FERPA Compliance: Requirements, Violations, and Checklist

A teacher hits Reply All and sends one student’s grade to thirty parents. The violation is logged before anyone knows how to respond. The Family Educational Rights and Privacy Act (FERPA) compliance breaks down in moments like this, not during policy reviews or yearly audits, but in routine tasks staff perform every day without a clear protocol.

FERPA compliance is not a policy you post on a website. It is a set of daily habits that every staff member with access to student records must practice, and that every institution must document. You need a structured training program and a clear violation response protocol, with audit-ready records that prove your institution can show compliance with confidence rather than scrambling when something goes wrong.

Main Takeaways

• FERPA protects the rights of parents and eligible students to inspect education records, request amendments, and control the disclosure of personally identifiable information (PII).
• Most violations happen during routine tasks. Misdirected emails and hallway conversations cause more harm than audit gaps.
• Federal rules permit disclosure without consent in specific cases, including legitimate educational interest and health or safety emergencies.
• Many institutions require annual FERPA training for employees with record access and document completion to support compliance and reduce privacy risks.
• Rights transfer from parents to students at age 18 or upon postsecondary enrollment. Sometimes college advisors miss this shift when contacting parents without consent.

FERPA Compliance Requirements: What the Law Expects From Your Institution

Being FERPA compliant means your institution takes active steps to safeguard student education records and personally identifiable information (PII). PII is any data point that can identify a student, including name, address, grades, and enrollment status. Compliance rests on upholding three core student rights and following strict rules about when records can and cannot be disclosed.

Three Rights You Must Protect

FERPA grants three rights. Parents hold these rights until the student turns 18 or enrolls in a postsecondary institution, at which point the rights transfer to the student.

• Right to inspect education records. Your institution must provide access within 45 days of a request, so your records office needs a documented intake and tracking process to meet that deadline.
• Right to request amendments. You must offer a formal process for students or parents to challenge and correct wrong data in their records.
• Right to consent before disclosure. You cannot release PII from education records without written consent, except under specific exceptions outlined in federal rules.

What Records Are (And Are Not) Protected

Protected education records include grades and transcripts, enrollment data, financial aid records, disciplinary files, and any record directly related to a student and maintained by the institution.

Records not covered by FERPA include:

• Law enforcement unit records.
• Faculty personal notes kept solely by the maker and never shared.
• Records created after a student is no longer enrolled that are unrelated to their attendance as a student.
• Peer-graded assignments before grades are collected and recorded by the instructor.
• Directory information (name, email, enrollment status), but only if your institution has issued the required annual opt-out notice to families.

That last point trips up many schools. If you skip the annual opt-out notice, directory data cannot be treated as shareable.

FERPA Exceptions: When You Can Share Without Consent

Federal rules (34 CFR § 99.31) permit disclosure without consent in multiple cases. Your faculty and staff need to know each one and its limits.

1. School officials with a legitimate educational interest: a teacher, advisor, or admin who needs the record to do their job, not someone who is simply curious.
2. Transfer to another school where the student seeks or intends to enroll.
3. Federal or state education authorities conducting audits, reviews, or enforcement.
4. Financial aid purposes connected to aid the student has applied for or received.
5. Groups conducting studies on behalf of the institution.
6. Accrediting organizations carrying out their accrediting functions.
7. Judicial orders or lawfully issued subpoenas: you must make a fair effort to notify the student or parent before releasing records, unless the order bars it.
8. Health or safety emergencies: this exception is narrow and applies only when the threat is immediate and serious.
9. State and local juvenile justice authorities acting under state law.
10. Parents of a dependent student: if the student is claimed as a dependent for IRS tax purposes, a school may share records with either parent without the student’s consent (34 CFR 99.31(a)(8)).
11. Parents of a student under 21: a postsecondary institution may notify parents of the student’s violation of alcohol or controlled-substance laws or policies (34 CFR 99.31(a)(15)).

