FERPA Rights and School Record Privacy
A clear guide to student record access, disclosure limits, and school privacy rules.
The Family Educational Rights and Privacy Act, usually called FERPA, is the federal law that governs who can see a student’s education records and when those records may be shared. It gives parents access to certain records while children are in school and transfers those rights to the student once the student becomes an eligible student, usually at age 18 or when attending college. Schools that receive federal education funds must follow these rules, and the law is designed to balance access to records with protection against unnecessary disclosure of personal information.
FERPA matters because schools keep a wide range of information about students, including grades, disciplinary files, schedules, and other records that can affect educational decisions. The law does not make all student information secret, but it does establish rules for inspection, amendment, and disclosure. In practice, FERPA tells schools when they must ask for written permission, when they may release information without consent, and how parents and students can challenge inaccurate records.
What FERPA Covers
FERPA applies to educational agencies and institutions that receive funds under programs administered by the U.S. Department of Education. That includes many public and private elementary schools, secondary schools, colleges, and universities, as long as they receive covered federal funds. The law is aimed at records maintained by the school and used in connection with the student’s education.
Liquor License Application Process Explained >
Not every note or document connected to a student is automatically a FERPA record. The core focus is on education records kept by the institution, especially records maintained in a systematic way by school officials. This distinction matters because FERPA regulates disclosure of records held by the school, not every piece of information that any staff member might know about a student.
Who Has Rights Under the Law
Before a student becomes an eligible student, parents generally hold the FERPA rights to inspect records and consent to many disclosures. Once the student turns 18 or enrolls in a postsecondary institution, those rights transfer to the student. At that point, the student becomes the person who can authorize disclosure, request amendments, and file complaints if the school does not comply.
Some schools also recognize special categories of students, such as high school students who are concurrently enrolled in college courses, as eligible students under the applicable rules. The result is that the right holder may change even before the student reaches the traditional college age.
Key Rights FERPA Gives Students and Parents
FERPA creates several important rights. These rights are not abstract promises; they are operational duties that schools must follow when handling records requests and disclosure decisions.
- Inspection and review: Parents and eligible students may inspect and review education records maintained by the school.
- Request for amendment: They may ask the school to correct records they believe are inaccurate, misleading, or otherwise in violation of privacy rights.
- Control of disclosure: Schools generally must obtain written consent before releasing personally identifiable information from education records.
- Complaint rights: If a school fails to comply, the parent or student may file a complaint with the U.S. Department of Education.
These rights are intended to ensure both transparency and fairness. A family should be able to see what the school is relying on, and the student should not be harmed by records that are outdated, incomplete, or misleading.
How Record Inspection Works
When a parent or eligible student asks to inspect records, the school must respond within a reasonable time, and federal guidance says the school should generally provide access within 45 days of receiving the request. Schools typically arrange a time and place for inspection rather than handing over everything immediately.
Schools do not always have to provide copies. If the parent or student can review the original records at the school, that may satisfy the law. However, if the person requesting access cannot reasonably inspect the originals in person, the school may need to provide copies or otherwise make access practical.
In a typical FERPA process, the requester identifies the specific records sought and submits the request to the appropriate school official. The school then confirms access arrangements, reviews whether any records are excluded from disclosure, and provides the inspection opportunity.
When a Student Can Ask for Corrections
FERPA does not guarantee that a school will change a record just because a parent or student disagrees with it. What it does guarantee is the chance to request amendment and, if the school refuses, to challenge the decision through a formal process. The law is especially concerned with records that are inaccurate or misleading, because those records can affect grades, discipline, enrollment, scholarships, and future opportunities.
If the school declines to revise a record, the parent or eligible student can usually ask for a hearing. If the school still refuses to change the record, the requester may be allowed to place a written statement in the file explaining the disagreement. That way, future readers of the record can see that the information is disputed.
Consent Rules and Disclosure Limits
FERPA’s default rule is simple: schools need written consent before they disclose personally identifiable information from a student’s education records. The consent should identify the records, explain why disclosure is being made, and specify who may receive the information.
This rule covers a wide range of information that could identify the student directly or indirectly. It also means schools must think carefully before giving records to outside parties, including employers, media outlets, private organizations, and even other individuals in some situations.
The practical effect is that students and parents should not assume a school can freely share grades, transcripts, disciplinary information, or other record data. In most cases, consent is required unless a specific exception applies.
Common Exceptions Schools Rely On
FERPA includes several exceptions that allow disclosure without consent. These exceptions are important because schools regularly need to share records for legitimate educational, administrative, and safety reasons.
| Exception | Typical use |
|---|---|
| School officials with legitimate educational interest | Permits internal access for staff who need the information to do their jobs. |
| Transfer schools | Allows sharing when a student enrolls or plans to enroll elsewhere. |
| Financial aid purposes | Permits disclosure to administer grants, loans, or other aid. |
| Audits and evaluations | Allows officials to review records for compliance and program assessment. |
| Health or safety emergencies | Permits disclosure when necessary to protect students or others. |
| Judicial orders or subpoenas | Allows disclosure when required by legal process. |
Other exceptions may cover studies for educational institutions, accrediting organizations, and certain juvenile justice disclosures under state law. The key point is that each exception has limits, and schools should not treat them as a blanket permission to release information whenever it is convenient.
