RIN number 1875-AA86

Family Educational Rights and Privacy Act (FERPA) 

Supporting Statement

1. Necessity of Information Collected.

The Family Educational Rights and Privacy Act (FERPA) is codified at 20 U.S.C. § 1232g. 

The purpose of the Act is to protect the privacy of students’ education records. FERPA 

affords certain rights to parents and to eligible students (a student who has reached 18 years 

of age or is attending a postsecondary institution at any age) with respect to students’ 

education records. FERPA applies to educational agencies and institutions that receive funds 

from any program administered by the Department of Education. The regulations are found 

at 34 CFR Part 99. 

20 U.S.C. § 1232g(e) requires each educational agency or institution to annually inform 

parents and students of their rights under FERPA (34 CFR § 99.7). 

20 U.S.C. § 1232g(b)(1)(F) permits the nonconsensual disclosure of personally identifiable 

information from students’ education records to organizations conducting studies “for, or on 

behalf of” an educational agency or institution. A change in 2008 to the FERPA regulations 

requires an educational agency or institution that discloses information under this exception 

to consent to enter into a written agreement with the organization that is conducting the study 

(34 CFR § 99.31(a)(6)(ii)(C)(1)-(4)). 

20 U.S.C. § 1232g(b)(4)(A) requires each educational agency or institution to keep a record 

of parties who have asked for and/or received access to the student’s records (34 CFR § 

99.32).

In 2008, the FERPA regulations were amended to require that State and local educational 

authorities and Federal officials and agencies listed in § 99.31(a)(3) maintain a record of 

further disclosures these parties may make on behalf of an educational agency or institution if

the educational agency or institution does not record the further disclosures (34 CFR § 

99.32(a)(1)).

In 2008, the FERPA regulations were amended to require that educational agencies and 

institutions record the particular and significant threat to the health or safety of a student or 

other individuals that formed the basis for a disclosure under 34 CFR § 99.31(a)(10). This is 

in addition to the longstanding requirement in § 99.32 that educational agencies and 

institutions keep a record of parties who have asked for and/or received access to the 

students’ education records (34 CFR § 99.32(a)(5)). 
2

In 2008, the FERPA regulations were amended to require educational agencies and 

institutions to maintain a listing in each student’s record of the State and local educational 

authorities and Federal officials and agencies that may make further disclosures of the 

student’s education records without consent (34 CFR § 99.32(b)(2)). 

The notice of proposed rulemaking (NPRM) was published on March 24, 2008. The final 

regulations were published on December 9, 2008, and relate to this collection. Changes in the 

information collection as a result of comments on the 2008 regulations have been provided as 

necessary for historical background.

The NPRM that this collection follows was published on April 8, 2011, and proposed

additional changes to the FERPA regulations. There was one proposed change in the NPRM 

affecting paperwork burden (§ 99.35(a)(3)). The final regulations, which published on 

December 2, 2011, relate to this collection. The amendments and changes made in the 

collection requirements as a result of feedback received on the regulations are identified 

below.

The 2011 final regulations modified the information collection requirements in § 

99.31(a)(6)(ii) by permitting a State or local educational authority or Federal agencies and 

officials listed in § 99.31(a)(3) to enter into written agreements with organizations 

conducting studies for, or on behalf of, educational agencies and institutions. However, it is 

our opinion that this does not constitute a change or increase in burden because this change 

permits this activity to be undertaken by an official or agency listed in § 99.31(a)(3) on 

behalf of an educational agency or institution under its jurisdiction.

The 2011 final regulations added a definition of the term “authorized representative” to § 

99.3 which would permit the officials listed in § 99.31(a)(3) (a State or local educational 

authority, the Secretary, the Comptroller General of the United States, or the Attorney

General of the United States) to designate any entity or individual to carry out any audit, 

evaluation, or the enforcement of, or compliance with, Federal legal requirements related to 

Federal or State supported education programs. It is our opinion that this does not constitute 

a change or an increase in burden because these entities are already required to record 

disclosures, pursuant to § 99.32(b)(2).

The 2011 final regulations modified the definition of “directory information” in § 99.3, as 

well as makes changes to the directory information provisions in § 99.37. Specifically, the 

regulations modify the definition of “directory information” to clarify that an educational 

agency or institution may designate as directory information and disclose, without consent, a 

student ID number of other unique personal identifier that is displayed on a student ID card 

or badge if the identifier cannot be used to gain access to education records, except when 

used in conjunction with one or more factors that authenticate the user’s identity, such as a 

PIN, password, or other factor known or possessed only by the authorized user. In addition, 

the regulations maketwo changes to § 99.37 concerning directory information: (1) provides 

that parents and eligible student may not use their right to opt out of directory information 

disclosures to prevent an educational agency or institution from requiring students to wear or 

otherwise disclose ID cards or badges; and (2) clarifies that an educational agency or 
3

institution may specify in the public notice it provides to parents and eligible student in 

attendance provided in § 99.37(a) that disclosure of directory information will be limited to 

specific parties, for specific purposes, or both, and that, if an educational agency or 

institution adopts a limited directory information policy, it must limit directory information 

disclosures only to the parties or purposes specified. It is our opinion that this does not 

constitute a change or an increase in burden because educational agencies and institutions 

typically include their directory information notice with their required annual notification of 

rights to parents and eligible students. The model annual notification of rights that is 

discussed under number 3 (Consideration of Improved Information Technology) includes a 

notation that the agency or institution may want to include its directory information public 

notice, as required by § 99.37 of the regulations, with its annual notification of rights under 

FERPA. 

