A student’s school records do more than show grades—they tell the tale of their time in school.

The Family Educational Rights and Privacy Act (FERPA) keeps these records under wraps and lets students decide who gets to see them. This covers everything from report cards to transcripts, and even notes about behavior. FERPA lays down the law for schools that get money from the government. You don’t need to be a lawyer to understand why this matters—it helps students, parents, and teachers make smart choices about what to share and who to share it with.

In this post, we’ll break down FERPA, spell out what counts as a school record, and clear up who can (and can’t) take a look at them.

Definition of Educational Records

Educational records are official documents that track a student’s academic journey. These records contain personal and academic details maintained by a school or university. Under FERPA (Family Educational Rights and Privacy Act), these records are strictly protected, ensuring that only authorized individuals can access them.

FERPA Educational Records Include

Educational records come in many forms—both physical and digital. If a school keeps it and it’s directly related to a student, it likely falls under FERPA protection. Some common examples include:

Grades & Transcripts – Your academic performance and official records.
Class Schedules – The courses you’re enrolled in for a given term.
Financial Aid Documents – Loans, grants, and scholarship details.
Disciplinary Records – Incidents and actions taken by the school.
Health & Medical Records – Kept by the school, such as immunization records.
Student Identification Information – Names, ID numbers, and other personal details.
Enrollment Records – Proof of attendance, past and present.
Admissions Information – Applications, acceptance letters, and supporting documents.

These records are stored all over campus—in the registrar’s office, academic departments, and student services. If you ever need access to them, knowing where to look is key.

FERPA Educational Records Do Not Include

Not everything related to a student counts as an educational record under FERPA. Some documents are outside its scope, such as:

Private Notes – Personal notes kept by professors or staff that aren’t shared.
Campus Police Records – Law enforcement documents kept separately from academic files.
Alumni Records – Information collected after a student has graduated.
Employment Records – Work-related documents if the job isn’t tied to student status.
Medical Treatment Records – Kept only for treatment purposes by campus health services.

In short, if a record isn’t meant for academic purposes or is created after a student leaves school, it’s usually not protected by FERPA.

Educational records protected and not protected by FERPA

Scope of Educational Records

A student’s FERPA rights kick in at 18 or when they start college—whichever comes first. This means parents lose automatic access unless the student grants permission.

Schools are required to safeguard these records from unauthorized access. Some must be kept for years after graduation or withdrawal, depending on the type of document.

Records can only be shared with:

School officials with a legitimate educational interest (such as advisors or registrars).
Third parties with written student consent (like employers or scholarship organizations).

Understanding what qualifies as an educational record and who can access it helps students stay in control of their personal information. If you’re ever unsure, ask your school’s registrar’s office for guidance.

Understanding FERPA

Imagine if your school could hand out your grades or personal details to anyone who asked. That used to be the case—until FERPA stepped in.

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects student privacy by giving students and parents specific rights over educational records. If a school receives federal funding in the U.S., it must follow FERPA’s rules.

History and Purpose of FERPA

Before 1974, schools could share student records freely—without a student’s or parent’s permission. There were no clear rules on privacy, and that led to serious concerns.

To fix this, Congress passed FERPA, giving parents control over their children’s educational records and ensuring schools couldn’t release private student information without consent. Once a student turns 18 or enters college, these rights transfer entirely to them, meaning parents can’t access records without permission.

At its core, FERPA is about giving students control over their own information while making sure schools handle records responsibly.

Key Provisions of FERPA

FERPA covers any record a school keeps that is directly related to a student. This includes:

Grades and transcripts
Class schedules
Health and disciplinary records
Financial aid details

In most cases, schools must get written permission from the student (or parent, if the student is under 18) before sharing these records. However, there are some exceptions:

School officials can access records if they need the information to do their jobs.
Records can be shared when a student transfers to another school.
In health or safety emergencies, schools can disclose necessary information without permission.

If a student or parent requests access to records, the school has 45 days to provide them. Schools may charge a fee for copies but can’t charge for simply searching or retrieving records.

