If you sell software to schools, someone in procurement will ask whether you are "FERPA compliant". It is a reasonable question with an awkward answer: FERPA does not regulate you directly. It regulates the school.
That does not make it irrelevant to you. FERPA governs when a school may disclose student information to you, and it sets conditions on what you may do with that information once you have it. Schools pass those conditions to you through contracts, and they lose the ability to work with vendors that mishandle student data.
This article covers who FERPA applies to, what counts as an education record, the routes by which a vendor lawfully receives student data, and the controls that let you answer the procurement question honestly. FERPA interpretation can be fact-specific, so confirm your position with counsel.
Who FERPA actually applies to
The Family Educational Rights and Privacy Act is a federal law at 20 U.S.C. § 1232g. Its regulations are at 34 CFR Part 99. It applies to educational agencies and institutions that receive funds under programs administered by the U.S. Department of Education. In practice, that covers most public K-12 districts and schools, and most colleges and universities. Private K-12 schools generally do not receive such funds and so generally fall outside it, though you should confirm for any specific school.
FERPA gives parents rights over their children's education records. Those rights transfer to the student at 18 or on attending a postsecondary institution, at which point the student is an "eligible student". The core rights are:
To inspect and review education records, with the school responding within a reasonable period and no more than 45 days after the request
To seek amendment of records believed to be inaccurate or misleading
To consent before personally identifiable information from education records is disclosed, unless an exception applies
The Department of Education's Student Privacy Policy Office administers the law. Its ultimate enforcement lever is the school's federal funding, which is why schools take vendor risk seriously even though the vendor is not the regulated party.
What counts as an education record
Under 34 CFR § 99.3, education records are records that are directly related to a student and maintained by an educational agency or institution, or by a party acting for it.
That last clause is the one that matters to you. If your platform holds records directly related to students on the school's behalf, those records can be education records even though they sit in your database. Gradebooks, assignment submissions, attendance, behavior notes, assessment results, and learning platform activity tied to a student are all candidates.
The regulation also defines personally identifiable information broadly. It includes direct identifiers such as name and student ID, indirect identifiers such as date of birth, and other information that, alone or in combination, would let a reasonable person in the school community identify the student with reasonable certainty. Removing names does not by itself de-identify a dataset of small classes or rare characteristics.
There are exclusions, including certain sole-possession notes kept by individual staff, law enforcement unit records, and some employment and treatment records. They rarely apply to a vendor's core product.
How a vendor lawfully receives student data
A school may disclose PII from education records only with consent or under an exception in 34 CFR § 99.31. Four routes come up for vendors.
Prior written consent
The parent or eligible student consents in writing to the specific disclosure. This is workable for optional services but impractical for a platform the whole school uses.
The school official exception
This is the route most EdTech vendors rely on. A school may treat a contractor as a school official if the contractor performs a service the school would otherwise use employees for, is under the school's direct control with respect to the use and maintenance of education records, and is bound by the regulation's limits on use and redisclosure. The conditions are specific, and a separate article in this series covers them in detail.
Directory information
A school may disclose information it has designated as directory information, such as name or grade level, if it has given public notice and an opportunity to opt out. Directory information cannot include a Social Security number. Relying on it alone is fragile, because families who opted out must be excluded and the designation varies by school.
Studies and audit or evaluation
Separate exceptions permit disclosure to organizations conducting certain studies for or on behalf of schools, and to authorized representatives of education authorities for audit or evaluation of education programs. Both require a written agreement with specified terms. They fit research and evaluation work more than ordinary product use.
What schools will ask you to commit to
Whichever route applies, schools will put the conditions in writing. Expect commitments along these lines:
Use student data only for the services the school contracted for
Do not redisclose PII to other parties without authorization, and flow the same restriction to your subprocessors
Do not use student data for targeted advertising or to build profiles for purposes unrelated to the service
Support the school when a parent or eligible student asks to inspect or amend records, typically by routing the request to the school
Return or delete data at the end of the contract, and confirm it in writing
Maintain reasonable security safeguards and notify the school of a breach within an agreed period
Most of these come from FERPA's conditions, from state student privacy laws, or from district policy. A security questionnaire will often test the same commitments. Our guide to handling an enterprise security review applies here with little adjustment.
The controls that make those commitments true
A procurement answer is only as good as the controls behind it. Before you sign, check you can produce evidence for each of these.
- Not done:
Data inventory by tenant. You know which data elements you hold for each school, where they are stored, and why.
- Not done:
Purpose limitation in practice. Student data does not flow into marketing, advertising, or unrelated analytics systems. Show the data flow, not only the policy.
- Not done:
Access control. Staff access to student data is limited to roles that need it and reviewed on a schedule. Our guide to least privilege in practice covers the method.
- Not done:
Access logging. You can show who accessed a school's data and when.
- Not done:
Subprocessor list and flow-down. Each subprocessor that touches student data is listed and bound by terms at least as strict as yours.
- Not done:
Request routing. Parent and student requests that reach you are forwarded to the school promptly, with a record.
- Not done:
Deletion at contract end. A runbook, and records showing it ran for past customers.
- Not done:
Incident response. A plan that identifies student data and the notification commitments in each contract.
Where FERPA stops
FERPA is narrower than many vendors assume, and the gaps are filled by other rules.
Breach notification. FERPA's regulations do not set a breach notification timeline of the kind HIPAA has. State laws and your contracts usually do.
State student privacy laws. Many states have their own laws governing EdTech operators directly, and some apply whether or not a contract exists. These often add prohibitions on advertising and sale, specific security requirements, and contract terms.
Children's privacy. If your product collects personal information from children under 13, COPPA may apply to you directly as an operator.
Other federal rules. The Protection of Pupil Rights Amendment governs certain surveys of students, and may matter if your product collects survey data.
For a summary of what FERPA requires and how it fits other frameworks, see the FERPA framework page.
How TrustLynce helps
TrustLynce tracks each school's contractual commitments against the controls that meet them through customer commitments, so a deletion clause or breach notice window has an owner and evidence. Vendor management keeps your subprocessor list and flow-down terms current, and access reviews produce the record schools ask about.