This discussion about § 99.37 was not included in the Paperwork Reduction Act portion of 

the 2011 NPRM, however a discussion was included in our Supplemental Statement to OMB 

about this matter. We noted that, since publication of the NPRM, it has been determined that 

§ 99.37(d) also has an information collection associated with it. As a result, details about this 

information collection are included in this information collection and included in the final 

regulations. Section 99.37(d) requires any educational agency or institution that elects to 

implement a limited directory information policy to specify its policy in the public notice to 

parents and eligible students in attendance at the educational agency or institution. It is our 

opinion that this requirement will not result in an additional burden for most educational 

agencies and institutions because educational agencies and institutions are already required 

under § 99.37(a) to provide public notice of its directory information policy. However, the 

change reflected in amended § 99.37(d) could result in a burden increase for an educational 

agency or institution that currently has a policy of disclosing all directory information and 

elects, under the new regulations, to limit the disclosure of directory information. The 

agency or institution would now be required to inform parents and eligible students that it has 

a limited directory information policy. The notice provides parents and eligible students with 

the opportunity to opt out of the disclosure of directory information. (An educational agency

or institution may decide how to handle any opt outs, depending on individual circumstances 

of the school community.) Additionally, many educational agencies and institutions include 

their directory information notice as part of the required annual notification of rights under §

99.7, which is already listed as a burden and approved under OMB Control Number 1875–

0246. These educational agencies and institutions, therefore, would not experience an 

increase in burden associated with the changes reflected in §99.37(d).

Although no changes were proposed to § 99.7, which requires that educational agencies and 

institutions annually notify parents and eligible students of their rights under FERPA, some 

modifications were made to our model notification associated with this requirement. 

Specifically, to allow parents and eligible students to more fully understand the 

circumstances under which disclosures may occur without their consent, we have amended 

the model annual notifications to include a listing of the various exceptions to the general 

consent rule in the regulations. The model notices (one for elementary and secondary

schools and another one for postsecondary institutions) are included as Appendix B and 

Appendix C with this information collection as well as with the final regulations. The model 
4

notifications are posted on our Web site at the following site address: 

http://www2.ed.gov/policy/gen/guid/fpco/index.html. (A copy of the model notifications are 

enclosed as an appendix.) It is our opinion that this addition to the model notification does 

not increases the currently approved burden of .25 hours (15 minutes) previously estimated 

for the annual notification of rights requirement. 

The 2011 final regulations amended the enforcement provisions (§§ 99.60-67) to clearly set 

forth the Department’s authority to investigate and enforce alleged violations of FERPA by

State and local educational authorities or any other recipients of Department funds under a 

program administered by the Secretary. It is our belief that this does not constitute a change 

or increase in burden because the change just clarifies the Department’s authority to enforce 

applicable FERPA requirements with all recipients of Department funds.

The 2011 final regulations added a new requirement under § 99.35(a)(3) that requires that the 

agency headed by an official listed in § 99.31(a)(3) to use a written agreement to designate 

any authorized representative other than an agency employee. The written agreement must: 

(1) designate the individual or entity as an authorized representative; (2) specify the 

information to be disclosed and the purpose for which the information is disclosed to the 

authorized representative (i.e., to carry out an audit or evaluation of Federal or State 

supported education programs, or for the enforcement of or compliance with Federal legal 

requirements that relate to those programs); (3) require the authorized representative to 

destroy or return to the State or local educational authority or agency headed by an official 

listed in § 99.31(a)(3) personally identifiable information from education records when the 

information is no longer needed for the purpose specified; (4) specify the time period in 

which the information must be returned or destroyed; and (5) establish policies and 

procedures to protect personally identifiable information from education records from further 

disclosure (except back to the disclosing entity) and unauthorized use, included limiting use 

of information by only those authorized representatives of the entity with legitimate 

interested. The burden for States is estimated at 40 hours annually for each educational 

authority (one for K-12 and one for postsecondary). This 40 hours of burden was reached by 

estimating that 103 State authorities (including both K-12 and postsecondary authorities)

may handle the agreements up to 10 times per year with an estimated time of 4 hours per 

agreement. This would be an increase in burden of 4,120 burden hours.

In the 2011 final regulations, a burden estimate of 4 hours annually was added for large 

school districts or local educational agencies (LEAs) and postsecondary institutions (1,452 

educational agencies and institutions with a student population of over 10,000). Assuming 

each large LEA and postsecondary institution handles the agreements up to 1 time per year 

with an estimated 4 hours per agreement, the total anticipated increase in annual burden for 

large LEAs and postsecondary institutions would be 5,808 hours for this requirement. 

Therefore, the total estimated burden for this provision is 9,928 hours. Note: For purposes 

of the burden analysis for §99.35(a)(3), the burden on large LEAs and postsecondary

institutions was estimated because we believe that estimating burden for these institutions 

captures the high-end of the burden estimate. The burden for smaller LEAs and 

postsecondary institutions under §99.35(a)(3) is expected to be much less than estimated 

here.
5

This is an extension of a previously approved information collection request.

2. Purpose of Use of Information Collected.

Educational agencies and institutions, such as school districts and postsecondary institutions 

are required to annually notify parents and students of their rights under FERPA. A school is 

not required to notify parents and students individually, but rather is required to provide the 

notice by any means that are reasonably likely to inform them of their rights under FERPA. 

These means could include publication in the school activities calendar, newsletter, school 

website, student handbook, or a combination of these methods. 

