(a) Each educational agency shall designate a data protection officer to be responsible for the implementation of the policies and procedures required in Education Law section 2-d and this Part, and to serve as the point of contact for data security and privacy for the educational agency.

(b) Data protection officers must have the appropriate knowledge, training and experience to administer the functions described in this Part.

(c) A current employee of an educational agency may perform this function in addition to other job responsibilities.