FERPA turns every access decision on a student information system, learning platform or data warehouse into a legal question: does this person or service have a legitimate educational interest in this record? The Family Educational Rights and Privacy Act (20 U.S.C. 1232g) and its regulations at 34 CFR Part 99 apply to schools, districts, colleges and universities that receive funds from US Department of Education programmes. The law predates cloud platforms, yet its "school official" and "reasonable methods" provisions now govern SaaS vendors, API integrations and AI tools that touch education records. This guide explains what FERPA requires of security teams, how the regulations translate into access control, logging and vendor controls, the current enforcement picture, and how to build a programme. It is written for security, IT and privacy leads in K-12 and higher education, and for edtech providers that act as school officials, with status checked against eCFR and the Department of Education as of October 2026.
Key takeaways
- Access control is an explicit FERPA duty. 34 CFR 99.31(a)(1)(ii) requires reasonable methods, physical or technological controls or an effective administrative policy, so school officials reach only the records in which they have a legitimate educational interest.
- Vendors are school officials only under conditions. An outsourced party must perform an institutional service, be under the institution's direct control for the use and maintenance of records, and respect the redisclosure limits in 99.33.
- Authentication is in the rule. Section 99.31(c) requires reasonable methods to identify and authenticate parents, students, school officials and any other party receiving personally identifiable information.
- FERPA has no breach notification clock, but other laws do. State breach laws and contracts still apply, and an unauthorised disclosure is still a FERPA violation the Department can investigate.
- The penalty is funding, and the Department is enforcing. Remedies under 99.67 include withholding payments and terminating eligibility, and the Student Privacy Policy Office has prioritised FERPA investigations and clearing its complaint backlog.
Scope: who and what is covered
FERPA applies to educational agencies and institutions that receive funds under any programme administered by the Secretary of Education (99.1). That includes nearly all public K-12 schools and districts and most colleges and universities, through federal student aid. Rights belong to parents until the student becomes an eligible student, at 18 or on attending a postsecondary institution, when they transfer to the student.
Edtech companies are not directly regulated by FERPA, but they are bound when they receive records as school officials or under another exception, and the Department can bar a third party that improperly rediscloses records from access for at least five years (99.67).
Education records and personally identifiable information
Under 99.3, education records are records directly related to a student and maintained by the institution or a party acting for it, in any medium, including databases, email, video and logs. Six categories are excluded: sole-possession notes used as a memory aid; law enforcement unit records; employment records unrelated to student status; treatment records of eligible students made by health professionals; records created after the person stopped being a student and not about their attendance; and peer-graded papers before the teacher records them.
| Data type (34 CFR 99.3) | FERPA status | Security handling |
|---|---|---|
| Grades, transcripts, discipline, special education, enrolment | Education record, PII | Role-based access, logging, encryption at rest |
| Student name, parents' names, address | PII (a)-(c) | Disclose only under consent or exception |
| Social Security number, student number, biometric record | PII personal identifiers (d); SSN is never directory information | Highest sensitivity tier; tokenise or mask in non-production |
| Date and place of birth, mother's maiden name | Indirect identifiers (e) | Treat combinations as identifying in exports and reports |
| Student ID or user ID used to log in | Directory information only if it cannot access records without a PIN, password or other factor | Never let an ID alone unlock records; enforce authentication |
| Directory information (name, email, photo, grade level, dates of attendance, sports, honours) | Disclosable without consent after annual notice and opt-out (99.37) | Honour opt-outs in every system that publishes data |
| Biometric record (fingerprints, iris, voiceprints, facial characteristics, handwriting) | PII | Separate storage, strict purpose, defined deletion |
| De-identified data | Releasable if no reasonable determination of identity is possible (99.31(b)) | Small-cell suppression; consider cumulative releases |
The PII definition also covers information that, alone or combined, would let a reasonable person in the school community identify the student with reasonable certainty. Log files, LMS analytics and support tickets that reference students are therefore usually education records.
