Family Educational Rights and Privacy Act (FERPA) Resources

The MACRAO Registrars Practices Committee regularly reviews the requirements of the federal Family Educational Rights and Privacy Act (FERPA) and makes recommendations for best practices to MACRAO members. These guidelines are based on the work of the American Association of Collegiate Registrars and Admissions Officers (AACRAO) and are endorsed by the committee.

AACRAO's website includes additional information on the subject and is highly recommended.

The following information is not intended to be legal advice; please refer to your institution's legal counsel for specific advice regarding FERPA requirements and implementation.

What is FERPA?

The Family Educational Rights and Privacy Act of 1974, was established to protect the rights of students and to ensure the privacy and accuracy of education records. The Act applies to all educational institutions that are recipients of federal funding.

Who is protected under FERPA?

FERPA protects the education records of students who are currently enrolled or formerly enrolled regardless of their age or status with regard to parental dependency. The education records of students who have applied to but have not attended an institution are not subject to FERPA guidelines, nor are deceased students.

What are "educational records?"

Any record which contains information that is personally identifiable to a student and is maintained by the institution or by a party acting for the institution. Education records include any records in whatever medium (e.g. handwriting, print, tapes, film, microfilm, microfiche, any form of electronic data storage including emails) that are in the possession of any school official. This includes transcripts or other records obtained from a school in which a student was previously enrolled.

What is not considered to be an educational record?

  • “Sole possession notes”
  • Law enforcement unit records
  • Records maintained exclusively for individuals in their capacity as employees
  • Medical and treatment records
  • Alumni records
  • Employment records (unless the employment is based on student status); the employment records of student employees (e.g. work-study, graduate teaching assistants) are part of their education records.

Do students have the right to inspect and review their education records?

Students have the right to see everything in their “education record,” except:

  • information about other students;
  • financial records of parents; and
  • confidential letters of recommendation if they waived their right of access.

FERPA does not prescribe what records are created or how long they are to be kept; however, institutions cannot destroy a record if there is a request to inspect and review.

What is “personally identifiable” information?

“Personally identifiable” includes more than just a student’s name; it includes a “personal identifier” such as a social security number. FERPA provides the following guidelines to determine what is personally identifiable.

  • The name of the student, the student’s parent, or other family members
  • The student’s campus or home address
  • A personal identifier (such as a social security number or student number)
  • A list of personal characteristics or other information which would make the student’s identity known with “reasonable certainty”

What constitutes “legitimate educational interest?”

The demonstrated “need to know” by those officials of an institution who act in the student’s educational interest, including faculty, administration, clerical and professional employees, and other persons who manage student record information including student employees or agents.

What is directory information?

Data elements that are generally not considered harmful or an invasion of privacy if publicly available. Every student must be given the opportunity to have directory information suppressed from public release.

Institutions may disclose what it has defined as directory information on a student without violating FERPA. Common examples include: name, address, email address, telephone number, date and place of birth, photograph, academic programs of study, enrollment status, dates of attendance, class or level, participation in officially recognized activities and sports, weight and height of members of athletic teams, degrees, honors, and awards received, and the most recent educational agency or institution attended.

Directory information cannot include: race, gender, SSN (or part of a SSN), grades, GPA, country of citizenship, or religion.

A student ID number can be considered directory information only if it cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user’s identity, such as a personal identification number (PIN), password, or other factor known or possessed only by the authorized user.

MACRAO recommends institutions discuss their definitions of directory information with their legal counsel.

When do you need consent to disclose non-directory information from an education record (including transcripts)?

A student must provide written consent before an institution may disclose personally identifiable information from their education records (except as otherwise allowed under FERPA). Such written consent must:

  • specify the records to be released;
  • state the purpose of disclosure; and
  • identify the party or class of parties to whom the disclosure may be made.

When must an institution disclose information without a student’s written consent?

When the disclosure is to:

  • the student; or
  • a person in response to a lawfully issued subpoena or court order, as long as the University makes a reasonable attempt to notify the student first.

When may an institution disclose information without a student’s consent?

When the disclosure is (one or more of the following):
  • To school officials (defined in policy) who have a legitimate educational interest.
  • To federal, state and local authorities involving an audit or evaluation of compliance with educational programs.
  • In connection with financial aid; this includes Veterans’ benefits.
  • To organizations conducting studies for or on behalf of educational institutions.
  • To accrediting organizations.
  • To parents of a dependent student (as defined by Internal Revenue Code).
  • To parents of a student under 21 years of age regarding violation of any law or institutional policy governing the use of alcohol or a controlled substance.
  • To comply with a judicial order or subpoena.
  • In a health or safety emergency.
  • Releasing directory information.
  • Releasing the results of a disciplinary hearing to an alleged victim of a crime of violence.

What is required for annual notification?

Institutions must provide annual notification to students of their rights to:

  • inspect and review their education records;
  • request an amendment to their education records;
  • a hearing if the request for an amendment is unsatisfactory;
  • request that the institution not disclose their directory information items; and
  • file a complaint with the U.S. Department of Education.

Institutions must also notify students annually of the following:

  1. That school officials within the institution may obtain information from education records without obtaining prior written consent,
  2. The criteria for determining who will be considered school officials, and
  3. What legitimate educational interest will entitle school officials to have access to education records.

Additional Information

If you still have questions, please contact:

Family Policy Compliance Office
U.S. Department of Education
(855) 249-3072
[email protected]

Additional information regarding FERPA regulations and history can also be found at the following link:


Updated 10/15/2021.