Cybersecurity and Data Privacy

Data Privacy Policy: Goose Creek CISD has taken action to ensure that all student data is handled securely and in compliance with all state and federal legislation. Through rigorous processes and high standards of compliance, our goal is to not only abide to state and federal law, but to provide students, parents, and our community with the resources and information needed to protect student privacy. This is accomplished by a process of continual improvement of security practices. The district employees the principle of least privilege and role based security to ensure that data is only accessed by those that have a legitimate educational purpose. A multi-layered defense is also employed to ensure that your data remains protected. As the technology landscape is constantly changing, these processes are reviewed at least annually to make sure they are still relevant and provide strong protection. In an effort to achieve these goals, the Goose Creek CISD Technology Department seeks to implement the following programs:

Trusted Learning Environment Seal Program - The CoSN Trusted Learning Environment (TLE) Seal program is the nation’s only data privacy framework for school systems, focused on building a culture of trust and transparency. The TLE Seal was developed by CoSN in collaboration with a diverse group of 28 school system leaders nationwide and with support from AASA, The School Superintendents Association, the Association of School Business Officials International (ASBO) and ASCD. School systems that meet the program requirements will earn the TLE Seal, signifying their commitment to student data privacy to their community. TLE Seal recipients also commit to continuous examination and demonstrable future advancement of their privacy practices.

CoSN has awarded the Trusted Learning Environment (TLE) Seal to Goose Creek Consolidated Independent School District (GCCISD) in 2022 and 2024. The TLE Seal is a prestigious national distinction that school districts earn for demonstrating a commitment to protecting student data through modern, rigorous policies and practices.
Texas Cybersecurity Framework - The Texas Cybersecurity Framework is a self-assessment to determine cybersecurity risks. While local governments and K-12 organizations are not required to submit a Cybersecurity Plan to the State, using the framework helps to align security goals and practices with other government entities and institutions of Higher Education across the State of Texas.

The district uses data to support a variety of processes throughout the district including supporting student learning, evaluating teachers, improving instructional and operational practices, and complying with various state and federal requirements. For more information on who uses student data, see this infographic.

GCCISD uses many applications to encourage learning through innovation. See this page for more information on approved/denied applications and the process for requesting a free or paid app.

Website Privacy Policy: Goose Creek Consolidated Independent School District (Goose Creek CISD or GCCISD) is committed to respecting and protecting your privacy as a visitor to our websites. This includes the Here, We Grow Giants site. We will only collect, store and use your personal information for defined purposes. Goose Creek CISD values accountability and transparency at all levels including ensuring that student data privacy and security are a top priority. For more information on what data is collected as well as records management, see the Data Governance tab.

Data Governance Objectives

Ongoing and transparent communication with parents and the community regarding data privacy practices.
Establish a centralized data governance framework or enterprise architecture that all departments and stakeholders must adhere to, ensuring the confidentiality, integrity, and availability of district data.
Develop and implement standardized policies to prevent the misuse of personal information related to students and employees.
Regularly propose, develop, review, and update data security and privacy standards, procedures, and related documentation.
Ensure district compliance with all applicable state and federal data privacy laws and regulations.

Student Data Collection and Security Fact Sheet

Employee Data Privacy Handbook

Data Governance Guidelines

Software FAQ

* Handbooks, procedures and guidelines are reviewed at least annually to provide updates that align with changes in laws/regulations and the constantly changing technology landscape.

Sharing Data with Vendors/Third-Parties

Goose Creek CISD takes the privacy of both student and staff data very seriously. Before procuring services or contracting with a third-party, a security risk assessment is performed. Much like a credit score is used in the lending process, a security risk score can reveal risks that a company would present and the likelihood they would suffer a data breach or other security incident. Goose Creek continuously monitors these third-parties in order to manage any risk that may occur and take appropriate proactive measures to keep district data secure. Secondly, if data will be shared with a vendor/third-party, a signed Data Privacy Agreement MUST be in place before a contract is signed. The current Data Privacy Agreement in use is the TX_NDPA_v1r6.

Records Management Compliance Training

This required training describes and mandates that every staff member, elected official, or anyone serving the district is responsible for school district records.
Records include any type of record about a student including paper or electronic forms is a legal requirement.
It is a shared responsibility and is every person’s responsibility.
All new hires are required to complete district-provided FERPA training.
All staff complete mandatory trainings yearly that include trainings on FERPA, CIPPA, COPA, and other laws.
The training is updated annually and regularly when new information is needed.