Key obligations
Rights of parents and eligible students
- Annual notification (99.7): institutions must notify parents and eligible students of their rights each year, including the criteria for who is a school official and what is a legitimate educational interest when the institution discloses under that exception.
- Inspection (99.10): records must be made available within 45 days of a request, and no fee may be charged to search for or retrieve them. Security teams often have to find records across email, LMS, SIS and backups to meet this.
- Amendment and hearing (99.20 to 99.22): a right to ask for inaccurate or misleading records to be amended and to a hearing if refused.
- Consent (99.30): disclosure of PII generally needs signed and dated written consent specifying the records, purpose and recipients; electronic signatures are allowed if they identify and authenticate the person.
The exceptions security teams must engineer for
| Exception (34 CFR 99.31(a)) | Condition | Control that makes it defensible |
|---|---|---|
| (1) School officials, including outsourced providers | Legitimate educational interest; vendors under direct control and bound by 99.33 | Role and attribute-based access, contract terms, access reviews |
| (2) Transfer to another school | Student seeks or intends to enrol | Authenticated, encrypted transfer channel; record of disclosure |
| (3) and 99.35 Audit or evaluation by authorities | Authorised representatives; written agreement for representatives | Data sharing agreement, scoped extracts, destruction certificate |
| (6) Studies for or on behalf of the institution | Written agreement; data destroyed when no longer needed | Minimised extract, research code under 99.31(b)(2) not based on SSN |
| (9) Subpoena or court order | Generally reasonable advance notice to the parent or student | Legal review workflow, disclosure log |
| (10) and 99.36 Health or safety emergency | Articulable and significant threat | Documented basis recorded at the time |
| (11) and 99.37 Directory information | Annual notice and opt-out honoured | Opt-out flag enforced in directories and integrations |
Security duties in the text
- Reasonable methods for access (99.31(a)(1)(ii)): technological controls are the expected route; an administrative policy alone is acceptable only if it is effective. In practice this means role-based access in the SIS and LMS, least privilege for staff and integrations, and periodic access reviews.
- Identification and authentication (99.31(c)): parent portals, student logins and staff accounts must authenticate users reasonably. For staff and administrators, phishing-resistant MFA is the defensible baseline. See the Education Identity Security Guide.
- Recordkeeping (99.32): institutions must keep a record of disclosures of PII, with the parties and their legitimate interest, alongside the student's record, with exceptions such as disclosures to school officials and of directory information.
- Redisclosure limits (99.33): recipients may use PII only for the purpose disclosed and may not redisclose it without consent or an exception.
- De-identification (99.31(b)): releases must account for other reasonably available information and multiple releases, not just removal of names.
Timeline and current status
| Date | Event |
|---|---|
| 1974 | FERPA enacted as section 444 of the General Education Provisions Act |
| 11 April 1988 | 34 CFR Part 99 regulations published in their current structure (53 FR 11943) |
| 2008 and 2011 | Major amendments: outsourced school officials, reasonable methods, de-identification, authorised representatives and studies |
| 21 March 2017 | Most recent change to Part 99 shown on eCFR |
| 2025 | Department of Education Dear Colleague Letter sets FERPA priority concerns, directs investigations and asks state agencies to certify compliance by 30 April 2025 |
| 22 April 2025 | FTC declines to finalise a COPPA school authorisation exception, citing possible FERPA regulatory changes |
| 26 August 2026 | Student Privacy Policy Office issues a PPRA Dear Colleague letter; PPRA general guidance under review |
As of October 2026, the eCFR text of Part 99 is unchanged since 2017, and no FERPA rule amendment has been finalised. The Department has signalled possible regulatory changes, so check the Federal Register and studentprivacy.ed.gov before relying on any exception's current wording. Much of the Department's security guidance (the 2014 online educational services guidance, the 2012 data breach response checklist, the 2015 data security checklist) is older than the platforms it now applies to, so security teams should treat it as a minimum.
Enforcement and penalties
- Who enforces: the Student Privacy Policy Office (SPPO) in the Department of Education enforces FERPA and the Protection of Pupil Rights Amendment. The regulations still name the Office of the Chief Privacy Officer and the Family Policy Compliance Office, earlier names for the same function.
