FERPA lets a school disclose education records without consent to a vendor acting as a school official, if the vendor performs a service the school would otherwise do with employees, is under the school's direct control over use and maintenance of the records, and follows the redisclosure limits. Product design can show each of those.
The three conditions
The Department of Education's student privacy site, summarising 34 CFR 99.31(a)(1)(i)(B), lists these conditions for an outside party.
- The party performs an institutional service or function for which the school would otherwise use employees.
- The party is under the school's direct control regarding the use and maintenance of education records.
- The party is subject to the redisclosure limits in section 99.33(a).
The school must also use reasonable methods to make sure school officials, including vendors, access only the records in which they have legitimate educational interests.
Turning conditions into product features
Institutional function. Describe your product in the contract as doing a job the school would do itself, such as grading support or scheduling. If part of your business uses records for something else, like building ad profiles, that part sits outside the exception.
Direct control. Give schools tools: export, deletion on request, retention settings, and an audit log of who accessed what. Contract language alone is thin if the product cannot comply.
Redisclosure limits. Under section 99.33(a), a party receiving records may use them only for the purposes for which they were disclosed and may not redisclose them without consent. Map your subprocessors and make sure each one is bound by the same limits.
Need to know access. Role based access inside your own staff. Support engineers should not browse student data by default.
Questions schools may ask you
- What student data do you collect and why?
- Who are your subprocessors?
- Can we delete records on request, including backups on a defined schedule?
- How do you log staff access?
- How do you tell us about an incident?
Have written answers ready. Procurement teams reward vendors who respond clearly.
The cost of getting it wrong
The site notes that if a third party improperly rediscloses records, the institution may not give that third party access to education records for at least five years under section 99.67(e). That is a commercial reason, not just a legal one, to control sharing.
Where Safeguard fits
For the software side, SBOM and dependency scanning, policy gates and compliance evidence automation help show how your code and vendors are controlled. This post is not legal advice; check your situation with counsel.
Evidence to keep
Schools may ask you to show, not just state, that you meet the conditions. Keep your data flow diagram, the subprocessor list, the access control model for your staff, a sample audit log extract and your deletion procedure. Keep the contract language that describes your service as an institutional function. Update the pack when you add a major feature or vendor. A pack that is current in October is far more useful than one rebuilt in the week before a renewal.
Quick check
Does FERPA certify vendors?
No. The exception is about the school's arrangement with the vendor, not a certificate. The vendor must meet the conditions in practice.
Sources
Last reviewed: 19 October 2026.