Rights Under FERPA

Under FERPA, students (and their parents, if applicable) have four key rights:

Review Records – You can request to see all educational records the school keeps about you.
Request Corrections – If something is incorrect, you have the right to ask for a fix.
Control Access – You decide who can (or can’t) see your records.
File Complaints – If a school violates FERPA, you can report it to the U.S. Department of Education.

However, schools can share records without permission in specific situations, including:

When a student transfers to another school
For financial aid processing
For official academic research
During health and safety emergencies

Lastly, schools are required to notify students of their FERPA rights every year and have clear processes for handling requests and corrections.

Types of Educational Records

Educational records under FERPA cover a wide range of documents that schools maintain about students. These records serve as a paper trail of a student’s academic journey, financial dealings, and even behavioral history. Schools keep these files not just for record-keeping, but also to track student progress, ensure compliance, and support institutional decision-making.

Academic Records

Academic records are the backbone of a student’s educational history. They include transcripts, grades, test scores, and class schedules—essentially, a student’s academic footprint.

But there’s more. Schools also store coursework and assignments, including research papers, lab reports, and project submissions. Whether it’s a final thesis or a mid-term essay, if it’s part of a student’s academic evaluation, it’s recorded. Advising notes, academic support logs, and student service records—often stored in campus-wide systems—are also protected under FERPA.

Even attendance records and class participation notes are part of this file. Teachers and administrators rely on these to monitor student engagement and performance. For example, a professor may track class participation to ensure a student is actively contributing, which can impact final grades

Disciplinary Records

If a student faces any disciplinary action, the school keeps a record of it. This includes written warnings, detention notices, and suspension reports—documents that may be referenced later if behavioral patterns emerge.

Beyond the incident reports, schools also maintain detailed documentation of investigations. This means that when an issue arises, the school logs what happened, how it was handled, and any follow-up measures taken. If a dispute ever comes up, these records provide clarity.

For students who receive behavioral intervention plans or counseling, these documents also go into their disciplinary file. Schools use them to track progress and ensure proper support is provided over time.

Financial Information

Financial records cover anything related to tuition, fees, and financial aid. Schools carefully track every transaction, including tuition payments, scholarship details, and financial aid documents.

Student account statements show charges, payments, and balances for courses, housing, meal plans, and other services. For many students, keeping track of these records is crucial—especially when applying for grants, loans, or scholarships.

All grant and loan documentation falls under FERPA protection because it contains sensitive personal and financial details. Schools must handle these records securely to prevent unauthorized access.

Student Rights and Educational Records

Under FERPA, students gain control over their educational records once they turn 18 or enter college. These rights ensure that students can access their records, correct mistakes, and decide who gets to see them.

Access to Records

Students have the right to review their educational records at any time. If a student requests access, the school must respond within 45 days.

For students who live far from campus, schools must provide alternative access, such as mailing copies or offering digital access. Schools can charge for copies, but they cannot charge fees just for searching or retrieving the records.

Students can request access to a range of records, including:

Grades & Transcripts – Academic history and performance.
Class Schedules – Current and past course enrollments.
Financial Aid Documents – Scholarship and loan details.
Disciplinary Records – Reports of behavioral incidents.
Health & Medical Records – If kept by the school (e.g., vaccination records).

Knowing what records you have access to is key—especially if you’re transferring schools, applying for jobs, or disputing an error.

FERPA requires written student permission before schools can share educational records. The request must clearly state:

Which records can be shared.
Who will receive them.
Why they are being disclosed.

However, there are exceptions where schools can share records without consent, including:

School officials who need the information for academic or administrative purposes.
Other schools where a student is transferring.
Health and safety emergencies where quick action is needed.
Certain government agencies for audits and compliance checks.

For students, this means most information stays private unless they authorize its release. If a student ever feels their records were shared inappropriately, they have the right to file a complaint.

Amendment of Records

Mistakes happen, even in official records. If a student finds incorrect or misleading information in their files, they have the right to request a correction.

