FERPA and NY Education Law §2-d
If a system touches student data, New York holds you to §2-d, and it holds your vendors to it through you. That means a Data Privacy Agreement, the Parents' Bill of Rights supplement listing what data is involved and how it's protected, and specific obligations on breach notification. I sign that agreement — it isn't a formality I'd ask you to skip.
As with any sector, the fastest projects are the ones that avoid the question entirely. Deadline tracking, grant reporting from aggregate numbers, and staff-facing knowledge assistants involve no student records at all, and can start immediately.
I don't claim to be FERPA certified. No such certification exists for a consultant. What exists is the agreement, the subprocessor list, and whether the vendor will put both in front of you before you sign.
Ask any vendor this
Ask whether they'll sign your §2-d Data Privacy Agreement and supply the Parents' Bill of Rights supplement. A vendor who hasn't heard of it hasn't worked with a New York school.
How data is actually handled, including every subprocessor: data handling →