FERPA — Family Educational Rights and Privacy Act
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeRegulationLegal InstrumentActSectorEducation SectorIndustryGovernment & Public Sector
- Region / PublisherRegionNorth AmericaRegion DetailUnited StatesPublisherU.S. Congress (enacted); enforced by the U.S. Department of Education, Student Privacy Policy Office
- VersioningVersion20 U.S.C. 1232g (section 444 of the General Education Provisions Act), as amended; 34 CFR Part 99, as amendedEffective DateNovember 19, 1974Issue DateAugust 21, 1974
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
FERPA is U.S. federal law in the public domain, published in the United States Code and the Code of Federal Regulations, and is included with the platform as a requirement set.
Framework text is licensed by its publisher and is included only where stated above.
- FERPA gives parents and eligible students the right to inspect education records, seek their amendment, and control disclosure of personally identifiable information.
- It binds every educational agency or institution that receives funds under a program administered by the U.S. Department of Education.
- Enacted August 21, 1974, it has applied since November 19, 1974 and is implemented by 34 CFR Part 99.
- The Department's Student Privacy Policy Office investigates complaints, and the Secretary may withhold payments or terminate funding eligibility.
- Schools publish an annual notification of rights, designate directory information, honor opt-outs, and keep a record of disclosures.
Overview
The Family Educational Rights and Privacy Act (FERPA) is the U.S. federal law, codified at 20 U.S.C. 1232g and implemented by 34 CFR Part 99, that gives parents and eligible students the right to inspect and review education records, to seek their amendment, and to control the disclosure of personally identifiable information from them. It binds every educational agency or institution, public or private, that receives funds under a program administered by the U.S. Department of Education (34 CFR 99.1), and it has applied since November 19, 1974.
Congress enacted FERPA on August 21, 1974 as section 513(a) of Pub. L. 93-380, adding section 444 to the General Education Provisions Act, with effect ninety days after enactment. The Department of Education enforces it: its Student Privacy Policy Office investigates complaints (34 CFR 99.60 to 99.66), and the Secretary may withhold payments, seek a cease-and-desist order or terminate funding eligibility where compliance cannot be secured voluntarily (20 U.S.C. 1232g(f); 34 CFR 99.67). The regulations were last substantively amended in 2008 and 2011.
Schools, districts, state education agencies and postsecondary institutions apply FERPA by defining what counts as an education record, publishing an annual notification of rights (99.7), setting the criteria for school officials with a legitimate educational interest, designating directory information and honoring opt-outs (99.37), keeping a record of disclosures (99.32), and answering access requests within 45 days (99.10). Rights belong to the parent until the student turns 18 or enrolls in a postsecondary institution, when they transfer to the student (99.5).
Why does it matter?
FERPA is a condition of federal education funding rather than a statute with private lawsuits or fines, so the risk it carries is the one the Department of Education can act on: findings of non-compliance, corrective plans and, at the end of the process, loss of eligibility for federal funds (34 CFR 99.67). For the institution, the law decides who may see a transcript, a disciplinary file or a health record kept by the school, and what must happen before that information leaves the building.
Key benefits include:
- Clear rights for families and students
Inspection and review within 45 days (99.10), amendment and a hearing (99.20 to 99.22), and written consent before most disclosures (99.30).
- A definition that fixes the scope
Education records are records directly related to a student and maintained by the institution or a person acting for it, with listed exclusions such as sole-possession notes and law enforcement unit records (99.3 and 99.8).
- Disclosure without consent only on listed grounds
The sixteen exceptions in 99.31 are exhaustive; a disclosure that fits none of them needs signed, dated, written consent.
- A transferable right
The parent's rights become the student's at age 18 or on attendance at a postsecondary institution, the eligible student (99.3 and 99.5).
- One enforcement path
Complaints go to the Department of Education within 180 days (99.64); the Office investigates, issues findings and sets a period for voluntary compliance before enforcement (99.65 to 99.67).
How does it work?
