can view or use data. Make sure vendor contracts clearly define data processing responsibilities, security measures, breach notification obligations, and data location. Finally, train staff on privacy and security practices so all users understand how to handle data properly. This combination helps manage risk, support compliance, and maintain trust, rather than taking ad-hoc or incomplete measures.