FERPA Education Compliance
Term 37 of 68 in the ERPStack technical glossary
What is FERPA Education Compliance?
The Family Educational Rights and Privacy Act (FERPA) is a federal law in the United States that protects the privacy of student education records, restricting access to authorized school officials.
FERPA Education Compliance at a glance
- Statute
- 20 U.S.C. 1232g, implemented by 34 CFR Part 99, Family Educational Rights and Privacy
- Protected object
- Education records — 1 student's records, wherever the institution stores them
- Core rights
- Inspect, request amendment, and control disclosure of personally identifiable information
- Engineering shape
- Consent state per disclosure, plus an audit trail of every record access
- Built with
- Read-and-write audit logging in PostgreSQL 18 through Drizzle ORM 0.45, consent state per disclosure, RBAC and SSO enforced by Next.js 16, hosted on AWS with Sentry scrubbed of student data
- Numbers that matter
- 20 U.S.C. 1232g, implemented by 34 CFR Part 99; source at 53 FR 11943, 11 April 1988; 3 core rights — inspect, amend, control disclosure
- Adjacent regimes
- GDPR obligations over the same records, and SOC 2 or ISO 27001 controls covering the institution's systems
- Commonly paired with
- SSO, RBAC, Row-Level Security in PostgreSQL 18, read-level audit logging, Next.js 16 server actions and SOC 2 or ISO 27001 controls
- Access path
- SSO with OAuth 2.0 at the identity provider, RBAC over Next.js 16 server actions, and every read written to Postgres — the read log is what a FERPA review samples.
- Who holds the records
- edtech vendors first, then the government agencies and healthcare units inside a university that hold the same student under a different rule.
How FERPA Education Compliance works in production
The ERPStack approach to FERPA Education Compliance
We design FERPA-compliant database systems for EdTech clients, implementing database-level schema isolation and strict user access tracking.
Frequently asked questions about FERPA Education Compliance
What does FERPA Education Compliance protect?
Student education records held by institutions receiving federal education funding. Education Compliance under 20 U.S.C. 1232g, implemented by 34 CFR Part 99, gives students and eligible parents rights to inspect records, request amendment, and control disclosure of personally identifiable information. For a software system that translates into per-record access control, a consent model, and a log of who viewed what.
How does FERPA differ from GDPR in system terms?
The unit of protection differs. Education Compliance is built around the education record and the institution's disclosure obligations, while GDPR is built around the individual's rights over personal data wherever it lives. A system serving both needs a consent and disclosure model on top of a general personal-data map, since satisfying 1 regime does not automatically satisfy the other.
What is the directory information exception?
A narrow category an institution may disclose without consent after giving notice and an opportunity to opt out. Education Compliance failures often occur here, because the category is configured once and then applied to exports nobody re-checked. Treating the opt-out as a per-student flag enforced at query time — rather than a report setting — is what keeps the exception from becoming a leak.
What does an EdTech system need to log?
Access, not just changes. Education Compliance obliges an institution to know who has seen a record, so read events matter as much as writes — which is unusual, since most systems audit only mutations. Building read logging in from the start is far easier than adding it later, and it is the evidence that answers a parent asking who accessed their child's file.