The statute sets the conditions and the regulations in 34 CFR Part 99 supply the procedure. Subpart A (99.1 to 99.8) covers applicability, definitions, the transfer of rights and the annual notification. Subpart B (99.10 to 99.12) covers inspection and review. Subpart C (99.20 to 99.22) covers amendment and hearings. Subpart D (99.30 to 99.39) covers disclosure. Subpart E (99.60 to 99.67) covers enforcement.
The default is consent: an institution may not disclose personally identifiable information from education records without a signed and dated written consent that specifies the records, the purpose and the recipient (99.30). Section 99.31 then lists the disclosures that need no consent, including to school officials with legitimate educational interests, to another school where the student seeks to enroll, to authorized representatives for audit or evaluation of federal or state programs (99.35), for financial aid, to organizations conducting studies for the institution under a written agreement, to accrediting bodies, to comply with a judicial order or subpoena, in a health or safety emergency (99.36), and of directory information (99.37).
Two controls run through every disclosure. The institution must keep, with the student's records, a record of each request for and disclosure of personally identifiable information, with the parties and their legitimate interests (99.32), and a recipient may not redisclose the information or use it for another purpose except as 99.33 allows. A contractor, consultant or volunteer may be treated as a school official only if it performs a service the institution would otherwise use employees for, is under the institution's direct control and is bound by the redisclosure limits (99.31(a)(1)(i)(B)).
Key Elements
- Right to inspect and review (99.10 to 99.12)
Access within a reasonable period and no more than 45 days after the request, explanations on request, copies where refusal would prevent review, and no fee for search or retrieval.
- Amendment and hearing (99.20 to 99.22)
A parent or eligible student may ask for amendment of a record that is inaccurate, misleading or violates privacy; on refusal there is a right to a hearing before an impartial official, and to place a statement in the record.
- Consent and the 99.31 exceptions
Signed, dated written consent is the rule; the sixteen lettered exceptions in 99.31(a), the de-identified data rule in 99.31(b) and the duty to authenticate identity in 99.31(c) set the limits.
- Directory information (99.37; 20 U.S.C. 1232g(a)(5))
Name, address, telephone listing, date and place of birth, major, participation in activities and sports, dates of attendance, degrees and awards and the like may be disclosed after public notice of the categories and an opportunity to opt out; Social Security numbers never qualify.
- Recordkeeping and redisclosure (99.32 and 99.33)
A log of disclosures kept with the records, and a bar on redisclosure by recipients except as the regulation permits.
- Annual notification (99.7; 20 U.S.C. 1232g(e))
Each year the institution tells parents and eligible students of their rights to inspect, to seek amendment, to consent to disclosure and to complain, and states its criteria for school officials and legitimate educational interest.
What does it cover?
FERPA applies to educational agencies and institutions at every level, elementary, secondary and postsecondary, and to state educational agencies, where funds are received under any program administered by the Department of Education, including student aid paid to the institution (99.1). It governs education records as defined in 99.3 and the personally identifiable information in them. It does not reach records held by a school's law enforcement unit for law enforcement purposes (99.8), certain employment records, or records of a postsecondary student made by a physician or other professional for treatment, and it does not apply to institutions that receive no Department of Education funds.
What are its objectives?
FERPA sets out to give families and students control over education records while letting schools run their programs.
Guarantee parents and eligible students the right to inspect, review and seek amendment of education records.
Require written consent before personally identifiable information is disclosed, except on the grounds listed in 99.31.
Make institutions accountable through annual notification, a record of disclosures and redisclosure limits.
Move the rights from parent to student at 18 or on postsecondary enrollment.
Give the Department of Education a complaint, investigation and enforcement process tied to federal funding.
Framework in Context
FERPA is the baseline federal rule for education records; the Protection of Pupil Rights Amendment governs surveys and certain instructional materials in schools, and the Children's Online Privacy Protection Act governs online collection from children under 13 by operators, not schools. State student privacy laws such as California's SOPIPA add duties for education technology vendors, and institutions that run clinics separate treatment records under HIPAA where FERPA does not apply. Section 99.31(a)(1)(i)(B) is the provision most vendor contracts are written to satisfy.
