← Global Privacy Laws Research Library
34 CFR Part 99; 20 U.S.C. 1232g
FERPA Regulations - Family Educational Rights and Privacy
Prepared by Shubhank Suman · Last reviewed
Status not verified beyond supplied text
- Legal character
- Federal regulation
- Region
- North America
What it covers
Education-record privacy at covered educational agencies and institutions receiving funds under programmes administered by the Secretary. Establishes rights, annual notification, inspection/review, amendment/hearing procedures, consent, disclosure exceptions, redisclosure limits and enforcement.
Why it matters
Determines when student-record services and outsourced institutional functions can receive information. The school-official exception requires direct institutional control and legitimate educational interests; it does not authorise unrestricted vendor AI training.
Refer to it when
Research student records, parent/eligible-student requests, educational service providers, studies, directory information or emergency disclosures.
AI, privacy and cybersecurity relevance
- AI: Moderate
- Privacy: Very High
- Cyber: Moderate
AI
MODERATE RELEVANCE
Student-record AI tools must fit disclosure purposes and provider conditions; no general AI framework.
Privacy
VERY HIGH RELEVANCE
Student-record access, consent, disclosure and amendment.
Cybersecurity
MODERATE RELEVANCE
Access/use controls, not a detailed technical-security standard.
Applicability
Educational agencies/institutions meeting § 99.1 funding and function tests and relevant recipients of education-record information; not every school or education app automatically.
Read first
§§ 99.1, .3, .5, .7 → .10 → .30-.37 → .60-.67.
Provisions / sections covered
§§ 99.1-.8 - Scope and rights
Education records and exclusions are defined in § 99.3. Rights generally transfer at age 18 or attendance at a postsecondary institution. Annual notification and law-enforcement-record boundaries apply.
§§ 99.10-.22 - Access and amendment
Inspection/review within a reasonable time, not exceeding 45 days, with specified limitations. Amendment, hearing and disagreement procedures address inaccurate, misleading or privacy-violating records.
§§ 99.30-.35 - Disclosure and redisclosure
Consent must identify records, purpose and recipients. Enumerated exceptions, contractor direct-control conditions, disclosure records, redisclosure restrictions and study/audit safeguards must be checked.
§§ 99.36-.37 - Emergency and directory information
Emergency disclosure requires an articulable and significant threat; directory information requires designation, notice and an opportunity to opt out.
§§ 99.60-.67 and Appendix A - Enforcement
Complaint investigation and enforcement procedures; complaints ordinarily within 180 days, with good-cause extension. Appendix A defines crimes of violence.
Subject-matter tags
- Consent
- Enforcement and penalties
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
- Children’s Online Privacy Protection Rule (COPPA Rule)Regulation · Status not verifiedSeparate under-13 online-operator regime; coverage must be assessed independently.
- HIPAA: United StatesLaw · Current (amended)Health/education record boundary; the regimes are not interchangeable.
- Washington My Health My Data ActLaw · Status not verifiedWashington’s health-data law expressly addresses FERPA-governed information in its exemptions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.