What Exactly Is FERPA – the Family Educational Rights and Privacy Act?


What Exactly Is FERPA – the Family Educational Rights and Privacy Act?

The Family Educational Rights and Privacy Act (FERPA) also known as the Buckley Amendment is a federal law that protects the privacy of a students’ education records and personally identifiable information. Often times FERPA is assumed to be part of the Privacy Act of 1974 which governs the records kept by government agencies, including the application records in the federal processing system which can be misleading.

When a student has reached the age of 18 or when attendance begins at a postsecondary institution at any age, rights under FERPA are transferred from the student’s parents to the student. However, FERPA does allow disclosure of a student’s education records to his or her parents if the student is listed as a dependent on the parent’s tax return under Internal Revenue Service (IRS) rules and in other special circumstances discussed below. Dependency rules for Federal Student Aid (FSA) purposes differ from those defined by the IRS so it is imperative for postsecondary institutions to fully understand the differences between the two entities.

Education records are defined as records directly related to the student maintained by an education agency, postsecondary institution or by a party acting on behalf of the agency or institution. Education records include any records in whatever medium (handwritten, email, print, file, diskette, etc.) but are not limited to admissions records (if the student was admitted), academic grades, attendance or financial aid, and transcripts or other records obtained from a school in which a student was previously enrolled.

FERPA allows eligible postsecondary students the right to:

  • Inspect and review education records within 45 days of receipt of the request by the institution;
  • Seek to have their education records amended; and
  • Consent to disclose personally identifiable information from education records, except when FERPA permits disclosure without consent.
  • The right to file a complaint with the U.S. Department of Education concerning alleged failures to comply with FERPA

Written consent is required. A student must provide written consent before an education agency or institution may disclose personally identifiable information from the student’s education records.

The written consent must:

  • State the purpose of the disclosure;
  • Specify the records that may be disclosed;
  • Identify the party or class of parties to whom the disclosure may be made; and
  • Be signed and dated

These rules apply to all education records a school keeps. A school must keep a record of each request for access and disclosure of personally identifiable information to other parties for as long as the educational records themselves are kept.

Special Circumstances

The following scenarios allow for the release of student information under FERPA without prior written consent from the student.

Disclosures to School Officials

  • Other school officials, such as teachers, within the institution whom the school has determined to have legitimate educational interests;
  • Officials of another postsecondary school or school system where the student receives services or seeks to enroll; and
  • Third-party services that your school has contracted with to perform Title IV functions are considered school officials under FERPA when they perform any of the following:
    • A school service or function for which your school would otherwise use employees;
    • Are under the control of your school with respect to the use and maintenance of education records; and
    • Comply with FERPA requirements about the use of personal information from education records

Disclosures to Government Agencies

  • Disclosures may be made for audit, evaluation, and enforcement purposes to authorized representatives of the U.S. Department of Education, which include employees of the Department as well as firms under contract to the Department to perform certain administrative functions or studies.
  • Disclosure may be made if it is in connection with financial aid the student has received or applied for. Such disclosure may only be made if the student information is needed to determine the amount of the aid or the conditions or student’s eligibility for the aid or to enforce the terms or conditions of the aid.
  • Schools may, without violating FERPA, release personally identifiable information on nonimmigrant students with an F, J, or M visa to U.S. Immigration and Customs Enforcement in compliance with the Student Exchange Visitor Information System program.

Disclosures in Response to Subpoenas or Court Orders

  • Family Educational Rights and Privacy Act permits schools to disclose personally identifiable information from a student’s education records without the student’s consent to comply with a lawfully issued subpoena or court order. In most cases, the school must make a reasonable effort to notify the student who is the subject of the subpoena or court order before complying so that he may seek protective action. However, the school does not have to notify the student if the court or issuing agency has prohibited such disclosure if certain conditions are met.
  • A school may also disclose information from education records, without the consent or knowledge of the student, to representatives of the U.S. Department of Justice in response to an ex-parte order issued in connection with the investigation of crimes of terrorism.

Campus Security and Violent Crime Records

  • Records created and maintained by a school’s law enforcement unit are exempt from the privacy restrictions of FERPA. A school may disclose information from these “law enforcement unit records” to anyone— including parents or federal, state, or local law enforcement authorities—without the consent of the student pursuant to school policy and/or state law.
  • 34 CFR 99.31(a) (13) concerns the release to the victim of any outcome involving an alleged crime of violence.
  • 34 CFR 99.31(a)(14) permits a school to disclose to anyone the final results of any disciplinary hearing against an alleged perpetrator of a crime of violence where that student was found in violation of the school’s policy on the offense.