Records Management Board Policies

CPC (LEGAL) - OFFICE MANAGEMENT: RECORDS MANAGEMENT

CPC (LOCAL) - OFFICE MANAGEMENT: RECORDS MANAGEMENT

FL (LEGAL) - STUDENT RECORDS

FL (LOCAL) - STUDENT RECORDS

The Texas Local Government Records Act, Chapter 201

*Board Policy is reviewed regularly to ensure that they align with all current laws and regulations.

** Note: Local government records retention schedules are available on the TSLAC website.

GCCISD Resources

For Teachers

Make sure you identify which students have restrictions on what their personal information and pictures can and cannot be used for by running the following report.

Compromised Email Account? Here’s What To Do

05/17/2021

From CISecurity:

An email account can be compromised in a number of different ways. In some cases, your password may be weak and easily guessed or obtained through a public breach. In other cases, you may have clicked on a malicious link in an email, social networking site, or webpage. Or, you may have downloaded an app or file that contained malicious scripts.

In this edition of the security newsletter, we’ll look at potential warning signs that your email account may have been compromised, what you can do to recover, and steps you can take to help prevent it from happening again.

How to Tell if Your Email Account is Compromised

Here are some red flags that may indicate your account has been compromised:

You are unable to access your e-mail account. If an attacker gained access to your email address and password, they may have logged in and changed the password to lock you out of the account.
Your family, friends, and coworkers receive emails from you that you didn’t write. Once your email account is compromised, the attacker can use your email address to send spam or phishing emails to the contacts in your address book.
You see activity on your social media accounts that you didn’t post. Some social media sites use single sign-on (SSO) with credentials from other accounts (e.g. Google, Yahoo) so you can login to social media without having to create a separate username and password. If your email account is linked to your social media accounts or if you use the same username and password for all your accounts, the attacker can gain access to everything with a single username and password.
You notice your Sent messages folder is empty or includes messages that you did not send.

What to Do if Your Email Account is Compromised

Here are some steps you can take if your account has been compromised. If you think your account has been compromised but you are not sure, it is better to err on the side of caution and follow these steps:

Login to your email account and reset your password using a strong password.
a. Use long passphrases to make passwords easier to remember and more secure.
b. Do not use information about yourself, the city where you were born, your age, or the names of relatives, friends, or pets.
c. Do not use common words such as the name of favorite sports team.
d. If you are unable to login, contact your email provider to find out how you can regain access.
End / sign out of all sessions on all devices. Even after you change your password, if the attacker has an active session, they may be able to continue to send emails from your account.
Reset any additional accounts that the attacker may have gained access to. These may include financial institutions, shopping sites, and social media sites. There may be references to these accounts in your email. Remember to use unique passwords for each and every account. If not, if one account gets compromised, they all become compromised.
Enable Multi-Factor Authentication (MFA) on your e-mail account. This provides an additional layer of protection to login to your email account. It requires a code from a text message, phone call, or authenticator app to further verify access. Visit STOP.THINK.CONNECT to learn how to activate MFA.
Review and change your security questions. If your email account was compromised from a device or location not matching your normal usage, it’s possible a malicious individual was able to answer your security questions.
Review your mailbox for any rules that you have not previously created. These rules can include message forwarding, deletion, or running unwanted applications.
Review outgoing messages and retract any malicious outgoing messages. In most cases, the attacker will not leave traces of any outgoing messages, but this should still be checked.
Contact the people in your email address book and let them know that your email was compromised. Remind them to delete any emails from you during the time your account was compromised to prevent them from becoming the next victim.
Verify if there is private or personally identifiable information in your e-mail that could be used maliciously.
Establish a routine where you change your password periodically. Consider changing your password on at least an annual basis (unless a breach requires it sooner).
Scan your computer for viruses and malware. This is especially important if you are experiencing problematic signs like unfamiliar applications loaded on your device, your computer operating slowly, or problems shutting down.

What Can I Do to Prevent an Email Account Compromise?

