FERPA
Family Educational Rights and Privacy Act
US law protecting the privacy of student education records at schools that receive US Department of Education funding.
In force: Enacted 1974
Who it applies to
Educational agencies and institutions that receive funds under programs administered by the US Department of Education.
Key requirements
- Parents (or eligible students, once 18 or attending a postsecondary institution) can inspect and review education records.
- Right to request correction of inaccurate or misleading records.
- Written consent before disclosing personally identifiable information from records, subject to listed exceptions.
- Annual notification of rights, and rules for disclosing 'directory information' with an opt-out.
Breach and incident notification
FERPA itself sets no breach notification deadline; state laws and Department of Education guidance apply.
Penalties
The main sanction is the potential loss of federal education funding after the institution fails to comply voluntarily.
Related frameworks
Shows up on these exams
Official source
US Department of Education: FERPANot legal advice
This is a study summary, not legal advice. Laws and their guidance change, and obligations depend on your facts and jurisdiction. Check the official source and the current, dated text, and consult a qualified lawyer before acting.
Go deeper
Privacy lab
Practise this topic hands-on.
HIPAA
United States (federal) - Sector-specific
GLBA
United States (federal) - Sector-specific
SOX
United States (federal) - Sector-specific
FISMA
United States (federal) - Cybersecurity & incident reporting
CIRCIA
United States (federal) - Critical infrastructure
SEC cyber disclosure rules
United States (federal) - Cybersecurity & incident reporting