Texas student data privacy laws sit on top of FERPA, not beside it. HB 2087 and related provisions in the Education Code define what counts as a "covered information" agreement, what vendors must promise, and what districts must publish. For a Texas district evaluating a school management system, the contract review is often the longest part of procurement. The good news is that the same questions come up every time, and Borderset is designed so the answers are visible before the first call ends.
What HB 2087 actually expects from vendors
Texas law treats school operators as fiduciaries of student information. That translates into three practical commitments: do not sell student data, do not use it to target advertising, and do not retain it longer than the educational purpose requires. Your contract should name those commitments explicitly, identify subprocessors, and describe how data is returned or destroyed at the end of the agreement. Borderset's security and compliance page documents each of those positions so legal counsel does not have to chase them.
Parent transparency without the panic
Districts must give parents reasonable means to review and request correction of their child's records. That works best when the underlying data model has clear ownership. Configure role-based access so a parent-facing export can be generated by a registrar without exposing internal counselor notes.
Breach notification timelines
Texas expects prompt notice when student data is exposed. Decide today which staff member owns the breach notification template, which phone tree fires, and how Borderset's audit logs feed the post-incident report. Practicing this once a year matters more than the policy document itself.
Sign the right contract on day one
A clean Texas student data agreement names the parties, defines covered information, lists permitted purposes, restricts secondary use, and sets a clear data return or destruction clause. It should also reference the district's parent notice and the vendor's privacy practices in a single addendum. When the contract is signed, capture it in your records so audits do not become archaeology projects. If you are migrating from spreadsheets or a legacy SIS, walk through what to expect when integrating your SIS so privacy is built into the cutover rather than retrofitted later.
Borderset implementations in Texas follow a repeatable pattern: confirm the data flow, lock down roles, sign the agreement, and document the parent-facing notice. None of those steps require legal heroics, but skipping any one of them turns the next audit into a fire drill. Districts that bring legal, technology, and academic leaders into the same one-hour kickoff meeting typically finish the privacy checklist in a single week — and then never have to revisit it as a special project.
Teacher workflows deserve attention, too. Texas educators move quickly between gradebooks, attendance, and parent messaging. If every workflow lives inside Borderset, there is no incentive to copy a roster to a personal device or paste student names into a public AI tool. Teacher tracking features keep professional development records, certifications, and assignments visible to administrators without exposing private student data on shared screens.
When you are ready, Borderset can walk your team through the exact clauses HB 2087 expects and show how the platform supports each one in production. State law is not a barrier to good software — it is a checklist that good software already meets. The schools that approach Texas privacy law this way end up with cleaner data, calmer parent communications, and a board that can answer the next records question with one short email instead of a frantic phone tree. That outcome is reachable for districts of every size, and it starts with a contract you can read in one sitting.