Governance, risk & compliance

Family Educational Rights and Privacy Act (FERPA), 34 CFR Part 99 34 CFR Part 99, eCFR read 24 Oct 2026

FERPA (20 U.

S. C.

1232g) and its regulations at 34 CFR Part 99 protect the privacy of student education records. Part 99 applies to an educational agency or institution that receives funds under any program administered by the US Department of Education (s.

99. 1), which in practice means public K-12 districts and schools and nearly every college and university.

A company is not 'covered' directly, but a school can give it student data without consent only if it qualifies as a 'school official': it performs a service the school would otherwise use employees for, is under the school's direct control for the use and maintenance of education records, and is bound by the use and redisclosure limits in s. 99.

33(a) (s. 99.

31(a)(1)(i)(B)). That is why school IT providers and ed tech vendors work under FERPA terms.

Part 99 gives parents, and students who reach 18 or attend a postsecondary institution (eligible students), rights to inspect and review records within 45 days (s. 99.

10), to seek amendment and a hearing (ss. 99.

20 to 99. 22), and to consent before disclosure of personally identifiable information (s.

99. 30), subject to listed exceptions (s.

99. 31).

The school must give an annual notification of rights (s. 99.

7), keep a record of disclosures (s. 99.

32), limit redisclosure (s. 99.

33) and follow notice and opt-out rules for directory information (s. 99.

37). Enforcement is by the Department of Education (the Office of the Chief Privacy Officer in the regulation text, s.

99. 60): it can withhold payments, issue a cease and desist order or end eligibility (s.

99. 67), and a third party that improperly rediscloses can be barred from receiving the school's data for at least five years.

There is no private right of action in Part 99. The FTC's April 2025 COPPA rule notice recorded that the Department of Education planned to propose FERPA amendments; no proposed or final amendment was found when this was written, so the text read is the current one.

FERPA is separate from COPPA (the amended COPPA Rule does not contain a school authorization exception) and from state student privacy laws, which are not mapped here. General information, not legal advice.

How Lavawall® helps you get to Family Educational Rights and Privacy Act (FERPA), 34 CFR Part 99 compliance

Most of Family Educational Rights and Privacy Act (FERPA), 34 CFR Part 99 comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Family Educational Rights and Privacy Act (FERPA), 34 CFR Part 99, and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Family Educational Rights and Privacy Act (FERPA), 34 CFR Part 99 in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Family Educational Rights and Privacy Act (FERPA), 34 CFR Part 99 as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.