Skip to main content
NC School Connectivity Initiative

Digital Safety & Privacy

How Cybersecurity and Data Privacy Work Together to Protect Students

Cybersecurity and data privacy are closely related, but they focus on different aspects of protecting information. Effective cybersecurity is crucial for ensuring data privacy, and Public School Units (PSUs) must address both to protect sensitive information and maintain the trust of students, families, and staff. The two disciplines overlap significantly, and understanding how they connect is essential to a comprehensive approach to information security in K-12 schools.

Defining Cybersecurity

Cybersecurity is a field dedicated to protecting digital systems, networks, and information from unauthorized access, misuse, and disruption. It includes a wide range of practices, such as access controls, encryption, incident response, and vulnerability management. The National Institute of Standards and Technology (NIST) frames it as the work of preventing, detecting, and responding to attacks. In everyday terms, cybersecurity is the lock on the filing cabinet: it keeps the wrong people out and keeps school systems running for the people who depend on them.

Understanding Data Privacy

In contrast, data privacy focuses on protecting personal and sensitive information. It requires implementing strict policies and technologies to ensure that data is collected, stored, and used ethically. To guide these efforts, organizations can use resources like the NIST Privacy Engineering Program (PEP) and incorporate privacy-enhancing technologies (PETs) into their systems. Key aspects include user consent, data minimization, transparency, and data security. In everyday terms, data privacy is the rulebook for who is allowed to hold the key, what they may do with student information, and how long they may keep it.

The Interconnection of Cybersecurity and Data Privacy

Effective data privacy practices are an essential part of a comprehensive cybersecurity strategy, while cybersecurity covers a broader range of concerns than privacy alone. Strong security measures, such as access controls and encryption, are necessary to protect privacy; without them, personal information is vulnerable to breaches and misuse. Conversely, privacy considerations should shape how security controls are designed, so that security practices respect individuals’ privacy rights and comply with applicable regulations.

The Cybersecurity and Infrastructure Security Agency (CISA) takes a similar view, describing cybersecurity as protecting networks, devices, and data from unauthorized access or criminal use, and keeping information confidential, accurate, and available.

Comprehensive Approach for Information Protection

By integrating both cybersecurity and data privacy into their overall strategy, PSUs can create a more secure and privacy-conscious environment that protects both their assets and the people they serve. For North Carolina schools, that approach is guided by federal and state requirements. See the “Key Resources” section for more.

Conclusion

Understanding the relationship between cybersecurity and data privacy is vital for PSUs that aim to safeguard sensitive information and maintain trust. By addressing both in a comprehensive way, PSUs can protect their digital assets, comply with relevant laws, and build a secure, privacy-conscious environment for students, faculty, and staff. Protecting student information is a shared responsibility: schools set the rules and safeguards, and families, students, and staff help by practicing safe habits and reporting anything suspicious right away.

Key Resources

State

  • N.C. Department of Public Instruction (NCDPI)
    • The Data Privacy and Policy site provides guidance and resources on student data privacy, security, and related policies for North Carolina PSUs.
  • N.C. Department of Information Technology (NCDIT)
    • The Office of Privacy and Data Protection (OPDP) leads the state’s privacy program, providing guidance, training and support to help agencies embed privacy, data protection, and transparency into their activities.
    • Privacy Laws, Policies & Guidance covers state and federal laws, including G.S. 115C-402.5 on student data system security and G.S. 143-800, which bars state and local government entities from paying ransoms and sits alongside NCDIT’s cyber incident reporting guidance.
    • The Statewide Cybersecurity Incident Report Form is used to report suspicious activity, including phishing, lost devices, or potential data exposure. If you experience a cybersecurity incident, report it to your PSU technology contact immediately. PSU technology staff can then report the incident to the state using the form or by calling the NCDIT Customer Support Center at 800-722-3946.

Federal

  • U.S. Department of Education (ED)
    • Student Privacy at the U.S. Department of Education. The Department is committed to protecting student and administrator privacy and enforces student privacy laws such as FERPA and PPRA.
    • FERPA (Family Educational Rights and Privacy Act) protects student education records and gives parents the right to review them and to consent to most disclosures. These rights transfer to the student at age 18.
    • PPRA (Protection of Pupil Rights Amendment) gives parents notice and the right to opt out when students are asked to take certain sensitive surveys.
  • Federal Trade Commission (FTC)
  • Federal Communications Commission (FCC)
  • National Institute of Standards and Technology (NIST)
    • The Cybersecurity and Privacy site offers a wide range of the priority areas that NIST covers, as well as the following frameworks:
    • Cybersecurity and Privacy Site offers a widespread of priority areas that NIST covers as well as the following frameworks:
      • The Cybersecurity Framework offers voluntary guidance to help organizations understand, assess, prioritize, and communicate cybersecurity risks.
      • The Privacy Framework is a voluntary tool to help organizations identify and manage privacy risk while still delivering products and services.
      • The Risk Management Framework outlines a structured process for building security and privacy risk management into the life cycle of information systems.
    • The Computer Security Resource Center (CSRC) offers information on many of NIST’s cybersecurity and information security projects, publications, news, and events, supporting people and organizations in government, industry, and academia, both in the U.S. and internationally.
  • Cybersecurity and Infrastructure Security Agency (CISA)
    • Cybersecurity for K-12 Education offers tools and guidance to help schools defend against cyber threats such as ransomware and phishing.
    • Cybersecurity Best Practices shares practical guidance for individuals and organizations, such as strong passwords, multi-factor authentication, and phishing awareness.

Industry

  • Center for Internet Security (CIS)
    • The Privacy Companion Guide shows how the CIS Critical Security Controls (v8) support privacy, helping schools connect security safeguards to privacy protection.

Local Contacts & Direct Assistance

District Support: Check your district’s website under “Technology” or “Data Privacy,” or ask your school’s front office to connect you with the local technology director.

NCDPI Support: For direct assistance building out your Public School Unit (PSU) privacy webpage, contact [email protected].