Of these cases, legitimate educational interest is the one your staff will face most often. Your institution must define that term clearly in its annual FERPA notification, and every employee should know exactly where the boundary falls. Applying these rules correctly during a rushed email or a hallway conversation is where most institutions’ FERPA compliance actually breaks down.

Secure the Records: Encryption, Access Control, and Monitoring

FERPA does not prescribe specific security controls, but the Department of Education and every major compliance framework treat a few safeguards as the baseline for protecting electronic records:

• Encryption. Encrypt PII at rest and in transit, so records stay protected even if a device is lost or a transmission is intercepted.
• Role-based access control. Limit record access to staff who need it for their role, with clear procedures to grant and revoke access when someone is hired, promoted, or leaves.
• Monitoring and logging. Log record- and user-level activity so unusual access is visible and you have an audit trail if an incident occurs.

These controls also shorten the contain and assess steps of a violation response, because you can see what was accessed and cut it off quickly.

FERPA Violation Examples, Penalties, and What to Do Next

Most FERPA violations do not start with bad intent. They start with routine tasks: a misdirected message, a document left in the wrong place, a conversation that crosses a line no one noticed. Every institution needs to recognize what a violation looks like and have a clear protocol ready when one occurs.

Consider two scenarios that could happen at your school this week. A front-office staff member leaves confidential documents, such as graded tests, report cards, or health plans, unsecured on a printer or a desk where unauthorized visitors or other students can view them. A college advisor calls a student’s parent to discuss academic probation without checking whether the student, who is over 18, has given written consent.

The consequences are real. The U.S. Department of Education’s Student Privacy Policy Office (SPPO) investigates complaints and can pull federal funding from institutions that show a pattern of violations. It can also impose a five-year ban that blocks any third party involved in a violation from accessing PII at any institution. Staff members do not face federal fines under FERPA, but they can face discipline up to and including termination.

Case law reinforces where that accountability sits. In Gonzaga University v. Doe (2002), the U.S. Supreme Court ruled that FERPA’s nondisclosure provisions create no private right to sue, meaning students and parents cannot take an institution to court directly under FERPA. Enforcement runs through the Department of Education, which makes a documented compliance record, not a courtroom defense, your institution’s real protection.

The risk landscape is growing. CIS and MS-ISAC’s 2025 K-12 Cybersecurity Report found that 82% of reporting K-12 schools faced cyber-threat impacts between July 2023 and December 2024, a period that saw 9,300 confirmed incidents, each one a possible trigger for a FERPA-related disclosure.

When a violation happens, follow this five-step response protocol:

1. Contain. Stop the disclosure right away: recall the email, pull down the posted document, restrict access to the record.
2. Assess. Identify what PII was exposed, who received it, and whether any FERPA exception applies.
3. Notify. Inform affected students or parents and report the incident to your institution’s FERPA compliance officer.
4. Report to SPPO when fitting. ED suggests contacting SPPO after third-party violations. File a formal complaint if needed.
5. Document and correct. Log the incident, your steps to contain it, and every fix you applied: added training, a policy change, an access limit. This record becomes your audit evidence.

Most violations are accidents. But when SPPO reviews your institution’s compliance record, the response you documented carries as much weight as the mistake itself.

FERPA Compliance Checklist: Training, Vendor Vetting, and Audit Readiness

FERPA compliance works as a day-to-day program, not a one-time policy sign-off. That is what separates institutions that pass audits from those that scramble through them. The program should include annual training for everyone who touches student records, documented proof they finished it, and clear processes for vetting vendors and filling record requests.

In March 2025, ED’s Student Privacy Policy Office directed state education agencies to submit training materials and other information necessary to show FERPA compliance, a clear signal that training records are now an audit expectation. Yet the gap between that standard and real practice is wide: a 2025 CoSN survey found that 73% of district privacy leaders say managing student data privacy is not part of their official job description, and 17% have never received any privacy training.

Your training content should cover:

• Disclosure rules and the consent exceptions.
• Safe email and grade-posting practices.
• How to process parent and student record-access requests within the 45-day window.
• How to spot and report a possible violation.