Common Framework Mappings
Organizations map FERPA to related privacy and sector-specific frameworks to harmonize controls, simplify compliance, and address overlapping student data protection, health, and regional privacy obligations across jurisdictions.
Mapped frameworks include:
CCPA/CPRA
California Student Online Personal Information Protection Act (SOPIPA)
COPPA
GDPR
HIPAA
ISO 27701
NIST Privacy Framework v1.0
Protection of Pupil Rights Amendment (PPRA)
How SmartSuite Supports FERPA
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management to keep the FERPA record of disclosures required by 34 CFR 99.32 as live data: each request and disclosure logged against the student record category, the 99.31 exception relied on, the recipient and its legitimate interest, so that annual notification, access requests and a Department of Education inquiry can be answered from one system.
Education Records Inventory
Map the systems and record types that hold education records as defined in 99.3, with the exclusions in 99.3 and 99.8 noted and an owner for each.
Access and Amendment Request Workflow
Track inspection requests against the 45-day limit in 99.10 and amendment requests, refusals, hearings and statements under 99.20 to 99.22.
Disclosure Log and Consent Records
Record each disclosure with the 99.31 ground or the signed consent, and the redisclosure limits passed to the recipient (99.32 and 99.33).
School Official and Vendor Register
List contractors and volunteers treated as school officials under 99.31(a)(1)(i)(B), their contracts, direct-control terms and review dates.
Directory Information and Opt-Outs
Hold the designated directory categories, the public notice and each opt-out so that 99.37 disclosures honor them.
Annual Notification and Complaint File
Schedule the 99.7 notification, keep its text and proof of distribution, and manage any 99.63 complaint with its 180-day timeline and corrective actions.
Related frameworks
The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out, and is enforced by the California Privacy Protection Agency.
COPPA requires operators of services directed to children under 13, or with actual knowledge of a child user, to get verifiable parental consent before collecting a child's data.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
The HIPAA Omnibus Rule (78 FR 5566, 2013) made business associates directly liable, set the breach risk assessment and tiered penalties, and added GINA protections.
Frequently Asked Questions For FERPA (Family Educational Rights and Privacy Act)
The rights belong to the parents of a student who is or has been in attendance. When the student turns 18 or attends an institution of postsecondary education at any age, the student becomes an eligible student and the rights transfer (20 U.S.C. 1232g(d); 34 CFR 99.3 and 99.5). A postsecondary institution may still disclose to a parent who claims the student as a dependent for tax purposes (99.31(a)(8)).
Within a reasonable period and in no case more than 45 days after the request (34 CFR 99.10(b); 20 U.S.C. 1232g(a)(1)(A)). The school must respond to reasonable requests for explanations, may not charge for search or retrieval, and may not destroy records while a request is outstanding.
Only on the grounds listed in 34 CFR 99.31(a), for example to school officials with legitimate educational interests, to a school where the student seeks to enroll, for audit or evaluation of federal or state education programs, for financial aid, to organizations conducting studies for the school, to accrediting bodies, under a judicial order or subpoena, in a health or safety emergency, and as directory information. Every other disclosure needs signed and dated written consent (99.30), and each disclosure is logged (99.32).
Information that would not generally be considered harmful or an invasion of privacy if disclosed, such as name, address, telephone listing, date and place of birth, major field of study, participation in activities and sports, dates of attendance and degrees and awards (20 U.S.C. 1232g(a)(5); 34 CFR 99.3). A school may disclose it only after public notice of the categories and a chance to opt out (99.37), and it may never use a Social Security number as directory information.
A parent or eligible student files a written complaint with the Department of Education within 180 days of the alleged violation (34 CFR 99.63 and 99.64). The Student Privacy Policy Office investigates and issues written findings with a period for voluntary compliance (99.65 and 99.66). If the institution does not comply, the Secretary may withhold payments, seek a cease-and-desist order or terminate eligibility for Department funding (99.67; 20 U.S.C. 1232g(f)). FERPA does not create a private right to sue.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.