The best way to protect PII is to not have it. 

The Family Educational Rights and Privacy Act (FERPA) provides guidelines for protecting students' records with personally identifiable information (PII). This federal law designates to whom and under what circumstances educational institutions may share data with PII.

FERPA compliance is mandatory for any educational institution that receives federal funding, and the institution is held responsible for making sure that any third party (e.g., researchers) with whom student information is shared, complies with FERPA and keeps the data secure. 

FERPA breaches by research teams are usually the result of someone accidentally emailing data containing PII or a laptop with PII data being stolen or hacked. The best way to prevent these breaches is for research teams to not have access to any PII in the first place.  


How can ERAS IDProtect help with FERPA compliance?

School districts can set-up a no-cost contract with ERAS to prepare and de-identify data for researchers. In this way, the school district can ensure FERPA compliance by only sharing de-identified data with researchers. PII are only shared with ERAS which uses multiple data security safeguards.

What is FERPA?

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.


FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students."


  • Parents or eligible students have the right to inspect and review the student's education records maintained by the school. Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. Schools may charge a fee for copies.

  • Parents or eligible students have the right to request that a school correct records which they believe to be inaccurate or misleading. If the school decides not to amend the record, the parent or eligible student then has the right to a formal hearing. After the hearing, if the school still decides not to amend the record, the parent or eligible student has the right to place a statement with the record setting forth his or her view about the contested information.

  • Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

    • School officials with legitimate educational interest;

    • Other schools to which a student is transferring;

    • Specified officials for audit or evaluation purposes;

    • Appropriate parties in connection with financial aid to a student;

    • Organizations conducting certain studies for or on behalf of the school;

    • Accrediting organizations;

    • To comply with a judicial order or lawfully issued subpoena;

    • Appropriate officials in cases of health and safety emergencies; and

    • State and local authorities, within a juvenile justice system, pursuant to specific State law.


Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper article) is left to the discretion of each school.


Source: U.S. Department of Education Family Educational Rights and Privacy Act (20 U.S.C. §1232g; 34 CFR Part 99)