Student data privacy for Google Forms add-ons: what school IT should check

Quick answer

The school IT checklist for a Forms add-on

1. Locate the privacy agreement. Look for a signed CA-NDPA (California) or the SDPC national DPA. Districts signed through CITE Privacy Services can piggyback an existing provider agreement instead of drafting one.
2. Verify the data schedule. The agreement's Exhibit B should enumerate collected data elements. Tools that only count responses and never store names, emails, or scores should say so plainly.
3. Confirm where data is stored. The lowest-risk pattern for Google Forms add-ons is configuration stored inside the district's own Google Workspace, with no external server and no external HTTP calls.
4. Check prohibited uses. The agreement should prohibit selling student data, targeted advertising, and training AI models on student data.
5. Note the incident commitment. CA-NDPA requires notification to the district within 72 hours of a confirmed breach, plus a written incident response plan.

How FormGuard handles this today

• FormGuard's CA-NDPA v1.5 provider agreement was fully executed with San Bernardino City Unified School District via the CITE Privacy Services program. Other California LEAs can countersign the same terms through CITE.
• The Schedule of Data lists application use statistics only — response counts and transient choice counts. No student names, emails, IDs, grades, or free-text answers are collected or stored by the provider.
• All settings live in Google Apps Script properties inside the school's own Google Workspace. The add-on makes no external HTTP requests and operates no external database.
• The signed exhibits commit to no AI training on student data, no advertising, and no data sale, with security practices aligned to the CIS Critical Security Controls and 72-hour incident notification.

Questions to send any Forms add-on vendor

1. Do you have a signed CA-NDPA or SDPC DPA an LEA can piggyback?
2. Which data elements appear in your Schedule of Data exhibit?
3. Is any student data stored outside our Google Workspace tenant?
4. Do you operate external servers, analytics, or telemetry endpoints?
5. What is your breach notification commitment and security framework?

If a vendor cannot answer these in one email, treat that as the answer.

Next steps

• FormGuard overviewCapacity controls with the education privacy commitment described above.
• Response limitsClose class and enrollment forms after capacity.
• SupportProcurement questions and privacy documentation requests.