Indiana’s new graduation pathways will include college entrance exams as one gatekeeper to graduation for some students, but the U.S. Department of Education says that means schools must take extra care to follow student data privacy laws.

The state includes the SAT and ACT as options for students to complete the new graduation pathways, and the tests include voluntary surveys around things like student interests and college plans. Then colleges and scholarship groups receive that data from the companies that offer the tests.

But recent guidance from the U.S. Department of Education says schools should be careful about the way they work with that information and those tests.

Indiana University associate professor Beth Cate says it’s because once schools partner with vendors to offer the tests to students, a patchwork of federal privacy laws apply to both the schools and testing company.

“Then they are regulated in the records that they can disclose and how they do that and they have to make sure they are adequately protecting privacy under those laws,” Cate says.

Outside of schools, terms of use between individuals and the testing companies means the student data privacy laws don’t apply. But schools will have to contract with the vendors of those tests and make sure any shared data follows exemptions in those federal laws, and that contracts between schools and vendors remain in legal and ethical good standing.

Cate says the shift really just means more attention to detail for schools, and guidance from the federal department.

“They’ve jumped in then to say ‘hey, OK, let’s lay it out there so that schools understand what we as the regulators are thinking about this and what we expect of them,’” she says.

The state department of education says it will start looking at requirements and state-level guidance on those tests and privacy concerns next year. New graduation pathway requirements start with the class of 2023.