Additional Disclosures Allowed to Parents

  • Information from a student’s education records in the case of a health or safety emergency that involves the student.
  • Notification for students under the age of 21 when the student has violated any law or policy concerning the use or possession of alcohol or a controlled substance.
  • Share information that is based on that official’s personal knowledge or observation and that is not based on information contained in an education record.

Disclosure of Directory Information:

FERPA defines directory information as information contained in the education records of a student that would not generally be considered harmful or an invasion of privacy if disclosed. Institutions may disclose the following information on a student without violating FERPA if the student has not restricted access to their information:

  • Student’s Name
  • E-Mail Address
  • Address
  • Telephone Listing
  • Date of Birth
  • Photograph
  • Major and Minor Fields of Study
  • Grade Level / Class Standing
  • Dates of Attendance
  • eDegrees, Honors, and Awards Received
  • Participation in Officially Recognized Activities and Sports
  • Position, Weight, and Height of Athletes
  • Most Recent Educational Agency or Institution Attended

Annual Notification Requirement

Under FERPA, a school must annually notify eligible students in attendance of their rights under FERPA. The annual notification must include the students right to:

  • Inspect and review his or her education records;
  • Seek to amend records;
  • Consent to disclosure of personally identifiable information (except in certain circumstances);
  • File a complaint regarding an alleged failure by a school to comply with FERPA; and
  • Inform eligible students of the school’s definitions of the terms “school official” and “legitimate educational interest.”

FERPA does not require a school to notify eligible students individually of their rights under FERPA. The institution may provide the notice by any means likely to inform eligible students of their rights. The annual notification may be published by various means, including any of the following:

  • In a schedule of classes;
  • In a student handbook;
  • In a calendar of school events;
  • On the school’s website (though this should not be the exclusive means of notification); and
  • In the student newspaper and/or posted in a central location at the school or various locations 

How Is Your Institution Tracking FERPA?

Does your institution have policies and procedures in place to properly comply with Family Educational Rights and Privacy (FERPA)? Does your manual process or Student Information System (SIS) allow tracking and documentation of Family Educational Rights and Privacy Act (FERPA) blocks, disclosures and retention of prior releases of information? Diamond SIS assists with all levels of data security and Family Educational Rights and Privacy Act (FERPA) compliance, keeping student data safe and private. User permissions can be controlled by management to ensure that private information remains secure.

Our robust student management system blends your school’s expertise with our school expertise empowering users to more effectively manage their activities. We value innovation, integrity, and above all customer service. Our main objective is to assist your career school’s continual growth and health. Contact us to learn more today! https://diamondsis.com/contact-us/

Family Educational Rights and Privacy Act – FERPA Citations

Family Educational Rights and Privacy Act of 1974

34 CFR 99.7 Notification of FERPA Rights

34 CFR 99.8 Law enforcement unit records

34 CFR 99.10–12 Right of student to review records

34 CFR 99.20–22 Right of student to request amendment to records

34 CFR 99.30 Prior consent requirement

34 CFR 99.31 When prior consent is not required to disclose information

34 CFR 99.32 Record keeping requirement

34 CFR 99.33 Limitations on redisclosure

34 CFR 99.34 Disclosure to other agencies/institutions

34 CFR 99.35 Disclosure to certain authorities for audit or evaluation of education programs

Subpoena Citations

20 USC 1232g(b)(1)(J)(i) and (ii), (b)(2)(B)

20 USC 1232g(b)(4)

34 CFR 99.31(a)(9)

34 CFR 99.32

Ex-Parte Orders and Terrorism

“Terrorism” and “crimes of terrorism” are defined in 18 USC 2331 and 2332b(g)(5)(B)

Family Educational Rights and Privacy Act (FERPA) General Guidance for Students


Family Educational Rights and Privacy Act (FERPA) Model Notice for Directory Information


2017- 2018 Federal Student Aid Handbook, Volume 2 – School Eligibility and Operations, Chapter 7 – Record Keeping, Privacy & Electronic Processes



About the Author:

Schedule a Demo