The process is straightforward:

Submit a written request explaining what needs to be changed and why.
The school reviews the request and decides whether to make the change.
If the request is denied, the school must:
1. Explain the reason for the denial.
2. Inform the student of their right to a formal hearing.

If, after the hearing, the school still refuses to correct the record, the student has the right to add a personal statement to their file. This ensures that their perspective is documented alongside the disputed information.

FERPA Compliance for Institutions

Schools and universities carry a big responsibility when it comes to handling student education records. Under FERPA, they must follow strict privacy rules to protect this information, ensuring that only authorized individuals have access. This means clear policies, proper training, and secure record-keeping systems are essential for compliance.

Notification Requirements

Every year, schools must inform students and parents about their FERPA rights—a crucial step in making sure everyone understands how their records are protected. The notification should explain:

How to inspect records – Students have the right to see their educational records.
How to request changes – If there’s an error in a file, students can request a correction.
How to file complaints – If a student believes their rights have been violated, they can report it.

A key part of this notification is directory information—basic details like a student’s name, email, or major that schools may share without consent unless the student opts out. Institutions must make this policy crystal clear so students know their choices.

To ensure students actually see this notice, schools should post it in multiple places—on their websites, in student handbooks, and even in registration materials. A quick email reminder wouldn’t hurt either!

Handling Record Requests

When a student or an authorized party requests access to educational records, schools must respond within 45 days. No exceptions.

But before granting access, schools need to verify identities to prevent unauthorized disclosures. Many institutions require secure verification methods, such as using your official student email, student ID number or logging into a secure portal with multi-factor authentication.

Some schools won’t process requests over the phone unless they have a way to confirm your identity. And if you’re requesting records remotely, you might be asked to show your student ID on a Zoom call before they release anything.

Schools also must keep logs of who accesses student records and why. This includes tracking third-party disclosures, which helps maintain transparency and accountability.

When students transfer to another school, their records can be shared without consent—but only if the disclosure is for enrollment purposes. This ensures a smooth transition between institutions without unnecessary delays.

Maintaining Privacy

Protecting student records is not just a policy—it’s a legal duty. Schools must have strong security measures in place, both for digital and physical records. This includes:

Secure storage – Locked filing cabinets for physical records and encrypted databases for digital ones.
Restricted access – Only authorized personnel should be able to view student information.

Staff members who handle student records must be trained regularly on FERPA rules. They need to understand what they can share, with whom, and under what circumstances. A simple mistake—like emailing a student’s transcript to the wrong person—could lead to a serious privacy violation.

Only school officials with a legitimate educational interest can access student records without consent. But what does “legitimate educational interest” actually mean? Each institution must clearly define this, ensuring access is limited to those who genuinely need the information to perform their job duties.

And when it comes to sharing non-directory information (like grades, disciplinary records, or financial aid details) with outside parties, written student consent is required. Schools must also keep these consent forms on file to document compliance.

Parental Rights Regarding Educational Records

As a parent, you naturally want to stay informed about your child’s education. Under the Family Educational Rights and Privacy Act (FERPA), parents have the legal right to access, review, and request corrections to their child’s educational records—at least until those rights transfer to the student.

Access to Children’s Records

Parents have the right to inspect and review their child’s educational records at any time while their child is a minor.

But what if a parent lives far away? No problem. Schools are required to provide copies if an in-person review isn’t feasible. While they can charge a reasonable fee for printing and mailing records, they cannot charge for simply locating or retrieving them.

Sometimes, educational records can be confusing—full of codes, acronyms, or unfamiliar terms. If a parent doesn’t understand something, they have the right to ask for an explanation, and schools must provide someone to help interpret the information. After all, knowing what’s in a record is just as important as having access to it.

Limitations on Parental Rights

Parental rights to student records don’t last forever. Once a student turns 18 or enters college, FERPA transfers those rights directly to the student. From that point on, parents cannot access records without the student’s written consent—even if they’re still paying tuition!

