FERPA General Guidance for Students

General Guidance for Students

The following guidance provides eligible students with general information about the Family Educational Rights and Privacy Act (FERPA). This document is a compilation and update of various letters and guidance documents previously issued that respond to a variety of questions about FERPA. While this guidance reflects our best and most current interpretation of applicable FERPA requirements, it does not supersede the statute or regulations. We will attempt to update this document from time to time in response to questions and concerns.

FERPA is a Federal law that is administered by the Family Policy Compliance Office (Office) in the U.S. Department of Education (Department). 20 U.S.C. § 1232g; 34 CFR Part 99. FERPA applies to all educational agencies and institutions (e.g., schools) that receive funding under any program administered by the Department. Parochial and private schools at the elementary and secondary levels generally do not receive such funding and are, therefore, not subject to FERPA. Private postsecondary schools, however, generally do receive such funding and are subject to FERPA.

Once a student reaches 18 years of age or attends a postsecondary institution, he or she becomes an “eligible student,” and all rights formerly given to parents under FERPA transfer to the student. The eligible student has the right to have access to his or her education records, the right to seek to have the records amended, the right to have control over the disclosure of personally identifiable information from the records (except in certain circumstances specified in the FERPA regulations, some of which are discussed below), and the right to file a complaint with the Department. The term “education records” is defined as those records that contain information directly related to a student and which are maintained by an educational agency or institution or by a party acting for the agency or institution.

FERPA generally prohibits the improper disclosure of personally identifiable information derived from education records. Thus, information that an official obtained through personal knowledge or observation, or has heard orally from others, is not protected under FERPA. This remains applicable even if education records exist which contain that information, unless the official had an official role in making a determination that generated a protected education record.

Under FERPA, a school is not generally required to maintain particular education records or education records that contain specific information. Rather, a school is required to provide certain privacy protections for those education records that it does maintain. Also, unless there is an outstanding request by an eligible student to inspect and review education records, FERPA permits the school to destroy such records without notice to the student.

​

Access to Education Records

Under FERPA, a school must provide an eligible student with an opportunity to inspect and review his or her education records within 45 days following its receipt of a request. A school is required to provide an eligible student with copies of education records, or make other arrangements, if a failure to do so would effectively prevent the student from obtaining access to the records. A case in point would be a situation in which the student does not live within commuting distance of the school.

A school is not generally required by FERPA to provide an eligible student with access to academic calendars, course syllabi, or general notices such as announcements of specific events or extra-curricular activities. That type of information is not generally directly related to an individual student and, therefore, does not meet the definition of an education record.

Under FERPA, a school is not required to provide information that is not maintained or to create education records in response to an eligible student’s request. Accordingly, a school is not required to provide an eligible student with updates on his or her progress in a course (including grade reports) or in school unless such information already exists in the form of an education record.

​

Amendment of Education Records

Under FERPA, an eligible student has the right to request that inaccurate or misleading information in his or her education records be amended. While a school is not required to amend education records in accordance with an eligible student’s request, the school is required to consider the request. If the school decides not to amend a record in accordance with an eligible student’s request, the school must inform the student of his or her right to a hearing on the matter. If, as a result of the hearing, the school still decides not to amend the record, the eligible student has the right to insert a statement in the record setting forth his or her views. That statement must remain with the contested part of the eligible student’s record for as long as the record is maintained.

However, while the FERPA amendment procedure may be used to challenge facts that are inaccurately recorded, it may not be used to challenge a grade, an opinion, or a substantive decision made by a school about an eligible student. FERPA was intended to require only that schools conform to fair recordkeeping practices and not to override the accepted standards and procedures for making academic assessments, disciplinary rulings, or placement determinations. Thus, while FERPA affords eligible students the right to seek to amend education records which contain inaccurate information, this right cannot be used to challenge a grade or an individual’s opinion, or a substantive decision made by a school about a student. Additionally, if FERPA’s amendment procedures are not applicable to an eligible student’s request for amendment of education records, the school is not required under FERPA to hold a hearing on the matter.

​

Disclosure of Education Records

Under FERPA, a school may not generally disclose personally identifiable information from an eligible student’s education records to a third party unless the eligible student has provided written consent. However, there are a number of exceptions to FERPA’s prohibition against non-consensual disclosure of personally identifiable information from education records. Under these exceptions, schools are permitted to disclose personally identifiable information from education records without consent, though they are not required to do so. Following is general information regarding some of these exceptions.

One of the exceptions to the prior written consent requirement in FERPA allows “school officials,” including teachers, within a school to obtain access to personally identifiable information contained in education records provided the school has determined that they have “legitimate educational interest” in the information. Although the term “school official” is not defined in the statute or regulations, this Office generally interprets the term to include parties such as: professors; instructors; administrators; health staff; counselors; attorneys; clerical staff; trustees; members of committees and disciplinary boards; and a contractor, volunteer or other party to whom the school has outsourced institutional services or functions.

