Data Processing Agreement

• FERPA Compliance: U.S. educational institutions that share student education records with ScrubCampus typically need a written agreement ensuring we act as a “school official” under FERPA
• State Laws: Many states have additional student privacy laws requiring data agreements with education technology vendors

• GDPR Requirement: If your organization is subject to the General Data Protection Regulation (GDPR) and shares personal data with us, you are legally required to have a DPA in place
• UK GDPR: Similar requirements apply under the UK’s data protection framework

• HIPAA: Healthcare organizations that may share Protected Health Information (PHI) need a Business Associate Agreement (BAA)

• Corporate Policies: Many organizations have internal policies requiring DPAs with all vendors that process employee or customer data
• Compliance Requirements: Industry-specific regulations may require formal data processing agreements

We prefer to use our standard DPA as it has been designed for our specific services and reviewed for compliance. However, for enterprise customers, we can review your template and discuss incorporating key provisions.

No, we provide DPAs at no additional cost as part of our commitment to data protection compliance.

Typically, one DPA covers your entire organization. If different entities within your organization have separate legal identities, each may need its own agreement.

We review our standard DPA annually and update it when regulations change or our services evolve significantly. We notify existing customers of material changes.

Yes, we accept electronic signatures for DPA execution.

The DPA remains in effect for any personal data we continue to process (e.g., during wind-down or retention periods) and terminates when all personal data has been deleted or returned.