Data Request and Disclosure Logging Procedure
Organization: Aina Design Corp
Applies To: hawaii.mokunet.us · kuleana.ainadesign.org · huikoeaina.ainadesign.org · ainadesign.org
Version: 1.0
Effective Date: February 20, 2026
Next Review: February 20, 2027
Policy Owner: Data Governance Lead
This procedure defines how Aina Design Corp receives, reviews, authorizes, fulfills, and logs all requests for student education records — whether from district staff, parents, or third parties. Maintaining this log is a core FERPA obligation and supports transparency with district partners.
This procedure covers all requests for student data that are:
•
Made by district or school staff (within the platform via export or API)
•
Made by parents or eligible students asserting FERPA rights
•
Made by courts, law enforcement, or government agencies
•
Made by any third party not already authorized as a sub-processor
Routine access to student data within the platform as part of normal educational use (e.g., a teacher viewing their own class) is governed by the Access Control Policy and logged automatically — it does not require a formal request under this procedure.
All formal data requests must be submitted in writing to: privacy@ainadesign.org
The request must include:
•
Name and role of the requestor
•
School or district affiliation (if applicable)
•
Specific data categories requested
•
Stated purpose for the request
•
The student(s) or scope of data affected
4. Request Review and Authorization
District data governance contact confirmation
Parent / eligible student
Identity verification + district notification
Review of legal process; district notified where permitted
Third-party researcher or partner
Written district authorization + DPA
The Data Governance Lead reviews all requests. Requests that cannot be fulfilled under FERPA or the district agreement are denied in writing with the reason stated.
5. Disclosure Log Requirements
Every disclosure of student education records — including fulfillment of formal requests and any emergency or legally compelled disclosures — must be recorded in the Disclosure Log with the following fields:
Data categories disclosed
Specific types of records shared
Number of students; individual IDs if a targeted request
Purpose stated by requestor
Verbatim or summarized purpose
Name of authorizing district contact or legal basis
Platform export, API, email attachment, etc.
Fulfilled, partially fulfilled, or denied (with reason)
6. Parent and Student Rights Requests
Parents of minor students and eligible students (age 18+) have the right under FERPA to:
1.
Inspect records — Request to view their education records. Fulfilled within 45 days of verified request.
2.
Request correction — Dispute inaccurate records; process coordinated with the district.
3.
Request disclosure log — Request a list of all third-party disclosures of their child’s education records.
Aina Design Corp coordinates these requests with the relevant district. We do not fulfill parent/student requests without district involvement.
In a health or safety emergency where disclosure of student information is necessary to protect a student or others, disclosure may be made without prior authorization. Such disclosures must be:
•
Documented in the Disclosure Log immediately after the fact
•
Reported to the district data governance contact within 24 hours
•
Limited to only the information necessary to address the emergency
8. Disclosure Log Access and Retention
•
The Disclosure Log is maintained by the Data Governance Lead.
•
Access is restricted to the Data Governance Lead, Compliance Officer, and external auditors.
•
The log is retained for 3 years per the Data Retention and Deletion Policy.
•
Copies of the log (redacted where needed) are available to district partners upon request.
•
Quarterly: Disclosure log reviewed for completeness and anomalies
•
Annually: Full procedure review
Data Governance Lead: _________________________
Compliance Officer: _________________________
Date Approved: _________________________