Compliance · FERPA

Private Beta · Building

FERPA evidence built for the institution that issues credentials.

Annual rights notifications, disclosure logs, consent records, third-party agreements, and amendment trails — all cryptographically anchored to a public ledger. Universities and K-12 districts get a FERPA evidence trail that survives the next SIS migration, the next ed-tech vendor change, and the next SPPO inquiry.

Request Early AccessRead the research

What it is

The 50-year-old federal law every US school operates under.

The Family Educational Rights and Privacy Act of 1974 (FERPA) is the federal law that governs the privacy of student education records. It applies to every educational institution that receives funds under any program administered by the U.S. Department of Education — which effectively means every public K-12 district, every public university, and most private universities.

FERPA grants four core rights to parents (and to "eligible students" 18 years old or attending post-secondary institutions): inspect and review records, request amendment of inaccurate records, consent to disclosure of personally identifiable information, and file a complaint with the Student Privacy Policy Office (SPPO) at the U.S. Department of Education.

FERPA penalties are unusual: SPPO does not levy fines on individual records. Instead, the ultimate consequence is withdrawal of federal funding from the institution. In practice, FERPA enforcement is reputational and operational — compliance officers worry about SPPO investigations, consent decrees, and the lawsuit risk from individual disclosure incidents.

Four rights · how Arkova maps to each

FERPA's four rights, with verifiable evidence behind each.

Right to inspect and review

Requirement

Parents (or eligible students 18+) have the right to inspect and review the student's education records within 45 days of a request. The institution must provide explanations and interpretations of the records.

Arkova

Anchored receipts of inspection requests, fulfillment timestamps, and the exact records produced. A FERPA examiner can verify the 45-day window was met for any prior request.

Right to request amendment

Requirement

Parents/eligible students may request that records they believe are inaccurate or misleading be amended. Institutions must respond, hold a formal hearing if denied, and allow a written statement of disagreement to be appended.

Arkova

Append-only amendment trail with cryptographic timestamps. Original records, amendment requests, hearing outcomes, and disagreement statements all linked into a verifiable chain.

Right to consent to disclosure

Requirement

Schools must obtain written consent before disclosing personally identifiable information from education records, except for specific exceptions (school officials with legitimate interest, transfer institutions, judicial orders, etc.).

Arkova

Disclosure log with anchored consent receipts: who consented, for what purpose, on what date, and what was actually disclosed. Disputes about prior consent become objectively verifiable.

Right to file a complaint

Requirement

Parents/eligible students may file a complaint with the U.S. Department of Education's Student Privacy Policy Office (SPPO) regarding alleged FERPA violations.

Arkova

Complete record-handling timeline anchored. When SPPO investigates, your institution can produce an immutable audit trail of every disclosure decision in the period.

Record classification

Four FERPA record categories determine your obligations.

Directory information

Examples

Name, address, phone, email, dates of attendance, enrollment status, photograph, degrees and awards received, participation in officially recognized activities.

FERPA rule

May be disclosed without consent IF the school provides annual notice and gives the student opportunity to opt out.

Education records (PII)

Examples

Grades, transcripts, class lists, course schedules, disciplinary records, Social Security numbers, financial aid records, medical/psychological records related to treatment.

FERPA rule

Cannot be disclosed without written consent except under specific FERPA exceptions (legitimate educational interest, audit/evaluation, financial aid, etc.).

Sole-possession records

Examples

Personal notes by school officials kept solely for personal use, not shared with anyone else, used as a memory aid.

FERPA rule

Not "education records" under FERPA. No FERPA disclosure restrictions.

Treatment records

Examples

Records made by physicians, psychiatrists, psychologists for adult students used solely in connection with treatment, not disclosed for any other purpose.

FERPA rule

Not "education records" if used solely for treatment. Become education records if shared with anyone other than the treating professional.

What an SPPO inquiry asks for

Six evidence categories every FERPA program needs.

  1. 1. Annual notification of FERPA rights. Every year, the institution must notify parents/eligible students of their FERPA rights, the procedure for inspecting records, the procedure for amendment requests, and the criteria for "legitimate educational interest" used in disclosure decisions.
  2. 2. Directory information opt-out records. Documented opportunity for students/parents to opt out of directory-information disclosure, plus the actual list of opt-outs maintained throughout the academic year.
  3. 3. Disclosure log under §99.32. Record of each request for and disclosure of personally identifiable information from a student's education records. Required to include the parties who requested or received the information and their legitimate interests.
  4. 4. Consent records. Signed and dated written consent forms specifying records to be disclosed, purpose of disclosure, and party/parties to whom disclosure is made. FERPA has specific signature requirements (electronic signatures permitted with proper authentication).
  5. 5. Subcontractor / third-party agreements. Written agreements with third parties (cloud SaaS, analytics platforms, ed-tech vendors) requiring FERPA-equivalent protections. Annual due-diligence reviews. Required for the "school official" exception under §99.31(a)(1).
  6. 6. Training records. Documented FERPA training for all school officials with legitimate educational interest in records. Training content, attendance, and refresh dates.

Who's in scope

Every institution receiving Department of Education funds.

FERPA scope is broad and indirect. The actual statutory hook is the receipt of federal education funds — but in practice this captures:

  • Public K-12 districts — every one of them via Title I, IDEA, and other federal programs.
  • Public universities and community colleges — all federal Title IV financial-aid recipients.
  • Most private universities — any institution whose students receive federal financial aid.
  • Charter schools, magnet schools, virtual schools — same federal-funding logic.
  • Third-party service providers (SIS vendors, LMS platforms, ed-tech SaaS) — bound by their school-official agreements under §99.31(a)(1).

Private K-12 schools that don't accept federal funds are typically not subject to FERPA — but most align with FERPA practices voluntarily because parents expect equivalent protections.

Build a FERPA evidence trail that survives the next SIS migration.

If you're a university or K-12 district that wants student-records evidence to survive the next SIS or LMS migration, we'd like to discuss an early-access pilot.

Arkova is in private beta. Features described on this page are being built and refined with pilot customers right now. Some controls and integrations are live today; others are in active development. Talk to us about the parts most relevant to your workload.

Request Early Access

Or read The State of Compliance in 2026 for the broader regulatory picture.