T

e

d

FERPA	Exceptions—Summary

his Privacy	Technical	Assistance	Center	(PTAC)	document	is	designed	to	assist	State	and	local	educational	agencies	(SEAs	and	LEAs)	and	

ducational	institutions	with	determining	under	what	conditions	the	Family	Educational	Rights	and	Privacy	Act	(FERPA)	permits	the	

isclosure	of	personally	identifiable	information	(PII)	from	education	records	to	third	parties,	such	as	researchers,	contractors,	volunteers,	

and	journalists.	

Generally,	FERPA	requires	written	consent	from	parents	or	“eligible	students”	(students	who	are	at	least	18	years	of	age	or	attending	a	postsecondary	institution)	in	order	to	

release	PII	from	education	records.	In	the	absence	of	the	written	consent,	FERPA	permits	an	educational	agency	or	institution	to	disclose	PII	from	an	education	record	of	a	student	

if	the	disclosure	meets	one	or	more	of	the	conditions	outlined	in	20	U.S.C.	§	1232g(b)	and	(h)	–	(j)	and	34	CFR	§	99.31.	Below	is	a	high-level	overview	of	the	four	most	commonly	

used	exceptions	to	the	FERPA	written	consent	requirement,	including	applicable	recordation requirements.	For	a	more	detailed	explanation	of	these	and	other	FERPA	exceptions,	

please	visit	http://ptac.ed.gov.		

Directory Information∗

School Official 

(Schools and LEAs only) Studies Audit or Evaluation

Conditions that must be met

1. A school and/or LEA must

properly designate “directory

information”:

a. Directory information may

only include PII that is

generally not considered

harmful or an invasion of

privacy if disclosed.

b. The policy must clearly

detail the types of PII that

have been designated as

directory information, the

parent’s or eligible

student’s right to refuse to

let any or all of these types

of PII be designated as

directory information, and

the period of time that the

parent or eligible student

has to opt out of such a

disclosure of directory

information.

2. A school and/or LEA must

give a public notice to

parents of students in

attendance and eligible

students in attendance prior

to disclosing directory

information.

3. Subject to a few exceptions,

parents or eligible students

must not have opted out of

the disclosure of directory

information.

1. A school and/or LEA must

a. Establish criteria in the

annual notification of

FERPA rights about who

is a “school official” and

what constitutes a

“legitimate educational

interest”;

b. Determine that the

disclosure is to a school

official who has a

legitimate educational

interest in the education

records; and

c. Use reasonable methods to

ensure that school officials

obtain access to only those

education records in which

they have a legitimate

educational interest.

2. If outsourcing institutional

services or functions to a

third party, outside parties

may be considered “school

officials” if the outside party

a. Performs an institutional

service or function for

which the school would

otherwise use employees;

b. Is under the direct control

of the school with respect

to the use and

maintenance of education

records; and

c. Complies with the PII

from education records

use and redisclosure

requirements.

1. The disclosure of PII from

student education records

must be for, or on behalf of,

an educational agency or

institution, in order to

a. Develop, validate, or

administer predictive

tests;

b. Administer student aid

programs; or

c. Improve instruction.

2. An educational agency or

institution may disclose PII

from education records, and

a “FERPA-permitted entity”

may redisclose PII only if

a. The disclosing educational

entity enters into a

written agreement with

the organization;

b. The study does not

permit identification of

individual parents and

students by anyone other

than representatives of

the organization with

legitimate interests in the

information; and

c. The information is

destroyed when no longer

needed for the study

purposes.

1. The disclosure of PII from education records must be to

a. Audit or evaluate a Federal- or State-supported education

program; or

b. Enforce or comply with Federal legal requirements

related to the program.

2. The receiving entity must be a State or local educational

authority or other FERPA-permitted entity or must be an

authorized representative of a State or local educational

authority or other FERPA-permitted entity.

3. The party disclosing the PII from education records

a. Must enter into a written agreement to designate anyone

other than its employee as its authorized representative

(each new audit, evaluation, or enforcement effort

requires an agreement); and

b. Is responsible for using reasonable methods to ensure to

the greatest extent practicable that the authorized

representative

i. Uses the PII only for the authorized purpose;

ii. Protects the PII from further unauthorized

disclosures or other uses; and

iii. Destroys the PII when no longer needed for the

authorized purpose and in accordance with any

specified time period set forth in a written

agreement.

4. State and local educational authorities and other FERPApermitted entities may redisclose the PII on behalf of the

educational agency or institution. In particular,

a. The disclosure must meet the requirements of an

exception to consent in § 99.31 and either the educational

agency or institution or other FERPA-permitted entity

has complied with the recordkeeping requirements.

5. Authorized representatives of the FERPA-permitted entities

may only redisclose the PII when expressly authorized in

the parties’ written agreement (assuming that the

redisclosure by the authorized representative on behalf of

the FERPA-permitted entity would be permissible under

FERPA).

Legal references

34 CFR §§ 99.3, 99.31(a)(11), 

and 99.37. 

34 CFR §§ 99.31(a)(1) and 

99.7(a)(3)(iii). 

34 CFR § 99.31(a)(6). 34 CFR §§ 99.31(a)(3) and 99.35. 

Other notes

Recordation: FERPA does not 

require educational agencies and 

institutions to record 

disclosures of appropriately 

designated directory 

information (§ 99.32(d)(4)).

Recordation: FERPA 

(§ 99.32(d)(2)) does not require 

educational agencies and 

institutions to record 

disclosures of PII from 

education records to school 

officials under § 99.31(a)(1).

Recordation: FERPA requires 

educational agencies and 

institutions to record all 

disclosures of PII from 

education records to 

organizations made under the 

studies exception (§ 99.32). 

Recordation: FERPA requires educational agencies and 

institutions to record all disclosures of PII from education 

records made under the audit or evaluation exception 

(§ 99.32).

 State and local educational authorities (and other

FERPA-permitted entities listed in § 99.31(a)(3))

redisclosing PII on behalf of the educational agency

or institution must record disclosures according to the

requirements in § 99.32(b)(2).

∗ While	FERPA does	not	require	that	schools	implement	a	directory	information	policy,	if	they	do	so,	certain	conditions	must	be	met.

See	PTAC	website	for	Additional	Resources	and	Glossary:	http://ptac.ed.gov

PTAC-Handout-2V, April 2014 http://ptac.ed.gov