Understanding FERPA

The Family Educational Rights and Privacy Act (FERPA) is a federal law protecting the privacy of student education records.

Who FERPA covers

FERPA applies to educational agencies and institutions that receive funds under a program administered by the U.S. Department of Education.

The law appears at 20 U.S.C. § 1232g, with regulations in 34 CFR Part 99.

Who holds the rights?

Parents

FERPA rights generally belong to the parent while the student is under 18 and has not attended a postsecondary institution.

Eligible students

Rights transfer when the student turns 18 or attends a postsecondary institution at any age.

What is an education record?

In general, an education record is information directly related to a student that is maintained by an educational agency or institution—or by a party acting for it. The format does not control: records can exist in student information systems, email, documents, photographs, recordings, learning platforms, spreadsheets, or other media. FERPA also contains specific exclusions, so consult current law and policy when classification is uncertain.

Core rights under FERPA

Inspect and review

Parents and eligible students may inspect and review maintained education records. Access must be provided within a reasonable time and no later than 45 days after the request.

Request amendment

They may challenge information believed inaccurate, misleading, or otherwise in violation of the student’s privacy rights and may request a hearing if amendment is denied.

Control disclosure

Schools generally must obtain signed, dated consent before disclosing personally identifiable information from education records unless a FERPA exception applies.

Important details about access and amendment

FERPA generally requires access—not automatically a copy. Copies or another arrangement must be provided when circumstances effectively prevent inspection.
A reasonable copying fee may be charged unless it would effectively prevent exercise of the inspection right.
A school may not destroy education records while an inspection request is outstanding.
If amendment remains denied after a hearing, the parent or eligible student may place a statement in the record explaining the disagreement.
The amendment process addresses inaccurate, misleading, or privacy-violating information—not a substantive grade or professional judgment that was accurately recorded.

What valid consent must identify

The records that may be disclosed
The purpose of the disclosure
The party or class of parties to whom disclosure may be made
A signature and date from the parent or eligible student

Common exceptions to prior consent

FERPA permits—but does not always require—disclosure without consent in specified circumstances and only when the applicable conditions are satisfied.

Exception	General purpose or condition
School officials	Officials whom the agency or institution has determined have a legitimate educational interest in the particular records.
Enrollment or transfer	Officials at another school where the student seeks, intends, or is already enrolled, when related to enrollment or transfer.
Audit or evaluation	Authorized representatives carrying out qualifying audits, evaluations, or enforcement activities under required controls.
Financial aid	Information necessary to determine eligibility, amount, conditions, or enforcement of aid terms.
Studies	Organizations conducting qualifying studies for or on behalf of the school under a required written agreement and privacy controls.
Accreditation	Accrediting organizations carrying out their functions.
Order or subpoena	Compliance with a judicial order or lawfully issued subpoena after applicable notice requirements are addressed.
Health or safety emergency	Appropriate parties who need the information to protect a student or another person from an articulable and significant threat.
Juvenile justice	Qualifying state or local authorities when authorized by specific law and FERPA conditions.
Directory information	Properly designated information after required public notice and an opportunity to opt out.

The full requirements and exceptions appear in 34 CFR § 99.31.

School officials

Employment does not create access to every student record. The official must have a legitimate educational interest in the specific information.

Schools must use reasonable methods—such as effective role-based controls or administrative policies—to ensure officials access only records in which they have that interest.

Health or safety emergencies

The school must determine from the totality of the circumstances that an articulable and significant threat exists and that the recipient needs the information to help protect someone.

The school must record the threat that formed the basis for disclosure and the parties receiving the information.

Directory information

A school may designate categories such as a student’s name, address, telephone listing, date and place of birth, participation in recognized activities or sports, honors and awards, and dates of attendance as directory information.

Required notice must identify

The categories designated as directory information
The parent’s or eligible student’s right to refuse disclosure
The time allowed to submit the written opt-out

A directory-information designation does not make information public for every purpose. Schools must honor valid opt-outs and comply with other applicable federal, state, and local requirements.

Annual notification

Schools must notify parents and eligible students annually about the rights to:

Inspect and review education records
Seek amendment of qualifying information
Consent to disclosures except where FERPA authorizes disclosure without consent
File a FERPA complaint

The notice must explain procedures for exercising these rights and, when applicable, the criteria for determining who is a school official and what constitutes legitimate educational interest.

A disclosure decision workflow

Identify the record. Determine whether the information is an education record containing PII.
Identify the requester. Authenticate identity, authority, and organizational role.
Identify the purpose. Document why the information is requested and what minimum information is needed.
Look for valid consent. Confirm that consent contains every required element and remains applicable.
If there is no consent, identify a specific exception. Do not rely on general convenience or assumed benefit.
Confirm every condition. Check agreements, direct control, notice, opt-out status, recordkeeping, redisclosure, and destruction requirements as applicable.
Limit the disclosure. Release only information authorized and necessary for the stated purpose.
Transmit securely and document. Use approved systems and record access or disclosure when FERPA requires it.
Escalate uncertainty. Refer subpoenas, emergencies, research, vendor access, and unusual requests to the designated privacy or records official.

Everyday guidance for school personnel

Access information only to perform an assigned professional responsibility.
Use approved systems for storage, transmission, sharing, and disposal.
Authenticate a requester before providing information.
Do not discuss identifiable student information in public spaces or with unauthorized people.
Refer uncertain requests to the district’s records, privacy, or legal contact.
Document access and disclosures when required.

Filing a FERPA complaint

A parent or eligible student who believes a school violated FERPA may file a written complaint with the U.S. Department of Education’s Student Privacy Policy Office.

A complaint generally must be submitted within 180 days of the alleged violation—or within 180 days after the complainant knew or reasonably should have known about it. The Department strongly encourages first contacting the educational agency or institution to seek resolution.

View complaint instructions and the current form

Official resources

This page provides general information and is not legal advice. Consult current federal and state law and local policy for specific situations. Reviewed August 2, 2026.