In addition, educational agencies and institutions must keep a record of each request for 

access to and each disclosure of personally identifiable information from the education 

records of each student. FERPA includes several exceptions to the recordation requirement. 

The recordation requirement does not apply to requests from or disclosures to: (1) the parent 

or eligible student; (2) a school official with legitimate educational interest; (3) a party with 

written consent from the parent or eligible student; (4) a party seeking directory information; 

or (5) a party seeking or receiving the records as directed by a Federal grand jury or other law 

enforcement subpoena and the issuing court or agency has ordered that the existence or 

contents of the subpoena or the information furnished in response not be disclosed. 

FERPA requires that educational agencies and institutions – typically schools, school 

districts, and postsecondary institutions – also record the names of additional parties, if any,

to which the receiving party may make further disclosures of the information on behalf of the 

educational agency or institution. The 2008 changes to the FERPA regulations require that 

State and local educational authorities and Federal officials and agencies that receive 

personally identifiable information from students’ education records – such as a State 

department of education – record any further disclosures of the information they make if the

disclosing school did not record the further disclosures, or if the information was received 

from another education authority or Federal official or agency listed in § 99.31(a)(3) of the 

FERPA regulations.

As a result of the 2008 changes to the recordation requirements in the regulations, 

educational agencies and institutions must also maintain a listing in students’ records of the 

State and local educational authorities and Federal officials and agencies that may make 

further disclosures of the students’ education records on behalf of the agency or institution so 

that parents and eligible students will be made aware of these further disclosures. This 

requirement would only apply in those cases where educational agencies and institutions 

have disclosed personally identifiable information from education records to any of these 

authorities listed in § 99.31(a)(3) of the FERPA regulations. Under this exception to 

FERPA’s general rule of consent, educational agencies and institutions are permitted to 

disclose education records to these particular officials and authorities for audit, evaluation, or 

compliance or enforcement activities, under the conditions of § 99.35 of the regulations. The 

information collection requirements are necessary to carry out the purpose of FERPA.
6

Further, the FERPA regulations require an educational agency or institution to enter into a 

written agreement with an organization conducting studies, for or on its behalf, for purposes 

of testing, student aid, and improvement of instruction. The written agreement requirement 

only applies if the educational agency or institution opts to disclose personally identifiable 

information from student’s education records under this exception to the general consent 

requirement of FERPA. The agreement must: (1) designate the individual or entity as an 

authorized representative; (2) specify the PII from education records to be disclosed; (3) 

specify that the purpose for which the PII from education records is disclosed to the 

authorized representative is to carry out an audit or evaluation of Federal- or State-supported 

education programs, or to enforce or to comply with Federal legal requirements that relate to 

those programs; (4) describe the activity to make clear that it legitimately fits within the 

exception of §99.31; (5) require the authorized representative to destroy PII from education 

records when the information is no longer needed for the purpose specified; (6) specify the 

time period in which the PII from education records must be destroyed; and (7) establish 

policies and procedures, consistent with FERPA and other Federal and State confidentiality 

and privacy provisions, to protect PII from education records from further disclosure (except 

back to the disclosing entity) and unauthorized use. The information collection requirements 

are necessary to carry out the purposes of FERPA.

3. Consideration of Improved Information Technology.

The advancement of and more common use of computer systems have dramatically reduced 

the burden of graphically producing the notification of rights required under the FERPA 

since it was enacted in 1974. Electronic systems also enable schools to more easily create 

and maintain disclosure information for the mandatory recordation requirements. 

The Family Policy Compliance Office (FPCO), which administers FERPA, makes available 

to school officials a model notification that can be adapted by schools. The models are 

posted on the Department’s Web site -- http://www.ed.gov/policy/gen/guid/fpco/ferpa/leaofficials.html and http://www.ed.gov/policy/gen/guid/fpco/ferpa/ps-officials.html. FPCO 

routinely responds to telephone and email inquiries from school officials 

(elementary/secondary as well as postsecondary), providing them with technical assistance 

on FERPA. The technical assistance often includes information on where to locate and 

download the model notifications. In addition, FPCO annually notifies school districts of 

their obligations under FERPA, as required by the Elementary and Secondary Education Act 

(ESEA). The annual notice includes a copy of the model FERPA notification and 

information on where to locate and download the model. This greatly reduces the burden on 

schools of having to write the required notification.

Other than the use of computers to reduce the burden of writing agreements, there is no 

specific technology that would reduce the burden of written agreements. However, FPCO 

will provide technical assistance and guidance to those educational agencies and institutions 

that request assistance.

4. Efforts to Identify Duplication.
7

The provisions do not duplicate any other Federal requirements. No other agency has this 

information.

5. Burden Minimization as Applied to Small Businesses.

These regulations are consistent with the Administration’s regulatory principles to minimize 

burden on small entities.

6. Consequences of Less Frequent Data Collection.

Should these collections of information under FERPA be conducted less frequently, the 

requirements of the Act would not be carried out.

7. Special Circumstances Governing Data Collection.

These information collection requirements are consistent with the guidelines in 5 CFR 

1320.5(d)(2).

8. Consultation Outside the Agency.

The Department informed the public of these information collection activities through the

NPRM for FERPA which published on April 8, 2011 (Vol. 76, No. 68, page 19726) and 

provided the comment period for this information collection activity. The information 

collection was submitted to OMB as soon as the NPRM was published. Although some 

changes have been made to the final regulations, no public comments on information 

collection requirements were received as a result of the April 8, 2011, NPRM.

