The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C.
§ 1232g; 34 CFR Part 99) is a Federal law that protects the
privacy of student education records. The law applies to all
schools that receive funds under an applicable program of the U.S.
Department of Education.
FERPA gives parents certain rights with respect to their
children's education records. These rights transfer to the student
when he or she reaches the age of 18 or attends a school beyond the
high school level. Students to whom the rights have transferred are
Parents or eligible students have the right to inspect and
review the student's education records maintained by the school.
Schools are not required to provide copies of records unless, for
reasons such as great distance, it is impossible for parents or
eligible students to review the records. