Answer a school's questionnaire by showing you meet the FERPA conditions that let a vendor act as a school official: you do a service the school would use staff for, the school controls how you use and keep records, and you do not redisclose. Back each answer with a document, not a promise.
Why do schools send these questionnaires?
FERPA is section 444 of the General Education Provisions Act, with regulations at 34 CFR Part 99. It covers educational agencies and institutions that receive funds under programs administered by the Secretary of Education. Generally, a school needs signed, dated consent before disclosing personally identifiable information from education records, unless an exception applies.
One exception lets a school treat a contractor, consultant or other outside party as a school official. That is how most edtech vendors get access to records, and it is why the questionnaire exists. The school must be able to show the conditions are met.
What are the three conditions?
From the Department of Education's FERPA page, citing section 99.31(a)(1)(i)(B), the outside party must meet all three:
- It performs an institutional service or function the school would otherwise use employees to perform.
- It is under the school's direct control for the use and maintenance of education records.
- It is subject to the redisclosure limits in 99.33(a).
Under 99.33(a), information is disclosed on the condition that the recipient will not redisclose it without prior consent, and the recipient's officers, employees and agents may use it only for the purposes for which it was disclosed.
How do the conditions turn into questions?
A constructed example of how a school question maps to a condition.
Condition 1, purpose. "Describe the service and the records it needs." Answer with a short data inventory: each field, why you need it, and what happens if the school withholds it.
Condition 2, direct control. "Who can instruct you on use, retention and deletion?" Answer with your contract terms, a deletion process and its timeline, and how the school exports its data.
Condition 3, no redisclosure. "Do you share data with anyone else?" Answer with a list of subprocessors, what each receives and why, and your rule that data is used only for the school's purpose, with no advertising or profiling use.
Beyond these, schools usually ask about access control, encryption, incident handling and software practices. The FERPA page we read does not prescribe any technical controls, so those answers come from your own program.
What evidence should you keep ready?
- A data inventory and data flow diagram.
- The contract template with the school official language.
- A subprocessor list.
- Access control policy and an example access review.
- Incident response plan and notification process.
- A software inventory (SBOM) and vulnerability management process, if asked how you handle third party code.
- Your deletion procedure and an example completed request.
What mistakes cost the most deals?
Vague answers ("we take privacy seriously"), mismatched answers between this questionnaire and your public privacy page, and claiming certifications you do not hold. State only what is true today. If something is in progress, say that and give the plan.
What to do
- Write one master answer set tied to the three conditions and keep it version controlled.
- Build the evidence folder listed above.
- Check your subprocessor list against reality each quarter.
- Make sure the contract gives the school direct control over use and deletion.
- Remove any secondary use of student data, such as product analytics that identify individuals, or document the legal basis with counsel.
- Have security and legal review each response before it goes out.
- Track which answers the schools challenge and improve them.
Safeguard can produce an SBOM and dependency scan for the software side of the answers, and its compliance automation can help organise evidence. It does not make you FERPA compliant.
Quick check
Does FERPA tell vendors which security controls to use?
The page we read does not prescribe technical controls. It sets conditions on control, purpose and redisclosure. Controls come from your own program and the school's requirements.
What is an eligible student?
Per the Department of Education, a student who reaches age 18 or attends a postsecondary institution, at which point FERPA rights transfer from the parents to the student.
Sources
- U.S. Department of Education: FERPA (fetched 18 October 2026)
Last reviewed: 18 October 2026.
