The Family Educational Rights and Privacy Act (FERPA) is a federal law enacted in 1974 that protects the privacy of student education records. Administered by the U.S. Department of Education, FERPA applies to all educational institutions that receive federal funding, covering virtually every public school and most colleges and universities in the United States. The law gives parents and eligible students (those 18 or older or attending postsecondary institutions) the right to access their education records, request corrections, and control the disclosure of personally identifiable information from those records.
FERPA prohibits educational institutions from disclosing personally identifiable information from education records without written consent of the parent or eligible student, with specific exceptions. Permitted disclosures without consent include sharing with school officials with legitimate educational interest, transfer to other schools, certain auditing and evaluation purposes, financial aid processing, and compliance with judicial orders. Institutions may disclose 'directory information' such as name and enrollment status if they have given public notice and allowed opt-out. FERPA requires institutions to maintain access controls on student records, train staff on privacy requirements, document all disclosures, and provide annual notification of rights. The law covers both physical and electronic records, including data in student information systems, learning management systems, and cloud services used by the institution.
Violations of FERPA can result in the withdrawal of federal funding, a severe consequence for any educational institution. The Department of Education's Student Privacy Policy Office investigates complaints and can require corrective action. With the rapid adoption of educational technology, institutions must ensure that vendors handling student data comply with FERPA through proper agreements. Cybersecurity teams in education must implement access controls, encryption, and data governance programs to protect student records across increasingly complex digital environments.