The education sector is beginning to embrace a culture that values, demands and uses data to support improved decisionmaking at every level--in classrooms, at kitchen tables and in state capitols. This shift is due in large part to state policymakers' leadership over the last six years in building statewide longitudinal data systems that collect and connect student-level data over the course of students' educational careers. States are now focused on critical actions to make sure these data can be used: linking data across disparate data systems, providing timely and appropriate access to stakeholders, and building stakeholders' capacity to use this information responsibly and effectively. While using education data is indispensable to policy, management and instructional decisions, this work must be balanced with appropriate protections for student data. The collective efforts to maximize the great potential of data must be accompanied by the necessary actions to: (1) Meet the moral and legal responsibility to respect the privacy and the confidentiality of students' personally identifiable information; (2) Mitigate risks related to the intentional and unintentional misuse of data; and (3) Ensure clarity around roles and responsibilities. This publication outlines three overarching responsibilities of state policymakers to protect the privacy, security and confidentiality of students' personally identifiable information and a series of questions about state policies and practices for state officials responsible for the stewardship of student data and state data systems to both protect student data and maximize their use to improve student achievement.