- Complaints: a parent or eligible student may file a written complaint within 180 days of the alleged violation or of when they knew of it (99.64); the Office may extend this for good cause and can open investigations without a complaint.
- Process: findings set out specific steps and a reasonable period for voluntary compliance (99.66). Most cases end there.
- Remedies (99.67): if compliance does not follow, the Secretary may withhold payments, seek a cease and desist order or terminate eligibility for funding. A third party that improperly rediscloses PII can be denied access to education records for at least five years.
- No private lawsuits: individuals cannot sue under FERPA itself, but state privacy laws, contracts and negligence claims after breaches can still lead to litigation.
- Current posture: the Department's 2025 letter said SPPO would prioritise investigations, clear the complaint backlog and consider loss of federal funding for non-compliance.
What it means for AI agents and non-human identities
Most education records today are read by machines: SIS-to-LMS sync jobs, rostering integrations, analytics pipelines, identity providers and, increasingly, AI tutors and assistants. Each of these runs on a non-human identity, and FERPA's "legitimate educational interest" test applies to what that identity can reach.
- Integration tokens are school-official access: an API token for a rostering or LMS integration often reads every student record in the tenant. Scope it to the fields the service needs, set expiry, rotate it and log its use. See the Service Account Security Guide.
- Privileged support tokens are a breach path: in the Canvas Instructure breach, a stored script in a support ticket ran in an agent's session and yielded a privileged token that was then used to pull student data through Canvas APIs. Instructure's remediation included eliminating lifetime tokens.
- AI tools must meet the school-official test: an AI tutor or assistant fed education records must perform an institutional service under the institution's direct control, and must not use the records for its own purposes, such as training a general model, without consent or an exception. See the AI and Privacy Guide.
- Agents need their own identities and scopes: an AI agent that queries the SIS on behalf of a counsellor should inherit that counsellor's access limits, not hold a tenant-wide credential. See the AI Agent Authorisation Guide.
- Logs and prompts are records too: prompts, transcripts and embeddings that contain student details are likely education records, subject to inspection, retention and disclosure rules.
Compliance steps
- Map education records. Inventory systems holding student PII (SIS, LMS, email, file shares, assessment platforms, data warehouse, backups), classify them, and record the owner. See the Data Classification Guide.
- Define legitimate educational interest in system terms. Turn the annual notice criteria into roles and attributes (teacher of record, counsellor, registrar, IT administrator) and implement them in SIS and LMS permissions.
- Inventory every integration and vendor. List each application, API token, service account and AI tool with access to records, the exception it relies on, the contract, and the scopes it holds.
- Contract for direct control. Add FERPA terms: purpose limits, no redisclosure, no secondary use including model training, security requirements, breach notice timelines, sub-processor approval and deletion at end of contract. See the Third-Party Risk Management Guide.
- Harden authentication. Require MFA for all staff with record access, phishing-resistant methods for administrators, and verified identity proofing for parent portal accounts.
- Log and review access. Enable audit logging for record views and exports in the SIS, LMS and warehouse, and run quarterly access reviews for staff and integrations. See the Access Reviews Guide.
- Roll out in stages. Pilot tightened roles in one school or faculty, run in report-only mode where the platform supports it, collect access-denied tickets for two weeks, then extend. Keep the previous role set exported so you can roll back quickly if teaching is disrupted.
- Prepare the breach path. FERPA has no notification clock, so plan around state laws and contracts, and record unauthorised disclosures. See the Data Breach Notification Checklist.
Decision guidance
- School official vs consent: use the school-official exception for services the institution would otherwise perform itself and directly controls; use consent for optional tools or where the vendor wants its own use of the data.
- Directory information vs PII: a narrow directory information policy reduces risk; publishing student emails as directory data makes phishing and account targeting easier.
- Small districts vs large universities: small districts can rely on platform-native roles, vendor-signed state data privacy agreements and a quarterly review; large universities with many departmental systems need central IGA, automated provisioning from the SIS and a vendor review board.
