TechKnowSurge
NIST NICE K0678 NIST CSF GV.OC-03 NIST 800-53 PT-1 ISC2 CISSP 1.4
TechKnowSurge Catalog Videos Family Educational Rights and Privacy Act (FERPA)
VideoSecurityFree

Family Educational Rights and Privacy Act (FERPA)

FERPA is a 1974 federal law that protects the privacy of student educational records, governing who can access that data, how it can be shared, and which institutions must comply. Schools receiving federal funding are required to follow FERPA, and its reach can extend to third-party organizations that handle student data on their behalf.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

The Family Educational Rights and Privacy Act, known as FERPA, is a federal privacy law enacted in 1974 that governs how educational institutions collect, protect, and share student data. Compliance is required of any school that receives federal funding, and the law's reach can extend indirectly to third-party vendors and businesses that store or process student data on behalf of those institutions. The categories of data FERPA covers include grades, transcripts, GPA, course enrollment, and other records generated during a student's academic career. Under FERPA, rights over student records are tied to age. Parents hold those rights while a student is under 18, at which point the rights transfer fully to the student. These rights include the ability to inspect and review educational records and to formally request amendments to information believed to be inaccurate or misleading, though institutions are not automatically required to make the requested changes. FERPA also establishes a detailed framework for disclosure. Directory information — such as a student's name — can generally be shared without consent, but more sensitive data requires explicit written authorization from the student or parent before it may be released to a third party. Specific exceptions to the consent requirement are outlined in the law. Institutions are also subject to annual notification obligations, requiring them to inform students and parents of their FERPA rights. Violations of the law carry enforcement penalties that vary in severity depending on the nature of the infraction.

What you'll learn

What's covered

FERPA Overview

Aligned to

NIST NICE
K0678 Knowledge of privacy laws and regulations
NIST CSF
GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed.
NIST 800-53
PT-1 Policy and Procedures
ISC2 CISSP
1.4 Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context

Key terms

Family Educational Rights and Privacy Act
FERPA
A U.S. federal law that protects the privacy of student education records and gives parents and eligible students the right to access, review, and request corrections to those records. Schools that receive federal funding must comply with FERPA's privacy protections.
Educational Records
Records, files, and documents that schools collect about students, including grades, transcripts, GPA, and class enrollment.
Directory Information
Designated student information, such as a student's name, that a school may disclose without prior consent under FERPA.
Disclosure
The release or transfer of student education record information to a third party, governed by consent requirements and exceptions under FERPA.
Consent
A privacy principle requiring that organizations obtain explicit permission from individuals before collecting, using, or sharing their personal data.
Eligible Student
A student who has reached 18 years of age and thereby assumes FERPA rights previously held by their parents.

Topics

Ferpa Data Privacy Regulatory Compliance Student Data Protection Information Governance Federal Law

Transcript

The Family Educational Rights and Privacy Act, or FERPA, is designed to help protect students' data when they're going to school. So let's cover what it is.

FERPA was created in 1974. Now, obviously, when a student goes to school, there's a lot of data that's collected about that student: grades that they're getting inside of classes, classes that they're taking, full transcript, and their GPA. All that information gets collected. Well, FERPA defines what is done, or how that information is protected, who has rights to that information, and how that information can be used.

Who needs to comply

So who needs to comply with FERPA? Well, any schools that are getting money from the federal government. They can't get federal government money unless they're complying with FERPA. However, I've also seen this apply to other organizations, other businesses, who are marketing and storing data for those schools. So it can have an indirect impact on these businesses, where they have to comply with FERPA as well.

Who has rights

Here are some of the highlights of FERPA. First of all, you have to understand who has rights under FERPA. And when it comes to student records, if that student is under 18, then the parents have the rights to do the requesting that happens under FERPA. And that shifts then and goes to the student when that student turns 18.

So one of the things that they have a right to is the right to access educational records, to see what's on file for that student. Another right is the right to amend, or ask for an amendment — not necessarily that they're automatically given that amendment, but they can ask for those records to be amended.

Disclosure

Another thing that FERPA defines is things around disclosure. So before an educational institution can give away information, or expose information, or hand it over to a third party, there are some definitions around it. First of all, there's directory information, and the directory information is the information like the student name and where they — they don't need consent to hand over that information. However, there is certain information that the parent or the student must give consent for before they hand that information over to another third party. And then there's exceptions to this as well, so it outlines what those exceptions are.

Notification and enforcement

There's also an annual notification requirement of what needs to be put out there, to the students and to the parents, as far as notifications around FERPA. And then there's also some stiff enforcement penalties that can vary depending on what the infraction is.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →