FERPA Compliance Guide (2026): Student Records, Vendors and Enforcement

Who it applies to

• Covered institutions. Part 99 applies to an educational agency or institution "to which funds have been made available under any program administered by the Secretary" that provides educational services or instruction, or that directs and controls public schools (§ 99.1). That covers most public K-12 districts and most colleges and universities, through federal student aid.
• Not covered by benefits alone. An institution isn't covered just because its students receive non-monetary benefits under a program.
• Vendors, contractors and EdTech. These aren't regulated directly. They're bound through school-official status and redisclosure limits, and can be barred for violations, as described below.

Key requirements

Rights of parents and eligible students

• Inspect and review. The school must comply within 45 days of a request, respond to reasonable requests for explanations, and not destroy records while a request is outstanding (§ 99.10).
• Amendment and hearing (§§ 99.20–99.22). Parents and eligible students can ask for records they believe are inaccurate or misleading to be amended, with a right to a hearing.
• Consent before disclosure (§ 99.30). This applies unless an exception in § 99.31 applies.

Annual notification (§ 99.7)

Each year, notify parents and eligible students in attendance of their rights:

• to inspect and review records
• to seek amendment
• to consent to disclosures
• to file a complaint with the Department

The notice must also state the criteria for who counts as a school official and what makes a legitimate educational interest. It must effectively reach parents with disabilities and, at K-12 level, parents whose home language isn't English (§ 99.7).

Disclosure without consent (§ 99.31)

The exceptions include:

• school officials with legitimate educational interests
• schools where the student seeks to enroll
• authorized federal and state education authorities
• financial aid
• health or safety emergencies (§ 99.36)
• others

The vendor rule. A contractor, consultant, volunteer or other outsourced party may be treated as a school official only if it meets all three conditions:

1. it performs a function the institution would otherwise use employees for
2. it is under the institution's direct control with respect to the use and maintenance of records
3. it is subject to the redisclosure limits in § 99.33(a)

Institutions must use "reasonable methods", whether physical, technological or administrative, to make sure officials access only the records in which they have a legitimate interest (§ 99.31).

Directory information (§ 99.37)

Before disclosing directory information, a school must give public notice of:

• the types of information it has designated as directory information
• the right to opt out
• the deadline for opting out

An opt-out made while the student was in attendance must still be honored after the student leaves.

Recordkeeping (§ 99.32)

• Disclosure log. Keep a record of each request for, and each disclosure of, PII. Keep it with the student's records for as long as those records exist.
• Health and safety disclosures. For these, also record the "articulable and significant threat" and who received the information (§ 99.32).

Enforcement and penalties

• Complaints must be filed within 180 days of the alleged violation, or of when the complainant knew of it. The SPPO can extend this for good cause or investigate on its own initiative (§ 99.64).
• Penalties for institutions. If an institution doesn't comply voluntarily, the Secretary may withhold payments, issue a cease-and-desist complaint, or terminate eligibility for funding (§ 99.67).
• Penalties for vendors. A third party that improperly rediscloses PII can be denied access to PII from education records for at least five years (34 CFR 99.67).

2026 enforcement climate

On 26 August 2026, the SPPO issued a Dear Colleague Letter to federally funded state and local agencies (ED). It reminded them:

• that parents must be allowed to review their children's records
• that failing to comply can mean losing federal funding

The Department also said it had opened statewide investigations, issued a FERPA finding against a state education department, and partnered with DOJ in June 2026 to coordinate enforcement. For PPRA surveys, the letter clarified that an opt-out policy isn't enough where written parental consent is required.

Certification

There's no FERPA certification. Schools usually assess vendors through contract terms and security questionnaires. FERPA doesn't prescribe specific technical controls.

Mapping to related frameworks

• PPRA: protects students in surveys and evaluations, and is enforced alongside FERPA by the SPPO.
• HIPAA: records covered by FERPA are generally excluded from HIPAA. See the AssureCore HIPAA guide.
• SOC 2 / ISO 27001: common vendor assurance evidence for showing "reasonable methods" of access control.
• NIST Privacy Framework: useful for building a student-data governance program.

Readiness checklist

1. Confirm that you're covered, i.e. that you receive Department of Education program funds.
2. Inventory education records and the systems that hold PII, including EdTech tools.
3. Publish an annual notice that includes the school-official and legitimate-interest criteria.
4. Designate the directory information categories and run the opt-out process.
5. Put contracts with every vendor relying on the school-official exception: direct control, use limits and redisclosure bans.
6. Apply role-based access so officials see only the records they need.
7. Maintain disclosure logs, including the basis for any health or safety disclosure.
8. Build a workflow for inspection and amendment requests, tracked against the 45-day deadline.
9. Review PPRA survey consent practices against the 2026 guidance.

Common pitfalls

• Treating a click-through EdTech agreement as enough to make the vendor a school official.
• Leaving the school-official criteria out of the annual notice.
• Missing the 45-day access deadline.
• Keeping records outside the main system and not producing them on request.
• Relying on opt-out where PPRA requires written consent.

How AssureCore helps

• The Controls Register documents access controls and vendor obligations.
• Evidence Management (control linking, expiry alerts) keeps vendor contracts and annual notices current.
• Policy Management drafts FERPA policies.
• Audit Reports (PDF/CSV) support reviews.

Frequently asked questions

Official references

• US Department of Education – What is FERPA?
• US Department of Education – FERPA regulations page
• eCFR – 34 CFR Part 99
• US Department of Education – Reminds Schools of Obligation to Comply (26 Aug 2026)

Related frameworks

• GDPR guide
• UK GDPR guide
• CCPA guide
• HIPAA guide