A school must inform eligible students of how it defines the terms “school official” and “legitimate educational interest” in its annual notification of FERPA rights. A school official generally has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility. Additional information about the annual notification of rights is found below in this guidance document.

Another exception permits a school to disclose personally identifiable information from an eligible student’s education records, without consent, to another school in which the student seeks or intends to enroll. The sending school may make the disclosure if it has included in its annual notification of rights a statement that it forwards education records in such circumstances. Otherwise, the sending school must make a reasonable attempt to notify the student in advance of making the disclosure, unless the student has initiated the disclosure. The school must also provide an eligible student with a copy of the records that were released if requested by the student.

FERPA also permits a school to disclose personally identifiable information from education records without consent when the disclosure is in connection with financial aid for which the student has applied or which the student has received, if the information is necessary for such purposes as to: determine the eligibility for the aid; determine the amount of the aid; determine the conditions for the aid; and/or enforce the terms and conditions of the aid. With respect to this exception, the term “financial aid” means payment of funds provided to an individual (or payment in kind of tangible or intangible property to the individual) that is conditioned on the individual’s attendance at a school.

Another exception permits a school to disclose personally identifiable information from education records without consent when the disclosure is to the parents of a “dependent student” as that term is defined in Section 152 of the Internal Revenue Code. Generally, if either parent has claimed the student as a dependent on the parent’s most recent year’s income tax statement, the school may non-consensually disclose the eligible student’s education records to both parents under this exception.

Postsecondary institutions may also disclose personally identifiable information from education records, without consent, to appropriate parties, including parents of an eligible student, in connection with a health or safety emergency. Under this provision, colleges and universities may notify parents when there is a health or safety emergency involving their son or daughter, even if the parents do not claim the student as a dependent.

FERPA also permits a school to disclose personally identifiable information from education records without consent when the disclosure is to the parents of a student at a postsecondary institution regarding the student’s violation of any Federal, State, or local law, or of any rule or policy of the institution, governing the use or possession of alcohol or a controlled substance. The school may non-consensually disclose information under this exception if the school determines that the student has committed a disciplinary violation with respect to that use or possession and the student is under 21 years of age at the time of the disclosure to the parent.

Another exception permits a school to non-consensually disclose personally identifiable information from a student’s education records when such information has been appropriately designated as directory information. “Directory information” is defined as information contained in the education records of a student that would not generally be considered harmful or an invasion of privacy if disclosed. Directory information could include information such as the student’s name, address, e-mail address, telephone listing, photograph, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, the most recent previous educational agency or institution attended, grade level or year (such as freshman or junior), and enrollment status (undergraduate or graduate; full-time or part-time).

A school may disclose directory information without consent if it has given public notice of the types of information it has designated as directory information, the eligible student’s right to restrict the disclosure of such information, and the period of time within which an eligible student has to notify the school that he or she does not want any or all of those types of information designated as directory information. Also, FERPA does not require a school to notify eligible students individually of the types of information it has designated as directory information. Rather, the school may provide this notice by any means likely to inform eligible students of the types of information it has designated as directory information.

There are several other exceptions to FERPA’s prohibition against non-consensual disclosure of personally identifiable information from education records, some of which are briefly mentioned below. Under certain conditions (specified in the FERPA regulations), a school may non-consensually disclose personally identifiable information from education records:

to authorized representatives of the Comptroller General of the United States, the Attorney General of the United States, the U.S. Secretary of Education, and State and local educational authorities for audit or evaluation of Federal or State supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs;
to organizations conducting studies for or on behalf of the school making the disclosure for the purposes of administering predictive tests, administering student aid programs, or improving instruction;
to comply with a judicial order or a lawfully issued subpoena;
to the victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense concerning the final results of a disciplinary hearing with respect to the alleged crime; and
to any third party the final results of a disciplinary proceeding related to a crime of violence or non-forcible sex offense if the student who is the alleged perpetrator is found to have violated the school’s rules or policies. The disclosure of the final results only includes: the name of the alleged perpetrator, the violation committed, and any sanction imposed against the alleged perpetrator. The disclosure must not include the name of any other student, including a victim or witness, without the written consent of that other student.
As stated above, conditions specified in the FERPA regulations at 34 CFR § 99. 31 have to be met before a school may non-consensually disclose personally identifiable information from education records in connection with any of the exceptions mentioned above.

​

Annual Notification of Rights

Under FERPA, a school must annually notify eligible students in attendance of their rights under FERPA. The annual notification must include information regarding an eligible student’s right to inspect and review his or her education records, the right to seek to amend the records, the right to consent to disclosure of personally identifiable information from the records (except in certain circumstances), and the right to file a complaint with the Office regarding an alleged failure by a school to comply with FERPA. It must also inform eligible students of the school’s definitions of the terms “school official” and “legitimate educational interest.”

