Documentation / Platform glossary / FERPA
FERPA — the Family Educational Rights and Privacy Act — is the United States federal law governing student education records. It gives students and parents rights of access and correction, and it restricts when an institution may disclose those records without written consent. It applies to institutions receiving federal education funding.
FERPA is built around a single protected category: the education record, meaning records maintained by an institution that directly relate to an identified student. Grades, transcripts, enrolment history, and disciplinary records are the familiar examples.
The law grants rights rather than only imposing duties. Eligible students and parents may inspect their records, request correction of information they believe is inaccurate, and control disclosure to third parties. Rights transfer from parent to student at eighteen or on enrolment in a post-secondary institution.
Disclosure is the part that shapes system design. The default is that disclosure requires written consent, subject to enumerated exceptions. Two recur in technology contexts. Directory information — categories an institution has designated as disclosable, such as name or enrolment status — may be released unless the student has opted out. The school official exception permits disclosure to parties performing institutional functions who have a legitimate educational interest, which is the basis on which institutions engage service providers, typically under contractual terms constraining use and onward disclosure.
Because FERPA attaches to the institution, a vendor's obligations are generally established by that contract rather than arising directly from the statute.
Any system handling student data inherits questions about scope, retention, and onward disclosure. What is stored, how long it persists, who may query it, and whether it leaves the institution's control are the questions that follow from FERPA's structure, and they are architectural decisions rather than contractual afterthoughts.
Education records also frequently sit alongside employment data — in tuition assistance and workforce education programs especially — where more than one privacy regime may apply to the same person at the same time.
QueryTek documents FERPA as privacy literacy for teams evaluating systems that touch education data, so the right questions about record scope, retention, and disclosure are asked during diligence. Whether and how a specific regime applies to an organization is a determination for that organization and its advisers. QueryTek EBM, the education benefits product, is in active development and not generally available.
Disclaimer: The information presented in this article is for general informational and educational purposes only and should not be construed as legal, regulatory, privacy, or compliance advice. The Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99) applies to educational agencies and institutions subject to it, and its application depends on institutional status, the nature of the records at issue, and the terms of any service agreement in place. State education privacy statutes, sector-specific rules, and other privacy regimes may impose additional or differing obligations on the same data. This content may not reflect the most current regulatory guidance or interpretation. Organizations should seek tailored advice from qualified legal or privacy professionals before determining how FERPA or any related requirement applies to their records, systems, or vendor relationships. Publication of this material does not establish an attorney-client, fiduciary, or professional advisory relationship.
