PowerSchool Cyber Attack and Liability Considerations

(from 9ine) In very late December, PowerSchools, a software platform used by schools, experienced a cyberattack through a customer service portal. When a third-party vendor such as PowerSchool suffers a data breach involving school data, the school, as the Data Controller in many jurisdictions, typically retains primary responsibility for the protection of personal information belonging to students, parents and staff. This obligation stems from various data protection and privacy laws that set out the duties and liabilities of organizations which decide “how and why” personal data is processed.

More from 9ine