For the previous NPRM, the Department informed the public through a 60-day and a 30-day

notice that the NPRM for FERPA was published on March 24, 2008. The NPRM (Vol. 73, 

No. 57, page 15574) did not provide a comment period for the information collection 

activity. However, the 60-day notice provided and the 30-day notice provided the 

appropriate comment period for the information collection activity.

Prior to this time, the public had the opportunity to comment on the proposed changes in the 

collection of information under FERPA during the publication of an NPRM in the March 14, 

1996, Federal Register. See 61 Fed. Reg. 10664 (March 14, 1996). One of the proposed 

changes (which was adopted) was to remove the previous requirement that educational 

agencies and institutions have a student records “policy” pursuant to § 99.6 of the regulations 

and to transfer some of the policy requirements to the notification requirement of § 99.7 of 

the regulations. As explained in the final regulations – 61 Fed. Reg. 59292 (November 21, 

1996) – the purposes in removing the requirement that schools maintain a policy were: (1) 

the change will help to ensure that parents and eligible students receive more effective 

notification of their rights under the law; and (2) the change will afford schools greater 

flexibility by removing requirements that are not statutory and not necessary to implement 

the law.
8

Seven commenters submitted letters in support of the proposal to remove the regulatory

requirement that schools adopt student records policies. One commenter said that the change 

will not only lessen the burden on schools, but would facilitate communication between the 

schools and parents or eligible students. The same commenter also said that the cost 

associated with the change would not be significant because his school district updates its 

notices regardless of statutory requirements. Another commenter representing a large public 

university stated that the “flexibility offered by not requiring having such a [student records] 

policy is a laudable goal.” Six commenters opposed the change. One commenter stated that 

the current requirements are not burdensome. Two noted that the policy is helpful in 

educating school officials about FERPA, and that the change in requirements would be 

burdensome on schools because they would incur costs to publish a longer notification. 

After consideration of the last comment, the Department removed some of the information 

that was proposed to be included in the notification as not necessary to meet the statutory

requirement. (See discussion at 61 Fed. Reg. 59293, first column.) At the time of these final 

regulations, FPCO made a hard copy model notification available to schools. Both model 

notifications (one for elementary/secondary schools and one for postsecondary institutions) 

were published in the Federal Register. (See 61 Fed. Reg. 59297 – 59298.) Since that time, 

we have included the models on our Web site. 

The other change in 1996 involving the collection of information under FERPA was a change 

to the recordation requirements of § 99.32. The change resulted in the addition of the fifth 

exception to the requirement. Specifically, schools are not required to record disclosure of 

information resulting from certain types of subpoenas and court orders issued for law 

enforcement purposes. This change reduced the recordkeeping burden for these types of 

disclosures. No comments were received on this change. 

Regulations from 1996 until 2008 did not involve any changes in the collection of 

information under FERPA. However, in 2008, additional information collection 

requirements were added to FERPA. While no specific consultation with school officials 

occurred, they had the opportunity to comment on the new requirements at the time of the 

2008 NPRM. Educational agencies and institutions did not independently expressed concern 

over costs or burden because of these requirements. FPCO sought ways to minimize burden 

of these requirements, such as making model notices easily available to school officials.

As a result of the March 28, 2008, NPRM, the Department did receive comments on some of 

the information collection activities. In the NPRM, we specifically noted that the 

Department was interested in relieving any administrative burdens associated with recording 

disclosures of education records and, therefore, invited public comments on whether a State 

educational agency (SEA), the Department, or other authority or official listed in § 99.31(a) 

(3) should be allowed to maintain the record of the redisclosures it makes on behalf of an 

educational agency or institution under § 99.32.

Several commenter’s, including officials representing State departments of education, stated 

that an SEA (or other authority or official listed in § 99.31(a) (3)) should be responsible for 

maintaining the record of disclosure required under § 99.32 when it rediscloses information 

on behalf of educational agencies and institutions. The commenter’s stated that requiring 
9

each educational agency or institution, such as school districts, to record each redisclosure 

made by an SEA or other State educational authority on its behalf imposes an unacceptable 

recordkeeping burden on school districts and is impractical for State educational authorities 

to adhere to in making further disclosures on behalf of the agency or institution. In response 

to these comments, we revised § 99.32 to require the State and local educational authorities 

and Federal officials listed in § 99.31(a)(3) to maintain the record of further disclosures if the 

educational agency or institution does not do so and make it available to the educational 

agency or institution upon request. We agree that by requiring State and Federal authorities 

and officials to record their redisclosures in these circumstances school districts will have 

less total paperwork burden because schools will not have to comply with the recordkeeping 

requirement in these instances.

The Department also received comments from a number of parties expressing support and 

appreciation for the explicit requirement for a written agreement whenever an educational 

agency or institution discloses personally identifiable information from education records to 

organizations conducting certain studies under § 99.31(a)(6). A national association of 

school boards pointed out that, while this change created another paperwork burden for 

school districts, the group did not object to the written agreement requirement because 

putting in writing the requirements regarding the use and destruction of data may improve 

compliance with FERPA. This commenter also recommended that the use and destruction of 

data should be made clear in this new provision. A national association representing 

postsecondary officials commented that, among other things, we should restrict access to 

personally identifiable information within the organization conducting the study to those 

individuals with a legitimate interest in the information. We received other comments that 

indicated a need to further clarify the specific types of information that must be contained in 

the written agreement between an educational agency and institution and an organization 

conducting a study for the agency or institution, and we included these clarifications in the 

final regulations. 