FERPA does not require a school to notify eligible students individually of their rights under FERPA. Rather, the school may provide the notice by any means likely to inform eligible students of their rights. Thus, the annual notification may be published by various means, including any of the following: in a schedule of classes; in a student handbook; in a calendar of school events; on the school’s website (though this should not be the exclusive means of notification); in the student newspaper; and/or posted in a central location at the school or various locations throughout the school. Additionally, some schools include their directory information notice as part of the annual notice of rights under FERPA.

​

Law Enforcement Units and Law Enforcement Unit Records

A “law enforcement unit” means any individual, office, department, division or other component of a school, such as a unit of commissioned police officers or non-commissioned security guards, that is officially authorized or designated by the school to: enforce any local, State, or Federal law, or refer to appropriate authorities a matter for enforcement of any law against any individual or organization; or to maintain the physical security and safety of the school. The law enforcement unit does not lose its status as a law enforcement unit if it also performs other, non-law enforcement functions for the school, including investigation of incidents or conduct that constitutes or leads to a disciplinary proceeding against a student.

“Law enforcement unit records” (i.e., records created by the law enforcement unit, created for a law enforcement purpose, and maintained by the law enforcement unit) are not “education records” subject to the privacy protections of FERPA. As such, the law enforcement unit may refuse to provide an eligible student with an opportunity to inspect and review law enforcement unit records, and it may disclose law enforcement unit records to third parties without the eligible student’s prior written consent. However, education records, or personally identifiable information from education records, which the school shares with the law enforcement unit do not lose their protected status as education records because they are shared with the law enforcement unit.

​

Complaints of Alleged Failures to Comply with FERPA

FERPA vests the rights it affords in the eligible student. The statute does not provide for these rights to be vested in a third party who has not suffered an alleged violation of their rights under FERPA. Thus, we require that a student have “standing,” i.e., have suffered an alleged violation of his or her rights under FERPA, in order to file a complaint.

The Office may investigate those timely complaints that contain specific allegations of fact giving reasonable cause to believe that a school has violated FERPA. A timely complaint is defined as one that is submitted to the Office within 180 days of the date that the complainant knew or reasonably should have known of the alleged violation of FERPA. Complaints that do not meet FERPA’s threshold requirement for timeliness are not investigated.

If we receive a timely complaint that contains a specific allegation of fact giving reasonable cause to believe that a school has violated FERPA, we may initiate an administrative investigation into the allegation in accordance with procedures outlined in the FERPA regulations. If a determination is made that a school violated FERPA, the school and the complainant are so advised, and the school is informed of the steps it must take to come into compliance with the law. The investigation is closed when voluntary compliance is achieved.

Please note that the eligible student should state his or her allegations as clearly and specifically as possible. To aid us in efficiently processing allegations, we ask that an eligible student only include supporting documentation that is relevant to the allegations provided. Otherwise, we may return the documentation and request clarification. This Office does not have the resources to review voluminous documents and materials to determine whether an allegation of a violation of FERPA is included. An eligible student may obtain a complaint form by calling (202) 260-3887. For administrative and privacy reasons, we do not discuss individual allegations and cases via email. Please mail completed complaint forms to the Office (address below) for review and any appropriate action.

​

Complaint Regarding Access

If an eligible student believes that a school has failed to comply with his or her request for access to education records, the student may complete a FERPA complaint form and should include the following specific information: the date of the request for access to the education records; the name of the school official to whom the request was made (a dated copy of any written request to the school should be provided, if possible); the response of the school official, if any; and the specific nature of the information requested.

​

Complaint Regarding Amendment

If an eligible student believes that a school has failed to comply with his or her request for amendment of inaccurate information in education records or failed to offer the student an opportunity for a hearing on the matter, the student may complete a FERPA complaint form and should include the following specific information: the date of the request for amendment of the education records; the name of the school official to whom the request was made (a dated copy of any written request to the school should be provided, if possible); the response of the school official, if any; the specific nature of the inaccurate information for which amendment was requested; and evidence provided to the school to support the assertion that such information is inaccurate.

​

Complaint Regarding Disclosure

If an eligible student believes that a school has improperly disclosed personally identifiable information from his or her education records to a third party, the student may complete a FERPA complaint form and should include the following specific information: the date or approximate date the alleged disclosure occurred or the date the student learned of the disclosure; the name of the school official who made the disclosure, if that is known; the third party to whom the disclosure was made; and the specific nature of the education records disclosed.

This guidance document is designed to provide eligible students with some general information regarding FERPA and their rights, and to address some of the basic questions most frequently asked by eligible students. You can review the FERPA regulations, frequently asked questions, significant opinions of the Office, and other information regarding FERPA at our Website as follows: www.ed.gov/policy/gen/guid/fpco/index.html

​

If, after reading this guidance document, you have questions regarding FERPA which are not addressed here, you may write to the Office at the following address:

​

Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202-8520