There are also a few specific exceptions where parents can be denied access:

Confidential letters of recommendation – If a student chooses to waive their right to review them, parents won’t have access either.
Private notes kept by teachers or school staff – Notes that are for personal use only (like a teacher’s reminder about student behavior) don’t count as official records under FERPA.

For many parents, this shift in access can feel frustrating—especially when they’re used to being involved. But FERPA is designed to empower students to take control of their own education, ensuring that their personal information remains private unless they choose to share it.

Exceptions to FERPA Privacy Rule

FERPA is built around student privacy, but there are certain situations where schools can share student records without consent. These exceptions exist to protect student safety, support school operations, and ensure essential information reaches the right people when needed.

School Officials and Legitimate Educational Interest

Not everyone at a school can access student records — only those with a legitimate educational interest can view them. This means that if an employee needs the information to do their job, they’re allowed access under FERPA.

For example, a professor might need to check a student’s prerequisites before enrolling them in an advanced course. A financial aid officer must review income documents to determine eligibility for grants. A school nurse may need medical history details to respond to a health concern.

Who qualifies as a school official under FERPA? It includes:

Teachers and professors – For grading, advising, and student progress tracking.
Administrators – Such as deans, registrars, and academic program directors.
Academic advisors – To help students select courses and meet graduation requirements.
Support staff – Like counselors, nurses, and IT personnel managing student data.
Contracted service providers – External companies that handle institutional functions (e.g., online learning platforms, legal consultants).
School board members – When making policy decisions that require student data.

The key requirement? A clear, job-related need. Accessing records out of curiosity or personal interest is not allowed.

Health and Safety Emergencies

FERPA allows schools to bypass consent requirements when a student’s health or safety is at immediate risk. If there’s an emergency, schools can quickly share relevant information with people who can help resolve the crisis.

This exception applies in situations such as:

Medical emergencies – A student collapses in class, and paramedics need their medical history.
Mental health crises – A student makes threats of self-harm, and their counselor needs to involve parents or professionals.
Campus safety threats – If a student is in danger or poses a risk to others, law enforcement may be informed.
Natural disasters – Schools may need to provide student location details during an evacuation.

However, this isn’t a free pass for unlimited record-sharing. Schools must determine that a real emergency exists and only disclose what is necessary to handle the situation.

Directory Information

Not all student records are strictly confidential. Schools can share basic details—called directory information—without consent, as long as students have the option to opt out.

What counts as directory information? Typically, it includes:

Name
Address
Phone number
Email address
Date of birth
Field of study (major/minor)
Dates of attendance
Degrees, honors, and awards received

This kind of information is often used for yearbooks, graduation programs, and honor roll lists. Schools must clearly notify students about what they classify as directory information and offer a way to opt out—usually at the start of the academic year.

While directory information seems harmless, students should think carefully before allowing their details to be publicly available. Opting out means schools won’t release this data—not even to potential employers.

Electronic Records and FERPA

In today’s digital world, student records aren’t just stored in paper folders and filing cabinets anymore. Schools now handle massive amounts of electronic educational records, from online grade books to student health records. While digital storage makes access and organization easier, it also brings new challenges—especially when it comes to privacy and security. FERPA ensures that even in a digital format, student information stays protected.

Digital Educational Records

Education records can exist in many digital forms—emails, PDFs, spreadsheets, and even online discussion threads. If a document contains information directly related to a student and is maintained by an educational institution, it is considered an educational record under FERPA.

Some common types of digital education records include:

Electronic grade books – Teachers track student progress digitally.
Digital attendance records – Schools monitor absences and tardiness online.
Online student portfolios – Students submit coursework through school platforms.
Student information systems – Databases store personal and academic details.
Digital health records – Schools keep immunization and medical records securely.
Email communications about students – Messages between faculty and staff discussing student performance or behavior.

Because these records exist in digital spaces, tracking who accesses them and when is critical. Schools must log every request for access and maintain a record of when student information is shared. Without these safeguards, sensitive student data could end up in the wrong hands.

Cybersecurity and FERPA

With so much student information stored electronically, data breaches and hacking threats are real concerns. Schools are legally required to protect student records from unauthorized access, just as they would with physical files. This means implementing strong cybersecurity measures to prevent leaks, theft, or accidental exposure.