A 60 day comment notice was published in the Federal Register on June 2, 2014 (74 Fr 

31315). The department received 64 comments. A summary response to the comments is 

provided in the attached “Comments Response 082714.doc”. A 30 day notice was published.

9. Payments or Gifts to Respondents.

The information collection’s respondents will not receive any payment or gift for submitting 

any information related to FERPA.

10. Assurance of Confidentiality.

FERPA requires that educational agencies and institutions protect the privacy of student’s 

education records, including the privacy of the record of request for the student’s education 

records. As the respondents of the information collection requirements, school officials do 

not need assurance of confidentiality because the requirements are intended to advance the 
10

privacy rights of parents and eligible students (a student who has reach 18 years of age or is 

attending a postsecondary institution at any age).

11. Questions of Sensitive Nature.

The Act does not address nor call for questions of a sensitive nature.

12. Annual Hour Burden for Respondents/Record keepers

FERPA’s Annual Notification of Rights Requirement (34 CFR § 99.7)

There are approximately 20,629 school districts and postsecondary institutions affected by

the annual notification of rights requirement in FERPA (34 CFR § 99.7). We estimate that an 

average of .25 hours (15 minutes) per response is required for the annual notification of 

rights requirement. From administrative experience, we have determined that, at the 

elementary/secondary level, school districts (as opposed to individual schools) are the entities 

that typically issue the annual notification of FERPA rights. At the postsecondary level, it is 

the individual institutions that issue the notice. Following is a breakdown of school districts 

and postsecondary institutions:

No. School Districts: 14,166

 Burden Hours: x .25

Total Burden Hours = 3,542

No. Postsec. Inst.: 6,463

Burden Hours: x .25

Total Burden Hours = 1,616

School District Burden Hours: 3,542

Postsec. Inst. Burden Hours: + 1,616

Grand Total Burden Hours: 5,158

Since most agencies and institutions met major requirements during the early years 

after FERPA’s passage in 1974 and after publication of the revised regulations in 1988, the 

year-to-year cost is minimal. 

FERPA’s Written Agreement Requirement (34 CFR § 99.31(a)(6)(ii)(C)(1)-(4))

20 U.S.C. § 1232g(b)(1)(F) permits the nonconsensual disclosure of personally identifiable 

information from students’ education records to organizations conducting studies “for, or on 

behalf of” an educational agency or institution for specified purposes. A change to the 

FERPA regulations in 2008 requires that, if an educational agency or institution discloses 

personally identifiable information under this exception to consent, it must enter into a 
11

written agreement with the organization that is conducting the study (34 CFR § 

99.31(a)(6)(ii)(C)(1)-(4)). 

The regulations in § 99.31(a)(6)(ii)(C) require an educational agency or institution to enter 

into a written agreement before disclosing personally identifiable information from education 

records, without consent, to organizations conducting studies for, or on behalf of, the 

educational agency or institution to: (a) develop, validate, or administer predictive tests; (b) 

administer student aid programs; or (c) improve instruction. The written agreement must 

specify the purpose or purposes, scope, and duration of the study or studies and the 

information to be disclosed, require the organization to conduct the study in a manner that 

does not permit personal identification of parents and students by anyone other than 

representatives of the organization with legitimate interests, require the destruction or return 

of the information to the educational agency or institution when the study is completed, and 

specify the time period for destruction or return of the information.

As discussed with OMB, the Department does not have any information on how many 

educational agencies and institutions actually disclose information to organizations under this 

exception. Therefore, we are unable to estimate the additional burden, if any, for the new 

requirements in § 99.31(a)(6)(ii)(C). However, it is our opinion that any additional burden of 

entering into written agreements to comply with this change is unlikely to be significant 

because most educational agencies and institutions already specify the terms under which 

personally identifiable information can be used when it is disclosed to organizations for these 

types of studies. Although this change will create an additional information collection 

requirement, the Department believes the benefits of the written agreement outweigh any 

additional burden because it will ensure better compliance with FERPA and provide clarity 

for both researchers and educational agencies and institutions about the restrictions and use 

of personally identifiable information disclosed under § 99.31(a)(6) for studies. 

The 2011 final regulations modified this provision to permit a State or local educational 

authority or Federal agencies and officials listed in § 99.31(a)(3) to enter into these written 

agreements with organizations conducting studies for, or on behalf of, educational agencies 

and institutions. The Department does not believe this constitutes a change or an increase in 

burden because there is no evidence that this would be considered a burden. Additionally, 

we only anticipate that State educational authorities (and not the other officials listed in § 

99.31(a)(3)) will enter into these agreements on behalf of the schools under their 

jurisdictions. Also as noted above, it is our opinion that the benefits of the written agreement 

outweigh any additional burden because it will ensure better compliance with FERPA. It will 

also provide clarification for both organizations conducting studies and educational agencies 

about the restrictions and use of personally identifiable information disclosed under this 

exception to FERPA consent requirement.

FERPA’s Recordkeeping Requirement (34 CFR § 99.32)

In 2010, we informally contacted eight school officials – three officials at 

elementary/secondary school districts, one official at an elementary school, and four officials 

at postsecondary institutions – to find out about their individual recordkeeping practices. 
12

Most of the schools we contacted used a paper-based system for recordkeeping, while some 

of the postsecondary institutions used both paper-based and electronic. From our informal 

review, it was clear that recordkeeping is done at the individual school (as opposed to the 

school district at the elementary/secondary level) and the individual postsecondary

institution. As a result, it was estimated that an average of .0833 hours (5 minutes) per 

disclosure is required for the recordkeeping requirement. The average number of disclosures

of individual student records per year was based on responses from the eight school officials. 

