Maryland Code, Education § 7-2102

(i) A data privacy and security incident response plan;

(ii) A breach notification plan; and

(iii) Procedures and requirements for allowing access to student data and personally identifiable information for a legitimate research purpose; and

(i) Types of student data and personally identifiable information processed by the county board, the protocols for processing student data, and the rationales for selecting processing protocols;

(ii) Contracted services that involve sharing student data between a county board and a school service contract provider; and

(iii) Procedures and rationales for vetting and selecting Internet sites, services, and applications.