FERPA: Education Data Privacy Compliance Guide

The Family Educational Rights and Privacy Act (FERPA) is the foundational US federal law governing the privacy of student education records. Applicable to all educational institutions receiving federal funding — from kindergartens to universities — FERPA grants parents and eligible students rights over education records and restricts how institutions can disclose student information.

What FERPA Covers

FERPA establishes rights in two key areas. First, it grants parents (and students over 18 or in postsecondary education) the right to inspect and review education records, request amendments to inaccurate records, and have some control over the disclosure of personally identifiable information (PII) from education records.

Second, FERPA restricts institutional disclosure of education records without written consent, subject to specific exceptions. Key exceptions include disclosures to school officials with legitimate educational interest, disclosures to other schools where a student is transferring, disclosures for financial aid purposes, and disclosures to authorized representatives for audit or evaluation purposes. Directory information (name, address, phone number) may be disclosed without consent if proper notice and opt-out procedures are followed.

Who Needs FERPA Compliance

FERPA applies to all educational institutions receiving funding from the US Department of Education — virtually all public schools and most private institutions. EdTech vendors do not have direct FERPA obligations but must support their institutional customers' compliance through appropriate data handling practices, contracts designating them as school officials, and security controls proportionate to the sensitivity of education records they process.

Implementation Approach

For institutions, develop annual FERPA notification procedures, establish consent and disclosure policies, define directory information categories with opt-out mechanisms, and train staff on permissible disclosures. For EdTech vendors, implement data handling policies aligned with FERPA, ensure contracts include appropriate provisions, implement security controls for education records, and limit data use to the purposes specified by the institution.

Cost Considerations

Institutional FERPA compliance costs $10,000 to $40,000 including policy development, training, and systems for managing consent and disclosures. EdTech vendors typically invest $15,000 to $75,000 for privacy program development, contract templates, and security controls. While FERPA penalties do not include fines, non-compliance can result in loss of federal funding — a potentially catastrophic consequence for educational institutions.