Some key security practices include:

Restricted access – Only authorized personnel should handle student records.
Regular security updates – Systems must be patched to prevent vulnerabilities.
Secure backup systems – Schools should store copies in protected locations.
Encryption and password protection – Sensitive data must be encrypted to prevent unauthorized viewing.
Clear protocols for data sharing – Schools must have written policies on who can share what information and how.
Staff training on digital security – Employees need to recognize threats and follow best practices.

Cybersecurity isn’t just about protecting data—it’s about protecting students. A single breach could expose social security numbers, grades, medical history, or financial aid details. That’s why institutions must constantly update their security measures and ensure only the right people have access.

Law Enforcement and FERPA

FERPA makes an important distinction between educational records and law enforcement records. While schools must protect student privacy, they can still work with police and security personnel in specific situations. The key is understanding what information can be shared and when.

Campus Security Records

Not all student-related records are considered “educational records” under FERPA. For example, records created and maintained by campus security or law enforcement units fall into a different category.

These files are not protected by FERPA, meaning campus police can manage them separately without the same restrictions as academic records.

To qualify as law enforcement records, they must meet these three conditions:

Created by the law enforcement unit (such as campus police or security).
Made for law enforcement purposes (like investigating campus incidents).
Maintained by the law enforcement unit (not by the school’s academic offices).

Because these records are separate, campus security can share them with outside law enforcement—like local police or the FBI—without violating FERPA. However, if a record is shared with other school departments, such as the registrar’s office, it could become subject to FERPA protections.

Cooperation with Law Enforcement

There are cases where schools can disclose student information to law enforcement without needing the student’s consent. The most common situations include:

Emergencies that pose a threat to health or safety (such as active shooter situations or medical crises).
Legal subpoenas or court orders that require disclosure.
Requests from School Resource Officers (SROs) — these are law enforcement officers assigned to schools. If they are part of the school’s law enforcement unit, they can access necessary student records to fulfill their duties.

That said, schools must strike a careful balance. Student privacy is still a priority, and institutions should have clear policies defining what information can be shared, when, and with whom.

Oversharing without justification can lead to violations, so schools need to be thoughtful about their law enforcement partnerships.

Best Practices for Protecting Educational Records

Keeping student records secure is not just about locking away files—it’s about building a culture of privacy. Schools must take proactive steps to ensure sensitive information stays protected from unauthorized access, data breaches, and human error.

Training and Policies

Privacy laws like FERPA mean nothing if staff aren’t properly trained. Anyone who handles student records—whether registrars, professors, or IT personnel—should receive regular FERPA training to ensure compliance.

Some key training areas include:

Proper handling of records — both digital and paper copies.
Who has permission to access certain records and under what conditions.
When student consent is required before sharing information.
How to recognize and report privacy concerns.

Schools should also have written policies in place, detailing:

Who can access student records (and why).
The steps required before sharing information.
Security measures for both physical and digital records.

To reinforce accountability, institutions should require staff to sign confidentiality agreements, acknowledging their responsibility to protect student data.

Audits and Monitoring Compliance

You can’t protect what you don’t track. Schools should conduct regular audits to identify security weaknesses and ensure compliance with FERPA. These audits help answer important questions, such as:

Are access logs being monitored? (Who viewed records and when?)
Are unauthorized individuals accessing student information?
Are policies being followed correctly?

Additional safeguards include:

Random spot checks of record storage areas.
Monitoring of digital access logs to detect suspicious activity.
A clear process for investigating and documenting privacy breaches — quick action can prevent future incidents.

At the end of the day, protecting student records is about more than just compliance—it’s about trust. Students rely on schools to keep their information safe and private, and institutions must take that responsibility seriously.

FERPA Beyond K-12 Education

Once a student turns 18 or enrolls in college, FERPA rights shift from parents to the student. This means the student now controls who can access their educational records—including parents. It’s a major shift in privacy, and many students (and parents) don’t realize the implications until they need access to grades, transcripts, or financial information.

