The Family Educational Rights and Privacy Act (FERPA) is a U.S. federal law that protects the privacy of student educational records.


FERPA applies to all schools that receive funds under an applicable program of the U.S. Department of Education.


FERPA limits the ability of schools to disclose student educational records, including grades and behavior, without student consent. Under FERPA, students have the right to:

  1. Control the disclosure of their education records to third parties;
  2. Review and amend their educational records;
  3. Receive an annual notice of their rights under FERPA; and
  4. File complaints with the U.S. Department of Education.

Educational records includes a broad range of personally identifiable information related to the student and retained by the school or a third party on behalf of the school, and may include records in the form of handwriting, print, computer media, film, and video and audio tape.

Under FERPA, personally identifiable information includes information that identifies or is identifiable to a student, including student name, parent/guardian names, address, SSN, and date of birth, as well as other information that, alone or in combination, would allow the student to reasonably be identified.

Compliance Tip: Disclosure of school “Directory Information” is permitted under FERPA so long as its disclosure would not, in general, be considered an invasion of privacy. However, before a school may publish directory information, it must provide a student the opportunity to opt-out of publishing of the information.

Consent obtained for the disclosure of student records must be signed in writing and dated by the student and include the records to be disclosed, the purpose of the disclosure, and to whom the disclosure is being made.

Exceptions to FERPA’s consent requirement include disclosures of student records to school officials for “legitimate educational interests,” and for purposes related to enrollment and transfer, financial aid, improving school instruction and predictive testing, school accreditation, sexual offenses, law enforcement matters, and for reasons of health and safety. However, a school is obligated to use reasonable measure to verify the party to whom the records will be disclosed.

Schools must fulfill student requests to review their educational records within 45 days and must use reasonable measures to verify the student’s identity prior to fulfilling the request. A student’s right to review their records does not apply to records of their parents’ financial information, law enforcement records, treatment records, or attorney-client privileged information.

Students have the right to request changes to their records for the purposes of correcting inaccuracies. If such a request is denied, the student is entitled to a hearing whereby:

  • Prior reasonable notice must be given to the student as to time and place of the hearing
  • The hearing must be held within a reasonable time of the denied request
  • The hearing must be conducted by a disinterested party
  • The student must be afforded a full and fair opportunity to present their case, and
  • The decision must be based on the evidence presented and delivered, in writing, within a reasonable time

If the hearing affirms the student’s request, the records must be so amended.

Compliance Tip: The Protection of Pupil Rights Amendment (PPRA), as expanded by the The No Child Left Behind Act of 2001, restricts the ability of schools to collect and sell student information and survey data (e.g. demographic information) for commercial purposes, including information pertaining to a student’s parents/guardians.


FERPA is enforced by the U.S. Department of Education. Students and their families may file complaints to the Department for investigation.


The Department of Education can issue fines from a minimum of $100 to a maximum of $1.5M for FERPA violations.