Directory Information and Why It Matters
Some student information is treated as directory information, which means a school may release it unless the student or parent has opted out where permitted. Directory information often includes items such as a student’s name, address, phone number, date of birth, major, participation in activities, and similar non-sensitive details, depending on the school’s policy. Even so, schools must still give notice about what counts as directory information and how a person can request nondisclosure.
Because directory information can look harmless at first glance, families sometimes overlook it. But in combination, seemingly small details may reveal a lot about a student’s location, schedule, or personal situation. That is why schools should clearly explain their directory-information policy and should honor opt-out requests when applicable.
Health and Safety Disclosures
One of the most important exceptions under FERPA involves health or safety emergencies. In these situations, a school may disclose information to appropriate parties if the information is needed to protect students or other individuals. Federal guidance recognizes that schools must be able to act quickly during emergencies, including public health events, threats of violence, or other urgent risks.
This exception is narrower than a general “best interests” standard. A school should still connect the disclosure to the specific emergency and the need to protect health or safety. Once the emergency passes, the ordinary consent rules generally return.
What FERPA Does Not Do
FERPA is often described broadly as a student privacy law, but it has clear boundaries. It does not forbid all discussion of students, and it does not prevent schools from collecting information they need for educational purposes. It also does not create a private damages action in the same way some other laws do; enforcement is generally handled through the Department of Education’s administrative process.
FERPA also does not cover information that is not maintained as an education record by the institution. That distinction is especially important for informal notes, personal observations, or records that are not centrally maintained in the way the law contemplates. Because of this, the exact status of a document can matter a great deal in a privacy dispute.
Best Practices for Families and Students
Families can take a few practical steps to make FERPA work in their favor. The law gives people rights, but those rights are most useful when families know how to use them.
- Keep copies of every written request sent to the school.
- Identify records as specifically as possible when asking to inspect or amend them.
- Ask the school to explain its directory-information policy and any opt-out deadline.
- Review records early if a student is approaching age 18 or college enrollment.
- Use written consent carefully and limit it to the records and recipients that are truly necessary.
Schools are more likely to respond efficiently when requests are clear and documented. Parents and students are also better positioned to resolve disputes when they understand which right they are invoking: access, amendment, consent, or complaint.
Frequently Asked Questions
Can a school refuse to show records to a parent? In general, no, if the parent still holds FERPA rights and the records are covered education records. Once rights transfer to an eligible student, the student controls access instead.
Does FERPA require a school to change a record? Not automatically. It requires the school to consider a request to amend and to provide a process for challenging a refusal.
Can a school share records with another school? Yes, in many cases, especially when a student is transferring or enrolling elsewhere.
Are teachers’ personal notes covered? Not always. FERPA generally applies to records maintained by the institution as education records, so informal or isolated notes may fall outside the law depending on how they are kept and used.
What happens if a school violates FERPA? The usual remedy is an administrative complaint through the Department of Education, not a direct lawsuit for money damages under the statute itself.
Why FERPA Still Matters Today
FERPA was created in an era of paper files, but its core principles remain highly relevant in digital schools, cloud-based student systems, and data-sharing networks. Schools now manage far more information than they did when the law was enacted, which makes clear rules about consent, access, and disclosure even more important. The same basic balance still applies: students and parents need meaningful access to records, and schools need defined limits on when they can share them.
For families, the best approach is to treat FERPA as an active privacy tool rather than a technical statute hidden in the background. When parents and students know their rights, they can protect sensitive information, correct mistakes before they cause harm, and make better decisions about how schools handle their records.
References
- Family Educational Rights and Privacy Act (FERPA) — Epic.org. n.d. https://epic.org/family-educational-rights-and-privacy-act-ferpa/
- FERPA | Protecting Student Privacy — U.S. Department of Education. n.d. https://studentprivacy.ed.gov/ferpa
- Family Educational Rights and Privacy Act (FERPA) — Centers for Disease Control and Prevention. n.d. https://www.cdc.gov/phlp/php/resources/family-educational-rights-and-privacy-act-ferpa.html
- Family Educational Rights and Privacy Act — Network for Public Health Law. 2020-01. https://www.networkforphl.org/wp-content/uploads/2020/01/Snapshot-FERPA_final1.pdf
- Family Educational Rights and Privacy Act (FERPA) — Student Press Law Center. n.d. https://splc.org/ferpa-what-it-means-and-how-it-works/
- Family Educational Rights and Privacy Act (FERPA) — The New School. n.d. https://catalog.newschool.edu/registration-and-records/family-educational-rights-and-privacy-act-ferpa
Similar Articles
Read full bio of Sneha Tete
