FERPA: What You Need to Know

It’s the Law

The Family Educational Rights and Privacy Act (FERPA), also known as the Buckley Amendment, was passed by Congress in 1974. It grants four specific rights to a postsecondary student:

  • To see the information that the institution is keeping on the student.
  • To seek amendment to those records and, in certain cases, append a statement to the record.
  • To consent to disclosure of records.
  • To file a complaint with the FERPA Office in Washington.

FERPA applies to all educational agencies or institutions, including ISU, which receive funds under any program administered by the Secretary of Education. FERPA governs what may be released, but it does not require that any information be released.

Notification of Rights Under FERPA

The Family Educational Rights and Privacy Act (FERPA) affords eligible students certain rights with respect to their education records. (An “eligible student” under FERPA is a student who is 18 years of age or older or who attends a postsecondary institution.)  These rights include: 

1. The right to inspect and review the student's education records within 45 days of the day the University receives a request for access.

Students should submit to the Office of the Registrar written requests that identify the record(s) they wish to inspect. The Registrar will make arrangements for access and notify the student of the time and place where the records may be inspected. If the records are not maintained by the Office of the Registrar, the Registrar shall advise the student of the correct official to whom the request should be addressed.

Please refer to the Request to Inspect Educational Record page for additional information.

2. The right to request the amendment of the student's education records that the student believes are inaccurate, misleading, or otherwise in violation of the student’s privacy rights under FERPA.

Students may ask the University to amend a record that they believe is inaccurate, misleading, or otherwise in violation of their privacy rights under FERPA. They should write the University official responsible for the record, clearly identify the part of the record they want changed, and specify why it is inaccurate, misleading, or in violation of their FERPA privacy rights. FERPA was not intended to provide a process to be used to question substantive judgments that are correctly recorded. The right to seek an amendment of an education record is not intended to allow students to contest, for example, a grade in a course because they felt a higher grade should have been assigned.

If the University decides not to amend the record as requested by the student, the University will notify the student of the decision and advise the student of his or her right to a hearing regarding the request for amendment. Please refer to the university's FERPA Hearing Process and Appeal Procedures page for additional information.

3. The right to consent to disclosures of personally identifiable information (PII) contained in the student's education records, except to the extent that FERPA authorizes disclosure without consent.

One exception that permits disclosure without consent is disclosure to school officials with legitimate educational interests. A school official may be employed (but not always) by the University in an administrative, supervisory, academic,  research, or support staff position (including law enforcement unit personnel and health staff); or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks. A school official may also include a person or company, consultant, or volunteer (such as an attorney, auditor, collection agency, representative of the ISU Foundation, or official of the National Student Clearinghouse) with whom the University has contracted to perform on an outsourced basis an institutional service or function, and who is under the direct control of the school with respect to the use and maintenance of PII from education records.  A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility. 

4. Generally, schools must have written permission from the student before releasing any information from a student's educational record. However, the law allows schools to disclose records, without consent of the student, to the following parties:

  • Information the University has designated as directory or public information
  • School officials who have a legitimate need to know
  • Persons who need to know in cases of health and safety emergencies
  • Appropriate parties in connection with financial aid to a student
  • Individuals who have lawfully obtained court orders or subpoenas
  • Accrediting organizations to carry out accrediting functions
  • Organizations conducting educational studies for the University
  • Other schools to which a student is applying, transferring, or intending to enroll or where the student is already enrolled if the disclosure is for purposes related to application, enrollment, or transfer
  • Courts during litigation between the University and the student or parent
  • Victim of crime of violence after final results of a disciplinary hearing
  • Public after disciplinary proceedings determine student committed a crime of violence
  • Parents of dependent students as defined by the Internal Revenue Code
  • Parents of a student regarding violation of any federal, state, local law, or policy of the school governing the use or possession of alcohol or a controlled substance if it is determined that the student committed a disciplinary violation and the student is under the age of 21
  • Federal, State, and local governmental officials for purposes authorized by law. (Note:  These entities may make further disclosures of PII to outside entities that are designated by them as their authorized representatives to conduct any audit, evaluation, or enforcement or compliance activity on their behalf.)

