Protect student records and prove FERPA compliance with confidence

FERPA is the Family Educational Rights and Privacy Act of 1974, a US federal law that protects the privacy of student education records. It gives parents, and students once they turn 18 or attend a postsecondary institution, the right to inspect and seek amendment of those records, and it limits disclosure of personally identifiable information without written consent. The rules are set out in 20 U.S.C. § 1232g and 34 CFR Part 99.

FERPA applies to educational agencies and institutions that receive funds under programmes administered by the US Department of Education, which covers most public schools, school districts and colleges, and many private universities. Edtech vendors and other third parties are bound indirectly when schools share records with them, typically under the school official exception, which requires the school to keep direct control over how the vendor uses and maintains the data.

FERPA has no fixed fines. The Department of Education can withhold payments, issue a cease and desist order or terminate a school's eligibility for Department funding, although termination is used only where compliance cannot be secured voluntarily. If a third party improperly rediscloses education records, the school must deny that third party access to records for at least five years.

Yes, indirectly. Schools may share education records with a vendor without consent when the vendor performs a service the school would otherwise do itself, has a legitimate educational interest, is under the school's direct control for the use and maintenance of records, and does not redisclose the data. Schools usually enforce this through contracts, so vendors are asked to prove their data handling and security in procurement.

FERPA compliance means publishing an annual notification of rights, answering access requests within 45 days, operating a fair process for amendment requests and hearings, getting written consent before disclosures unless an exception applies, keeping a record of disclosures, and defining directory information with an opt-out. In practice this needs strong access controls, vendor contracts and documented security over the systems that hold student records.

FERPA is a US education privacy law, while GDPR is a broad EU data protection law covering all personal data, so an institution or vendor with EU students may need to meet both. SOC 2 and ISO 27001 are security frameworks rather than legal requirements, but vendors often use them to show schools that student data is protected. Controls such as access management and logging overlap across all of them.

No. The Department of Education does not certify schools or vendors as FERPA compliant, and there is no official FERPA audit or seal. Compliance is shown through policies, contracts, records of disclosures and security controls, and is tested when parents or eligible students complain to the Student Privacy Policy Office. Vendors often support their FERPA position with a SOC 2 report or ISO 27001 certificate.

Yes. FERPA is supported in OneClickComply today. The same controls you use for ISO 27001, SOC 2 or GDPR are mapped to FERPA obligations, so evidence collected once counts towards each standard. OneClickComply does not certify FERPA compliance, and our auditors can advise on your approach.