Detection, measurement and framework mapping
What to monitor: bulk exports and API reads of student records, especially by privileged or integration accounts; new OAuth grants and API tokens in the SIS and LMS; access from unusual locations to staff accounts; changes to roles and permission sets; and directory information publishing that ignores opt-outs.
- Metric: percentage of integrations with a documented exception, contract and scoped token (target 100%).
- Metric: staff accounts with record access protected by MFA (target 100%).
- Metric: access review completion and number of entitlements removed per cycle.
- Metric: integration tokens older than the rotation period, or without expiry.
- Metric: inspection requests answered within 45 days.
| FERPA duty | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Reasonable methods for access (99.31(a)(1)(ii)) | AC-3 Access Enforcement, AC-6 Least Privilege | PR.AA-05 | 5.15 Access control, 8.3 Information access restriction |
| Identification and authentication (99.31(c)) | IA-2 Identification and Authentication | PR.AA-05 | 5.17 Authentication information, 8.5 Secure authentication |
| Account lifecycle for staff and integrations | AC-2 Account Management | PR.AA-05 | 5.18 Access rights |
| Disclosure records and monitoring (99.32) | AU-2 Event Logging, AU-6 Audit Record Review | DE.CM-03 | 8.15 Logging, 8.16 Monitoring activities |
| Vendor direct control and redisclosure (99.33) | SA-9 External System Services, SR-6 Supplier Assessments | GV.SC-05 | 5.19 and 5.20 Supplier relationships and agreements |
| Inspection rights (99.10) | AC-3(14) Individual Access | GV.OC-03 | 5.34 Privacy and protection of PII |
| De-identified and research releases (99.31(b)) | PM-25 Minimization of PII Used in Testing, Training, and Research | ID.AM-07 | 8.11 Data masking |
Common failure patterns
- Click-through vendor terms: teachers adopt free tools under consumer terms, so the institution has no direct control, no deletion clause and no limit on secondary use.
- Tenant-wide integration tokens: one long-lived token with read access to every student, stored in a script or vendor console. The Canvas breach shows how a privileged platform token turns into bulk student data theft.
- Everyone is a school official: broad staff roles that give every employee search access to the whole student body, with no review.
- Student ID as a credential: systems that let a student number alone open a record, which removes it from directory information and fails 99.31(c).
- Weak de-identification: published reports with small cells that identify individual students when combined with other releases.
Practitioner checklist
- Inventory every system and integration that holds or reads education records, with an owner.
- Translate the annual notice's legitimate educational interest criteria into enforced roles.
- Require MFA for all staff with record access and phishing-resistant MFA for administrators.
- Scope, expire and rotate every integration token and service account; remove lifetime tokens.
- Put FERPA terms, including no model training on student data, into every vendor contract.
- Turn on audit logging for record views and exports and alert on bulk reads.
- Run quarterly access reviews covering staff, vendors, integrations and AI tools.
- Honour directory information opt-outs in every system that publishes student data.
- Keep the disclosure record required by 99.32 and log unauthorised disclosures.
- Test the 45-day inspection process, including email, logs and AI transcripts.
Standards and references
- eCFR: 34 CFR Part 99 Family Educational Rights and Privacy
- eCFR: 34 CFR 99.31 Disclosures Without Prior Consent
- eCFR: 34 CFR 99.3 Definitions
- eCFR: 34 CFR Part 99 Subpart E Enforcement
- US Department of Education, Student Privacy Policy Office: FERPA
- US Department of Education: Directs Schools to Comply with Parental Rights Laws
- US Department of Education, PTAC: Protecting Student Privacy While Using Online Educational Services
- US Department of Education, PTAC: Data Security Checklist
Related NHI Mgmt Group resources: Education Identity Security Guide · US State Privacy Laws Guide · Privacy Programme Guide for Security Teams · GDPR Compliance Guide for Security Teams. This guide summarises the Family Educational Rights and Privacy Act and 34 CFR Part 99 as of October 2026 and is not legal advice.