FERPA and Education Records Protection

Identify the education record and the institution's role

FERPA protects qualifying education records at covered educational agencies and institutions. Its definition of personally identifiable information includes direct identifiers and indirect or linked information. Confirm the record, the institution's coverage and the proposed disclosure rather than classifying all educational material in the same way.

Sources: [1] [2]

Review combinations that identify a student

Build representative tests around the actual records used: an attendance export, a class support list or an accommodation workflow. Consider the information that a recipient could combine with other available details. A file with names removed may still contain identifiable information.

Have the record owner review ambiguous findings. Avoid assuming that one national identifier, school ID or keyword is a complete FERPA detection strategy.

Make the disclosure route explicit

The general rule restricts disclosure of personally identifiable information from education records without written consent, but exceptions permit certain disclosures when their conditions are satisfied. Map each sharing workflow to its purpose, recipient, authorisation and applicable conditions. A vendor relationship alone is not enough to settle those questions.

Sources: [3]

Test the routine school workflow

Use safe student examples to test exports and approved transfers. Check whether an incorrect recipient is detected and whether the correct recipient can perform the authorised task. Review support tickets and temporary copies, then document retention and cleanup decisions with the record owner.

Applying this with TRIAS

Use a TRIAS evaluation to test discovery and supported transfer controls against representative education records. Confirm indirect-identifier limitations and legitimate sharing routes. The institution remains responsible for disclosure decisions and the conditions of any FERPA exception.

• Education data protection →
• Controlled file sharing →