(Based on the type and size of the school, the number of releases varies.) 

It was not clear that schools recognize that FERPA requires that they record disclosures 

made of personally identifiable information from students’ education records to State 

authorities, such as when a school discloses personally identifiable information on all 

students in attendance to a State education department on the elementary/secondary level or 

to the State postsecondary educational authority on the college level. Without more 

information on the practices of schools in this regard, it is difficult to accurately estimate the

specific burden hours for this recordkeeping requirement. However, we assumed that many

of these schools, especially at the postsecondary level and more urban school districts, 

utilize computerized methods to record disclosures, which would make it less burdensome to 

record disclosures for large numbers of students. Where there are large numbers of 

disclosures and no computerized method is used to indicate that a disclosure occurred, 

FPCO has advised schools that they may utilize a single notice about the mass disclosure. 

When a parent or student requests access to his or her record of disclosure, the school may

provide the notice with the information concerning the disclosure to the parent or student at 

the time of the request, thereby minimizing the burden on the school. However, because

these recordations are not exempt from FERPA’s recordkeeping requirement, we have 

included an estimate for the burden of recording disclosures of all students in attendance to 

State authorities. We estimate that schools must share this information with State officials 

twice a year and estimate that it would take schools 1 hour to either make the recording via 

their computer system or develop a notation and make it available to parents or students 

asking to inspect this record. As explained elsewhere, it is our administrative experience 

that few parents and students request to see this record. 

The 2011 NPRM proposed a definition of the term “authorized representative” to § 99.3 

which would permit the officials listed in § 99.31(a)(3) (a State or local educational 

authority, the Secretary, the Comptroller General of the United States, or the Attorney

General of the United States) to designate any entity or individual to carry out any audit, 

evaluation, or the enforcement of, or compliance with, Federal legal requirements related to 

Federal or State supported education programs. It is our opinion that this does not constitute a 

change or an increase in burden because these entities are already required to record 

disclosures, pursuant to § 99.32(b)(2), as described in this section.

For the general recordkeeping requirement of § 99.32(a) for recordation of individual 

disclosures, following is a breakdown of individual schools (public elementary, secondary, 

or combined) and postsecondary institutions:

No. of Schools: 97,382
13

Average No. of Disclosures: x 192

# Of Responses 18,697,344

Hours/Response: x .0833

Burden Hours 1,557,489 

No. of Postsec. Inst.: 6,463

Average No. of Disclosures: x 192

# of Responses 1,240,896

Hours/Response: x .0833

Burden Hours 103,367

Elementary/Secondary School Burden Hours: 1,557,489

Postsec. Inst. Burden Hours: + 103,367

Total Burden Hours for recordation 

of individual disclosures: 1,660,856

For the recordkeeping requirement for disclosures of all students in attendance to State 

educational authorities, following is a breakdown of individual schools (public elementary, 

secondary, or combined) and postsecondary institutions:

No. of Schools: 97,382

Average No. of Disclosures: x 2

# of Responses 194,764

Hours/Response: x 1

Burden Hours 194,764 

No. of Postsec. Inst.: 6,463

Average No. of Disclosures: x 2

# of Responses 12,926

Hours/Response: x 1

Burden Hours 12,926
14

Elementary/Secondary School Burden Hours: 194.764

Postsec. Inst. Burden Hours: + 12,926

Total Burden Hours for recordation 

of disclosures of all students: 207,690

Total Burden Hours for recordation 

of individual disclosures: 1,660,856

Total Burden Hours for recordation 

of disclosures of all students: 207,690

Total Burden Hours for Recordation 1,868,546

 

The number of school districts and the number of postsecondary institutions subject to 

FERPA is based on the number of public school districts and the number of Title IV 

postsecondary institutions, as reported in the National Center for Education Statistics’ 

(NCES’) Digest of Education Statistics. See 

http://nces.ed.gov/programs/digest/d07/tables/dt07_005.asp. The number of affected 

schools reported to OMB in previous years was higher, but we believe this number that is 

based on NCES’ count is more accurate.

§ 99.32(a)(1) –

In 2008, the regulations were amended (§ 99.32(a)(1)) to require educational agencies and 

institutions to maintain a listing in each student’s records of the State and local educational 

authorities and Federal officials and agencies that may make further disclosures of the 

student’s education records on behalf of the agency or institution without consent. This only

applies when the school discloses personally identifiable information to one of these parties. 

Because schools are already required to record their disclosures to a State and Federal 

authorities under § 99.32(a), we do not believe that this new requirement will impose any

new burden. 

§ 99.32(a)(4) –

The 2008 final regulations also added § 99.32(a)(4) to require that, upon the request of a 

parent or eligible student, an educational agency or institution must obtain a copy of the 

record of further redisclosures described under § 99.32(b)(2) and make it available for 

review to the parent or eligible student.