Postsecondary Education Concerns

In college, students have full authority over their educational records. This means a school cannot release information—grades, disciplinary actions, financial aid details, or even class schedules—to anyone without written permission from the student. Yes, even parents.

However, there are a few key exceptions where schools can share information without student consent:

Tax Dependency: If the student is claimed as a dependent on their parent’s tax return, the school can share records with the parents.
Health & Safety Emergencies: If there’s an immediate threat to the student’s health or safety, the school can notify emergency contacts without waiting for permission.
Alcohol or Drug Violations (Under 21): Schools can inform parents if a student under 21 is involved in substance-related violations.

That said, students have the option to grant partial access to specific information. For example, a student might allow parents to see tuition bills and financial aid info but keep their grades and disciplinary records private. Many schools have online portals where students can set up permissions to decide who can access what.

Transferring Educational Records

When a student transfers to another school—whether it’s a new college, a study abroad program, or even graduate school—FERPA allows schools to share records with the new institution without needing student consent.

Here’s what students should know about record transfers:

The current school must make an effort to notify the student before sending records.
Schools can share records like:
1. Transcripts (grades, coursework, and academic history).
2. Disciplinary actions (if applicable).
3. Special education needs (if relevant).
Schools must log all requests for access to student records—meaning there’s always a paper trail of who accessed the information and why.
Once the receiving institution gets the records, they must follow FERPA guidelines—meaning they cannot share or disclose that information further without the student’s permission.

This process ensures that important academic history follows students smoothly, without unnecessary paperwork or delays. However, if students are concerned about what’s being transferred, they should check with their school’s registrar before making a move.

Important Note :-

Once you receive a diploma, transcript, or digital credential, FERPA no longer protects it—it’s yours to share however you want. But there’s a catch.

If your school sends your records directly to an employer, graduate school, or third party, FERPA still applies, meaning they need your written consent before releasing them.

So before assuming your transcript is on its way, check where it’s going and whether you need to give permission. A misplaced assumption could lead to delays, missed opportunities, or even unintended disclosures.

Assuring FERPA Compliance With EduTranscript

Navigating the complexities of FERPA compliance can be a daunting task for university registrars. With frequent updates to regulations and the responsibility of managing countless academic records and transcripts, ensuring adherence to privacy laws becomes increasingly challenging.

EduTranscript offers a modern solution to these challenges by automating the transcript management process. It provides a self-service portal where students can submit their transcript requests, allowing registrar’s office staff to efficiently review, approve, and oversee the entire dispatch process. This streamlined approach not only reduces manual workload but also minimizes the risk of non-compliance.

Security and compliance are at the forefront of EduTranscript’s design. The platform ensures full adherence to FERPA regulations, safeguarding student data through robust encryption and secure data storage.

Additionally, EduTranscript is fully web accessible, ensuring all users, including those with disabilities, can easily navigate and interact with the platform. By integrating seamlessly with existing university systems, it provides a comprehensive solution for managing academic records securely and efficiently.

To learn more about how EduTranscript can assist your institution in maintaining FERPA compliance while simplifying transcript management, visit their website.

Conclusion

FERPA isn’t just a set of rules—it’s a safeguard for student privacy. Schools handle a massive amount of sensitive data, from transcripts to disciplinary records, and any misstep can have serious consequences. That’s why institutions must be proactive, ensuring that records are stored securely, shared responsibly, and managed with care.

Students and parents have rights under FERPA, but those rights are only as effective as the systems in place to protect them. Schools need clear policies, well-trained staff, and consistent oversight to stay compliant. A small mistake—like an email sent to the wrong person—can lead to a privacy breach, so attention to detail is critical.

Managing FERPA compliance manually can be overwhelming, especially with the volume of academic records universities process daily. That’s where EduTranscript helps. With automated transcript management, a self-service student portal, and secure, FERPA-compliant processing, it simplifies the workload for registrar offices.

If your institution wants to improve efficiency while ensuring compliance, book a demo with EduTranscript today.