The gap between a training program and a training policy is proof. Your audit-ready evidence file needs four things: the training outline, assignment rosters, completion timestamps, and signed attestations. A training system like Vector LMS automates assignment, tracks completion, and creates audit-ready reports for K-12 and higher education institutions.

FERPA Compliance by Institution Type

FERPA duties shift based on whether you operate a K-12 school, a college or university, or an EdTech platform. The table below breaks down the key differences.

Despite standard agreements like NDPA v2, only 55% of districts required vendors to provide product safety data during 2026 procurement, according to CoSN’s U.S. State of EdTech 2026 report.

Use this FERPA compliance checklist to close the gaps:

1. Assign annual FERPA training to every employee and contractor who can access education records.
2. Track and store completion records with timestamps and signed attestations.
3. Send the required annual FERPA notification to all parents or eligible students.
4. Publish your directory information opt-out notice and process opt-out requests before sharing any directory data.
5. Set up a documented process for filling record-access requests within 45 days.
6. Vet every EdTech vendor before granting access to PII.
7. Define legitimate educational interest in your annual notification so staff know the boundary.
8. Keep a written post-violation response protocol and review it each year.

When vetting a vendor, ask: Do you have a signed data processing agreement? How do you handle student data after the contract ends? Will you agree to breach notification within 72 hours? Can you confirm data is not used for ads or profiling?

Build Audit-Ready FERPA Compliance With Vector Solutions

Train every staff member on their FERPA duties, document their completion for auditors, and respond to violations with a protocol that produces solid records. That turns compliance from a static policy into a day-to-day program you can stand behind when SPPO comes asking.

Vector LMS lets education institutions assign annual FERPA training at scale and confirm every staff member finishes on time, with reports that show exactly who trained, when they finished, and what topics they covered, no spreadsheets or manual follow-up needed.

Frequently Asked Questions About FERPA Compliance

Do I need to notify students or parents every time I share education records under an exception?

No. FERPA allows disclosure under specific exceptions without prior consent, and most do not require notice after the fact. Two do carry notice duties: for judicial orders or subpoenas, you must make a fair effort to notify unless the order bars it; for health or safety emergencies, notice is urged but not always required. Routine exceptions like legitimate educational interest or transfers to another school do not call for any notice.

How do I know if my institution’s FERPA training program will hold up in an audit?

Your program is audit-ready if you can produce four pieces of evidence on demand: the training outline, assignment rosters showing who was required to train, completion records with timestamps, and signed attestations that staff understand their duties. ED’s Student Privacy Policy Office now requests training materials and other information from state agencies to show compliance, which signals that proof is an audit standard. If you cannot pull a completion report within five minutes, your tracking system is not enough.

What’s the difference between a FERPA violation and a data breach, and do I report them the same way?

A FERPA violation is any release of PII from education records without consent, even by accident. A data breach is a security incident where PII is accessed or exposed through a system compromise. A breach can trigger a FERPA violation, but not all violations are breaches. Report FERPA violations to your institution’s FERPA compliance officer and, when fitting, to ED’s Student Privacy Policy Office. Report data breaches to affected people and state bodies per breach-notice laws, and to law enforcement if criminal.

Can I share a student’s grade with their parent if the student is over 18 and enrolled in college?

No. Once a student turns 18 or enrolls in a postsecondary institution, FERPA rights transfer to the student, and you cannot disclose education records to parents without the student’s written consent. One exception: if the student is claimed as a tax dependent under IRS rules, the institution may disclose records to parents, though it is not required to. Many institutions ask students to sign a consent form during orientation covering parental access to grades, billing, and financial aid.

How often should I update my definition of legitimate educational interest in the annual FERPA notification?

Review and update it each year before you send the notification, and update it right away after any staff or role change that affects who accesses student records. Your definition must state which roles have access and for what purpose. If you add an advising platform, hire student success coaches, or expand mental health services, those roles and tools must appear in the updated wording. A vague or outdated definition leads staff to share records based on job title alone, which does not meet the standard.