5. The right to file a complaint with the U.S. Department of Education concerning alleged failures by the University to comply with the requirements of FERPA.

In many situations, complaints relative to FERPA can be resolved within the University on an informal basis. Any student who wishes to discuss a FERPA complaint may contact the Registrar, 214 Enrollment Services Center.

To file a FERPA complaint with the U.S. Department of Education, contact the Office that administers FERPA at:

Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, SW.
Washington, DC, 20202

Directory and Public Information vs. Confidential Information

Directory and Public Information: FERPA defines this as “…information contained in an education record of a student which would not generally be considered harmful or an invasion of privacy if disclosed” (FERPA Regulations, 34CFR, Part 99.3).

Confidential Information: With the exception of the aforementioned information, all student records are considered to be confidential and may not be released. Individuals may request to suppress their information from the Online Directory or from Public Information Releases through their student portal.

Data Storage and Access: Faculty and staff accessing and storing confidential information in unsecured locations (e.g., flash drives, public or home computers, etc.) create the risk of unauthorized access to protected education records.

ISU Online Directory Information for Verified Users

Those accessing the Online Directory from an on- campus server or via ISU’s virtual private network (VPN) or other authenticated means.

  • Name
  • Major
  • Classification
  • ISU Email Address
ISU Online Directory Information for Guest Users

Those who are external, unauthenticated individuals. Guest users have the ability to send an email to students via a WebForm.

  • Name
  • Major
  • Classification
Other Public Information:
  • Hometown
  • Dates of Attendance at ISU
  • Expected Date of Graduation
  • College
  • Awards & Academic Honors
  • ISU Degree(s) and Date(s) Awarded
  • Previous Educational Institutions Attended, Degrees Received, and Dates-of-Attendance
  • Full- or Part-Time Status
  • Participation in Official Recognized Activities and Sports
  • Weight and Height of Members of Athletic Teams
Online Directory and Public Information can NEVER Include:
  • Social Security Number (full or partial)
  • University ID (UID) Number
  • Student Schedules
  • Race
  • Ethnicity
  • Nationality
  • Sex and Gender
  • UID Pictures
Student Education Records

Includes information directly related to the student and maintained by ISU. For example:

  • Personal Information
  • Enrollment Records
  • Students’ Exams or Papers
  • Grades
  • Disciplinary Files
  • Financial Aid Information
  • Student Employment Records

Frequently Asked Questions

Education records are directly related to a student and are maintained by an educational agency or institution or a party acting for or on behalf of the agency or institution. These records include but are not limited to: Grades, transcripts, class lists, course schedules, financial information, and discipline files. The information may be recorded in any medium (e.g., print, handwritten, email, video or audio tape, etc.). Exempted from the definition of education records are sole possession records/notes. These records are made by one person as an individual observation or recollection, are kept in the possession of the maker of the record, and only shared with a temporary substitute. Sharing with another person, or placing the records in an area where they can be viewed by others makes them subject to FERPA. Best advice: If you do not want it reviewed, do not write it down.

No. Before releasing any information, check for a “No Information Release” or other restriction. If the student has requested that Online Directory Information be withheld, no information can be released. If the student does not have a restriction on the release, Directory or Public Information may be released (Note. FERPA does not require that such information be released).

FERPA generally prohibits disclosure of information from education records, except in certain specified circumstances. One of these exceptions permits the nonconsensual disclosure of information to a student's parent if the student is a dependent student. If a student is claimed as a dependent by either parent for tax purposes, then either parent may have access under this provision; however, disclosure is not required, and you should speak with the Office of the Registrar prior to making such a disclosure. Spouses of eligible students have no rights under FERPA. Before disclosing information from a student’s education records to a spouse, the student would have to provide written consent.

Students may choose to allow the release of their education records to a specified third party by completing a Consent for Disclosure of Education Records form. Such a form must: (1) Specify the records that may be disclosed; (2) State the purpose of the disclosure; and (3) Identify the party or class of parties to whom the disclosure may be made. Iowa State University has determined that the form may remain on file for the specific request outlined on the form, assuming the student provided authorization for on-going use. While this form may authorize the school official to release the student’s records, it does not obligate the school official to do so; Iowa State reserves the right to review and respond to requests for release of education records on a case-by-case basis.