Skip Navigation
Forum Guide to Protecting the Privacy of Student Information: State and Local Education Agencies

Section 2: Summary of Key Federal Laws


Education agency administrators and parents share a common interest in ensuring that personal information about children in elementary and secondary schools is kept confidential. Many are unaware of the protection offered by state and federal laws. In this section, we inform administrators and parents about how federal laws protect information maintained in school and education agency records. The guidelines in this section offer practical information to education agency personnel and policymakers on developing procedures that will work for families and schools.

This material reflects only the broad outline of federal privacy policy requirements. The material describes federal policy principles, many of which are supplemented by additional state statutes or local regulations. Readers should be cautioned that these descriptions are not legally binding and that they should direct specific questions either to local and state legal experts or to the appropriate federal government offices. Figure 2–1, found at the end of this chapter, summarizes federal laws that govern the privacy of education records for elementary and secondary education.


  • Provide an overview of all federal laws that are primarily concerned with or include provisions to safeguard the privacy of student education records
  • Familiarize readers with specific aspects of student records that are governed by current federal laws and regulations
  • Provide resources to further understanding of federal laws

Key Points

  • FERPA applies to education agencies, institutions, and schools that receive funds from the U.S. Department of Education.
  • FERPA establishes broad privacy protections for education records.
  • Other federal laws, such as the National School Lunch Act, affect data collection, maintenance, and disclosure procedures.
  • FERPA grants parents and eligible students access to education records and restricts disclosure of this information without their consent, with some exceptions.
  • Districts’ written privacy policies ensure the uniform application of FERPA.
  • FERPA protects most information collected by schools about students. However, sole possession records (e.g., teachers’ informal notes), records of school-based law enforcement units, and employment records do not fall under the jurisdiction of FERPA.
  • Directory information of individual students may be released without prior consent. However, school districts must give public notice of what is considered in this category and provide parents an opportunity to opt out.
  • The U.S. Department of Education does not require local education agencies to notify parents or eligible students individually of their rights, but agencies must provide notice where it is likely to be seen.
  • Parents and eligible students may inspect, review, and request to amend education records.
  • FERPA prohibits record matching of students’ education records and restricts which parties may have access to personally identifiable information. It also establishes penalties for inappropriate redisclosure by third parties.
  • The Protection of Pupil Rights Amendment (PPRA) was originally enacted to govern the administration to students of surveys that contain questions about certain protected information. It was amended by NCLB to generally apply to local education agencies that are the recipients of any funds from the Department of Education.
  • The privacy of special education records is protected by FERPA and the Individuals with Disabilities Education Act (IDEA).
  • Records pertaining to the identification, evaluation, and educational placement of children with disabilities must be available for inspection by parents.
  • Any participating agency or institution that collects, maintains, or uses personally identifiable information about students with disabilities must protect the privacy of these special education records.
  • Each public agency must have one official who is responsible for ensuring the confidentiality of any personally identifiable information and must train all persons who are collecting or using personally identifiable information regarding the state’s policies on confidentiality and FERPA.
  • Agencies must maintain, for public inspection, a list of employees who have access to personally identifiable information.
  • Education records may be protected by laws administered simultaneously by other state and federal agencies, as well as by the U.S. Department of Education.
  • The Children’s Online Privacy Protection Act of 1998 (COPPA) also impacts student privacy. Certain web sites must obtain parental consent before collecting personal information from children under age 13. Parents can review and delete the child’s personal information. The privacy notices of these web sites also have to disclose certain privacy requirements.
  • The National School Lunch Act of 1994 protects the privacy of information that agencies collect from families of children who are eligible to receive free or reduced-price meals.
  • Confidentiality regulations generally apply to records of students who receive assistance or treatment under laws administered by the federal Substance Abuse and Mental Health Services Administration.
  • The Office of Management and Budget reviews and approves federally administered questionnaires, surveys, or forms before they are to be completed by state and local education agencies and programs that receive federal funds.
  • The Privacy Act of 1974 stipulates allowable uses of social security numbers by government agencies and gives individuals the right to refuse to disclose or use their social security numbers except for the purposes defined by the social security law.
  • Experts in government offices and education organizations can assist education agencies in protecting the privacy of education records.