State educational authorities and Federal officials and agencies that maintain records of 

redisclosures will have to make that information available to the educational agency or 

institution whose records were redisclosed, upon request, so that the agency or institution 

can make that record available to a parent or eligible student who has asked to inspect and 

review the student’s record of disclosures. Our estimate is that two educational authorities 
15

or agencies in each State and the District of Columbia (one for K-12 and one for 

postsecondary) and the Department itself, for a total of 103 authorities, will maintain the 

required records of redisclosures. It is also estimated that it will take .25 hours (15 minutes) 

per disclosure to locate and print a record of disclosures for this requirement. Based on our 

administrative experience over the years, we assume that few parents and students request 

this information and, therefore, use an estimate that one tenth of one percent of a total of 

68.1 million students will make such a request each year, or 68,076 requests. This translates 

to an average of 3 disclosures per school. (We divided total number of schools by total 

number of requests.) The total number of disclosures by State and Federal educational 

authorities will be the same as that calculated for schools. 

No. of Schools & Postsec. Inst.: 20,629

Average No. of Disclosures: x 3

# of Responses 61,887

Hours/Response: x .25

Burden Hours 15,472

Average No. of Disclosures by

 State & Fed. Ed. Authorities: 61,887

Hours/Response: x .25

Burden Hours 15,472 

School Burden Hours: 15,472

State & Fed. Burden Hours: + 15,472

Total Burden Hours 30,944

§ 99.32(a)(5) –

The 2008 final regulations added a new section (§ 99.32(a)(5)) that requires that a school that 

discloses information under the health and safety emergency exception in § 99.36 record the 

particular and significant threat that formed the basis for the disclosure and the parties to whom 

the education records were disclosed. Because § 99.32(a) already requires schools to record 

disclosures made under §99.36, including the legitimate interests the parties had in requesting or 

obtaining the information, we believe these changes will not create any significant additional 

administrative costs for schools and that the benefit of requiring recordation of this information 

outweighs the costs. This new requirement in § 99.32(a)(5) simply clarifies the type of 

information that must be recorded when a school discloses personally identifiable information in 

response to a health or safety emergency, either for one student or for all students in a school. 

We do not believe that the new requirement modifies the burden reported under § 99.32.
16

§ 99.32(b)(2) –

The 2008 final regulations added a requirement (§ 99.32(b)(2)) that State and local educational 

authorities and Federal officials listed in § 99.31(a)(3) maintain a record of further disclosures 

these parties may make of personally identifiable information from education records if the 

educational agency or institution does not do so. While the Department did not officially seek 

comments on any information collection activities in the March 28, 2008, NPRM, we did receive 

comments on some of these activities. In the NPRM, we specifically noted that the Department 

was interested in relieving any administrative burdens associated with recording disclosures of 

education records and, therefore, invited public comments on whether a State educational agency

(SEA), the Department, or other authority or official listed in § 99.31(a)(3) should be allowed to 

maintain the record of the redisclosures it makes on behalf of an educational agency or 

institution under § 99.32.

Several commenters, including officials representing State departments of education, stated that 

an SEA (or other authority or official listed in § 99.31(a)(3)) should be responsible for 

maintaining the record of disclosure required under § 99.32 when it rediscloses information on 

behalf of educational agencies and institutions. The commenter’s stated that requiring each 

educational agency or institution, such as school districts, to record each redisclosure made by an 

SEA or other State educational authority on its behalf imposes an unacceptable recordkeeping 

burden on school districts and is impractical for State educational authorities to adhere to in 

making further disclosures on behalf of the agency or institution. 

In response to these comments, we revised § 99.32 to require the State and local educational 

authorities and Federal officials listed in § 99.31(a)(3) to maintain the record of further 

disclosures if the educational agency or institution does not do so and make it available to the 

educational agency or institution upon request. We agree that by requiring State and Federal 

authorities and officials to record their redisclosures in these circumstances school districts will 

have less total paperwork burden because schools will not have to comply with the 

recordkeeping requirement in these instances. 

State educational authorities and Federal officials listed in § 99.31(a)(3) will incur new 

information collection burdens if they maintain the record of redisclosure for the educational 

agency or institution on whose behalf they redisclose education records under the regulations. 

We estimate that two educational authorities or agencies in each State and the District of 

Columbia (one for K-12 and one for postsecondary) and the Department itself, for a total of 103 

authorities, will maintain the required records of redisclosures. (We anticipate that educational 

agencies and institutions will record under § 99.32(b)(1) any further disclosures made by the 

other Federal officials listed in § 99.31(a)(3), the U.S. Comptroller General and the U.S. 

Attorney General, as is currently required for redisclosures made by other parties on behalf of the 

educational agency or institution. See 34 CFR § 99.32(b)(1).) We estimate further that these 

authorities will need to record two redisclosures per year from their records. We estimate that an 

average of .0833 hours (5 minutes) per disclosure is required for this new recordkeeping 
17

requirement. We also assume for purposes of this analysis that State educational authorities and 

the Department already have software that will allow them to record these disclosures 

electronically. 

No. of St. & Fed. Edu. Authorities: 103

Average No. of Disclosures: x 2

# of Responses 206

Hours/Response: x .0833

Burden Hours 17

§ 99.35(a)(3)

The 2011 final regulations added a new requirement under § 99.35(a)(3) that requires an agency

headed by an official listed in § 99.31(a)(3) to use a written agreement to designate any 

authorized representative other than an agency employee. The written agreement must: (1) 

designate the individual or entity as an authorized representative; (2) specify the PII from 

education records to be disclosed; (3) specify that the purpose for which the PII from education 

records is disclosed to the authorized representative is to carry out an audit or evaluation of 

Federal- or State-supported education programs, or to enforce or to comply with Federal legal 

requirements that relate to those programs; (4) describe the activity to make clear that it 

legitimately fits within the exception of §99.31; (5) require the authorized representative to 

destroy PII from education records when the information is no longer needed for the purpose 

specified; (6) specify the time period in which the PII from education records must be destroyed; 

and (7) establish policies and procedures, consistent with FERPA and other Federal and State 

confidentiality and privacy provisions, to protect PII from education records from further 

disclosure (except back to the disclosing entity) and unauthorized use. We estimate that the 

burden for States is estimated at 40 hours annually for each educational authority (one for K-12 

and one for postsecondary). This 40 hours of burden was reached by estimating that 103 State 

authorities may handle the agreements up to 10 times per year with an estimated time of 4 hours 

per agreement. Total anticipated increase in annual burden would be 4,120 hours for this new 

requirement.