Good security best practices and safe browsing habits can help prevent your email account from being compromised in the future:

Make sure your devices are patched with the latest updates, including antivirus.
Set your security software, internet browser, and operating system to update automatically. Or, establish a routine to do this manually on a frequent basis.
Use unique strong passwords for account access.
Be wary of unexpected emails, especially when they contain links and/or attachments.
Verify the sender’s address. If you don’t recognize the address, don’t reply.
If an email request from a known contact seems out of place, verify the request by calling the sender on the phone.
Think twice before clicking a link. Always hover before clicking to see the address of the web site you are attempting to visit.
Never click text links like “Click Here” or “Unsubscribe,” or any other links in suspect emails.
Never input a password or your email address on an unknown site, and never provide your passwords to anyone.
Be vigilant when reviewing emails, as you may receive an email from a legitimate contact who has been compromised.
Don’t access your email account on a public computer or from a device using public Wi-Fi.

Privacy & Security Discussion Topic Ideas

Phishing Emails
- Have you noticed any phishing emails to share with others? What clues did you notice that made you aware that it was not legitimate? How should these emails be reported? Should general SPAM be reported as Phishing?

Social Engineering
- Have you received phone calls using social engineering techniques trying to get you to give information to someone that you do not know? What did you do to verify their identity before sharing information?

Current Events
- What are some recent cyber attacks or data breaches in K-12 from news sources? How we can better be prepared to prevent a similar attack at Goose Creek CISD?
- What recent cybersecurity/data privacy news have you seen and how could it impact us?
- What are upcoming/recent laws or regulations around privacy and cybersecurity that would impact Goose Creek CISD?

Applications & 3rd Party Systems
- Have you used a new app, program, or website lately? Did you make sure you knew what data is being collected/transmitted and if it is being protected? How did you verify?
- Why is it important to vet our applications for security, privacy, or content concerns?
- Thinking about using a new app? Discuss the vetting process and assign someone to submit it for review.

Data Privacy Webpage
- What data do you collect on students? Review the Data Fact Sheet.
- Review resources on Data Privacy site

Data Breach Notice
- If you became aware of a potential data breach, who would you notify?
- What is the role of the District's cybersecurity coordinator? Who is this at Goose Creek CISD?

Data Privacy Curriculum
- How are you implementing data privacy in your classrooms?
- How do you integrate the Digital Citizenship Curriculum in your classrooms?
- What discussions have you had with students, parents, teachers, or staff about privacy/security?

Disaster and Recovery
- How do we protect data when in a disaster (fire, flood, hurricane, cyber attack, school shooting, etc)?
- How would we recover from a disaster and is that documented?

Cybersecurity and Privacy Training
- Has everyone completed the required trainings on Cybersecurity and Privacy?
- What is something each person learned from the Texas Cybersecurity training.
- What is Board Policy CQB and why is it important?

Handbooks

Employee Handbook 2025-26

Student Handbook 2025-26 (English)

Student Handbook 2025-26 (Spanish)

* Handbooks, procedures and guidelines are reviewed at least annually to provide updates that align with changes in laws/regulations and the constantly changing technology landscape.

Board Policy

CQB - Cybersecurity

*Board Policy is reviewed regularly to ensure that they align with all current laws and regulations.

Laws/Regulations

FERPA - Family Educational Rights and Privacy Act - The Family Education Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education

The Texas Local Government Records Act, Chapter 201 - States that public school district employees have an obligation to correctly and efficiently maintain the records in their possession to comply with standards for public access, parent/student access, and legal or audit purposes.

PPRA - Protection of Pupil Rights Amendment - PPRA (20 U.S.C. § 1232h, 34 CFR Part 98) affords parents of students certain rights regarding, among other things, participation in surveys, the collection and use of information for marketing purposes, and certain physical exams.

COPPA - Children's Online Privacy Protection Act - COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.

CIPA - Children's Internet Protection Act - The Children's Internet Protection Act (CIPA) was enacted by Congress in 2000 to address concerns about children's access to obscene or harmful content over the Internet.

Protecting Children in the 21st Century Act (2007) - Amends the Communications Act of 1934 to require the Federal Communications Commission (FCC) to issue regulations for promoting a safe internet for children.

Texas House Bill 18: SCOPE Act - The SCOPE Act requires covered digital service providers to provide minors with certain data protections, prevent minors from accessing harmful content, and give parents tools to manage their child's use of the service. The SCOPEE Act is highly relevant to Texas school districts. The new law specifically relates to protecting minors from harmful, deceptive, or unfair trade practices in connection with the use of certain digital services and electronic devices, including the use and transfer of electronic devices to students by a public school.

