Data Processing Agreements (DPA) and Student Data Privacy
Outline
Polar Cloud takes student and educator data privacy seriously. This article explains what a Data Processing Agreement (DPA) is, which Polar Cloud plans include one, and how schools and districts can request or review a DPA when required.
What is a Data Processing Agreement (DPA)?
A Data Processing Agreement (DPA) is a legal agreement between a school or district and a software provider that defines how student and educator data is handled.
In a K–12 environment, DPAs are commonly used to support compliance with student data privacy laws such as FERPA, COPPA, and applicable state-level privacy requirements. A DPA typically outlines:
What types of data are processed
How the data may and may not be used
Security and confidentiality practices
Data retention and deletion procedures
Responsibilities of both the school and the service provider
Which Polar Cloud plans include a DPA?
Polar Cloud offers DPAs for plans designed for school-wide or district-wide deployment.
School and School Plus plans
Include a Data Processing Agreement
Intended for use with student accounts
Support centralized administration, permissions, and oversight
Appropriate for school or district IT approval
Classroom plan ($199/year)
Does not include a Data Processing Agreement
Intended for individual teacher use, evaluation, or limited instructional scenarios
Not designed for institution-wide student data processing or district-level approval
This distinction reflects the scope, responsibility, and legal obligations associated with school-level deployments.
Why DPAs are tied to School-level plans
A DPA establishes formal legal obligations between Polar Cloud and a school or district regarding the handling of student data. These agreements are intended for institutional use and require coordination with school or district IT, legal, or procurement teams.
School and School Plus plans are designed to support this level of deployment and include the administrative controls and account management features typically required when student data is involved at scale.
What the Polar Cloud DPA covers (high level)
While the full DPA is shared privately with schools and districts, it generally addresses:
Categories of student and educator data processed
Permitted uses of data solely to provide the Polar Cloud service
Data security and confidentiality practices
Use of trusted service providers to support the platform
Data retention and deletion following account or contract termination
Polar Cloud does not sell student data or use student data for advertising or marketing purposes.
How to request a DPA
Schools and districts using, or planning to use, a School or School Plus plan may request a DPA by contacting Polar Cloud.
When reaching out, please include:
School or district name
Intended Polar Cloud plan
State and any known district privacy requirements
The DPA is typically reviewed and executed by the school or district’s IT, legal, or procurement team.
State-specific requirements and addenda
Some states or districts require additional language or a state-specific addendum to a standard DPA.
If your school or district has specific requirements:
You may provide your preferred state or district addendum, or
Request alignment with an applicable state template
Polar Cloud will review reasonable, applicable requirements as part of the DPA process.
Questions?
If you have questions about data privacy, DPAs, or which Polar Cloud plan is appropriate for your school, please contact Polar Cloud support or your school success representative.