Most EdTech products receive student data under one provision of the FERPA regulations: the school official exception. It lets a school share personally identifiable information from education records with a vendor, without parental consent, by treating the vendor as one of its own officials.
The exception is often described as a formality. Sign the contract, check the box, receive the data. It is not. It has specific conditions, and those conditions continue to apply for as long as you hold the data. A vendor that uses student data for its own purposes, or passes it on without authorization, is no longer operating within the exception.
This article walks through the conditions in the regulation, what "direct control" means for a SaaS product, how redisclosure works, and the controls that keep you inside the exception. For the broader picture of how FERPA reaches vendors, start with our overview of FERPA for EdTech vendors. This is not legal advice; confirm your position with counsel and with the schools you serve.
The three conditions in the regulation
The exception is at 34 CFR § 99.31(a)(1). It starts with school officials inside the institution, such as teachers and administrators, whom the school has determined to have legitimate educational interests. It then lets a school treat an outside party as a school official too.
A contractor, consultant, volunteer, or other party to whom the school has outsourced institutional services or functions may be considered a school official if it meets three conditions.
It performs an institutional service or function for which the school would otherwise use employees. A learning management system, a gradebook, a student information system, or a tutoring platform used in instruction fits. A product the school has no institutional need for does not.
It is under the direct control of the school with respect to the use and maintenance of education records. The school, not the vendor, decides how the records are used.
It is subject to the requirements of § 99.33(a) governing the use and redisclosure of PII from education records. It uses the information only for the purposes for which it was disclosed, and does not pass it on without consent except as the regulation permits.
All three must hold. Meeting the first because your product is genuinely useful does not compensate for failing the second because you treat the data as yours.
Legitimate educational interest and the annual notice
There is a fourth requirement, and it sits with the school. The school may disclose to officials, including outside parties, only where they have a legitimate educational interest in the records.
If a school discloses under this exception, its annual notification of FERPA rights must state the criteria for who counts as a school official and what counts as a legitimate educational interest, under § 99.7. A district that has not included outside service providers in those criteria has a gap in its own compliance, and it may ask you to help close it by confirming how your service fits.
You cannot fix the school's notice for it, but you can make the fit easy to describe. Be clear about what institutional function your product performs and which records it needs to perform it.
What direct control means for a SaaS product
The regulation does not define "direct control" in operational detail. For a SaaS vendor, it is usually established through the contract and demonstrated through how you operate.
In practice, it tends to mean:
The school decides the purpose. Your contract limits your use of student data to providing the contracted service.
The school can direct changes. It can correct records, restrict processing, and require deletion, and you act on those instructions.
The school retains control of the records. Ownership or control of student data stays with the school, and the contract says so.
You do not repurpose the data. No targeted advertising, no sale, no profile building for purposes unrelated to the service.
The school can see what you do. It can obtain information about your security practices, subprocessors, and handling of its data.
The difficult area is product development. Using identifiable student data to build features for other customers is hard to reconcile with direct control. Whether you may use de-identified data for product improvement depends on the contract and on whether the data is genuinely de-identified under the regulation's broad definition of PII. Get the answer in writing rather than assuming it.
Redisclosure and your subprocessors
Section 99.33(a) is where many vendors drift outside the exception without noticing.
The rule is that a party receiving PII from education records may not disclose it to any other party without prior consent, and its officers, employees, and agents may use it only for the purposes for which it was disclosed. The regulation allows further disclosures on the school's behalf in limited circumstances under § 99.33(b), with conditions that include the school's own recordkeeping.
For a SaaS vendor, this raises two practical questions.
Subprocessors
Your hosting provider, support tooling, email delivery service, and analytics vendors may all touch student data. Schools typically address this in the contract by approving your list of subprocessors and requiring you to bind each one to terms at least as strict as yours. Keep the list accurate. An undisclosed subprocessor that receives student data is the clearest example of an unauthorized redisclosure.
Requests from third parties
Law enforcement requests, subpoenas, and requests from parents who contact you directly should be routed to the school, unless the law requires otherwise. The school decides whether a disclosure is permitted, not you.
What is at stake
Under § 99.33(e), if the Department of Education determines that a third party outside the school improperly redisclosed PII in violation of the section, the school may not allow that third party access to PII from education records for at least five years. For a vendor whose product depends on student data, that is a commercial consequence, not a technical one.
Building access controls that honor the exception
Section 99.31(a)(1)(ii) requires the school to use reasonable methods to ensure that school officials obtain access only to the education records in which they have legitimate educational interests. Those methods can be physical or technological access controls, or effective administrative policy.
That requirement is the school's, but your product is often the means of meeting it. Schools will look for:
Role-based access, so a teacher sees their own sections and not the whole district
Administrative controls that let the school assign and revoke roles
Restrictions on your own staff's access to student data, limited to support and operations roles that need it
Logs of access to student records, available to the school on request
Periodic review of who holds access, with evidence
Our guides to access reviews that hold up and centralized logging for compliance cover how to produce that evidence. Disclosures to school officials do not have to be recorded in the school's disclosure log under § 99.32, which makes your access logs one of the few records that show who saw what.
Where vendors get it wrong
Treating the exception as permanent. It applies while the conditions hold. A new data use can take you outside it.
Assuming the contract is enough. The contract establishes direct control on paper. Your data flows have to match it.
Forgetting the free tier. If teachers sign up individually, without a school agreement, the school may not have designated you as a school official at all.
Keeping data after the contract ends. Holding student data with no service to provide is hard to justify under any condition.
For the regulation's wider requirements, see the FERPA framework page.
How TrustLynce helps
TrustLynce runs user access reviews across the systems that hold student data, and keeps your subprocessor inventory and flow-down terms current in vendor management. Each school's contractual commitments can be tracked against the controls that meet them, so evidence is ready when a district asks.