In addition, the burden for large LEAs and postsecondary institutions (1,452 educational 

agencies and institutions with a student population of over 10,000) is estimated to be 4 hours 

annually. Assuming each large LEA and postsecondary institution handles the agreements up to 

1 time per year with an estimated 4 hours per agreement, the total anticipated increase in annual 

burden for large LEAs and postsecondary institutions would be 5,808 hours for this requirement. 

The total estimated burden under this provision is 9,928 hours.

No. of St. & Fed. Edu. Authorities: 103

Average No. of Disclosures: x 10

# of Responses 1,030

Hours/Response: x 4__ 
18

Burden Hours 4,120

No. of Large LEAs & Post. Inst: 1,452

Average No. of Disclosures: x 1

# of Responses 1,452

Hours/Response: x 4_

Burden Hours 5,808

State & Fed. Burden Hours: 4,120

School Burden Hours: 5,808 

 Total Burden Hours for 

 Written Agreements: 9,928

GRAND TOTAL

Total Number of Respondents: 105,399 Total Number of Responses:20,293,021 

Total Number of Burden Hours: 1,914,593 

This is a list of the regulatory requirements which is provided with more detailed description 

(above) in the Supporting Statement, A12. Each requirement lists the burden for schools, 

institutions, and/or state or local education authorities with the number of responses and total 

burden hours. 

Remove IC Title Status Responses Hours Dollars Document

Type

Form No. Form 

Name

Annual 

Notification of 

Rights 

Requirement 

(Section 99.7) 

for School 

Districts

No Change 14166 3542 0 Other Regulatory 

Requirement 

Annual 

Notification of 

Rights 

Requirement 

(Section 99.7) 

for 

Postsecondary 

Institutions

No Change 6463 1616 0 Other Regulatory 

Requirement

FERPA

Recordkeeping 

Requirement 

(99.32) 

for schools

No Change 18697344 1557489 0 Other Regulatory 

Requirement

FERPA 

Recordkeeping 

No Change 1240896 103367 0 Other Regulatory 

Requirement
19

Requirement 

(Section 99.32) 

for

Postsecondary 

Institutions

FERPA Section 

99.32 

Recordkeeping 

Requirement for

Disclosures 

(Schools)

No Change 194764 194764 0 Other Regulatory 

Requirement

FERPA Section 

99.32 

Recordkeeping 

Requirement for 

Disclosures 

(Postsecondary 

Institutions)

No Change 12926 12926 0 Other Regulatory 

Requirement

FERPA Section 

99.32(a)(4) 

Regulatory 

Requirement for 

Schools and 

Postsecondary 

Institutions

No Change 61887 15472 0 Other Regulatory 

Requirement

FERPA Section 

99.32(a)(4) for

State Education 

Authorities

No Change 61887 15472 0 Other Regulatory 

Requirement

FERPA Section 

99.32(b)(2) for 

State Education 

Authorities

No Change 206 17 0 Other Regulatory 

Requirement

FERPA Section 

99.35 (a) (3)

For State 

Educational 

Authorities 

 

No Change 1030 4120 0 Other Regulatory 

Requirement

FERPA Section 

99.35

(a) (3) For large 

LEAs and 

postsecondary 

institution

Authorities 

No Change

1452 5808

0 Other Regulatory 

Requirement

Total responses under this ICR: 20,293,021 Total burden hours under this ICR: 1,914,593

13. Annual Cost Burden to Respondents

The total for the capital and start-up cost components of both information collection 

requirements is zero. The information collection requirements under FERPA do not require 

the purchase of any capital equipment nor create any start-up costs. Computers and word 

processing software used to complete this information collection are part of the respondents’

customary and usual business or private practices, and therefore are not included.

The total for operation and maintenance for this information collection is zero. The 

information collection does not create costs associated with generating, maintaining, and 
20

disclosing or providing the information that is not already identified in question 12 of this 

supporting statement.

14. Estimated Annual Cost to the Federal Government.

No measurable percentage of staff time is devoted to assisting educational agencies and 

institutions in either of these information collection requirements. With regard to the annual 

notification requirement, as explained in the response to question 3, the Department posts 

model notifications (one for elementary/secondary and one for postsecondary) on its website. 

The model can be downloaded and easily be adapted by schools for use. With regard to the 

recordkeeping requirements, staff routinely provides technical assistance on other aspects of 

the law, but the recordkeeping requirements have become routine with schools and appear to 

not be an issue of concern. 

15. Reasons for Changes to Burden Hours Estimated 

This is an extension of a previously approved information collection request. There are no 

changes in burden and responses.

16. Collection of Information with Public Results.

The results of the collection of information will not be published.

17. Approval to Not Display Expiration Date.

ED is not seeking this approval.

18. Exception to the Certification Statement.

ED is not requesting any exceptions to the “Certification for Paperwork Reduction Act 

Submissions.”