HIPAA In Texas Schools - HIPAA Privacy Regulations are federal laws that govern the use and disclosure of confidential health information.

USDA Children's Free and Reduced Disclosure - The Healthy Meals for Healthy Americans Act of 1994, PL 103-448, amended Section 9(b)(2)(C) of the National School Lunch Act (NSLA) (42 USC 1751(b)(2)(C)) to allow, without consent, limited disclosure of information about the free and reduced-price meal or free milk eligibility.

Payment Card Industry Data Security Standard (PCI DSS) - Is a set of security standards formed in 2004 by Visa, MasterCard, Discover Financial Services, JCB International and American Express. Governed by the Payment Card Industry Security Standards Council (PCI SSC), the compliance scheme aims to secure credit and debit card transactions against data theft and fraud.

David's Law English (Spanish) - "David's Law" requires school districts to include cyberbullying in their district bullying policies and notify a child's parents if he or she is a victim or alleged aggressor of bullying. It allows for schools to collaborate with law enforcement when serious or life-threatening cyberbullying situations arise.

Texas HB 3834: Cybersecurity Training for State and Local Governments - Security awareness training requirements for state employees.

Texas HB 3512: AI Training for State and Local Governments - Modifies the mandatory cybersecurity training for state employees by requiring state-certified AI training annually. Additionally, it requires local governments to certify their adherence to the training mandates when applying for state grants.

Texas Senate Bill 820 - Relating to a requirement that a school district adopts a cybersecurity policy.

Texas Senate Bill 1893 - SECTION 1. Subtitle A, Title 6, Government Code, is amended by adding Chapter 620 to read as follows: CHAPTER 620. USE OF CERTAIN SOCIAL MEDIA APPLICATIONS AND SERVICES ON GOVERNMENTAL ENTITY DEVICES PROHIBITED Sec. 620.001. DEFINITIONS. In this chapter:(1) "Covered application" means: (A) the social media service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited; or (B) a social media application or service specified by the proclamation of the governor under Section 620.005.

Texas Senate Bill 1188 - Sec. 183.002. REQUIREMENTS FOR ELECTRONIC HEALTH RECORD STORAGE. (a) A covered entity shall ensure that electronic health records under the control of the entity that contain patient information are physically maintained in the United States or a territory of the United States. This subsection applies to: (1) electronic health records that are stored by a third-party or subcontracted computing facility or an entity that provides cloud computing services; and (2) electronic health records that are stored using a technology through wich patient information may be electronically retrieved, accessed, or transmitted.

Texas Cybersecurity Framework - The Department of Information Resources (DIR) developed the Texas Cybersecurity Framework (TCF) in collaboration with other government entities and the private sector. It uses a common language to address and manage cybersecurity risk in a cost-effective way, based on business needs, without placing additional regulatory requirements on agencies.

* Last reviewed 3/19/2026

GCCISD Resources

Employee Data Privacy Handbook

Third-Party Data Privacy Video

Agenda Discussion Topics

Security Access Procedure

GCCISD Digital Safety

Digital Citizenship Curriculum

Are you considering an application?

Before you start, review our Software FAQ.

Is the app already approved or denied?

Check the Student Data Privacy Consortium (SDPC) Database
Check the Goose Creek Approved & Denied App List

You must follow the approval process to request apps for student use. Teachers may research apps they wish to use. Consider the resources below before using a third-party application (website or app). If you feel the app is a good candidate, please follow the approval process listed below or on the Ed Tech webpage.

First ask yourself these questions:
Checklist for Choosing Tools Worth Your (and Your Students') Time
Educational App Evaluation Checklist
Second make sure you understand how the data is being used. To protect student data as well as the security of other district systems, you need to understand the importance of App Vetting. Things to look at are the privacy policy, is the data encrypted, can you request deletion of data, is the data strictly used for educational purposes, is the data protected, is the app appropriate for the targeted age group, etc.
What is App Vetting and Why is it Important?
Vetting Apps Across the District (RED FLAGS to watch out for)

Vetting Process

iPad App Approval Video HOW-TO

iPad App Approval Process

iPad App Approval Workflow

Data Privacy

Educator's Guide to Student Data Privacy

Protecting Student Privacy While Using Online Educational Resources

Privacy Basics - Facebook

Privacy Basics - Twitter

Laws, Regulations and Standards

COPPA 101

FERPA 101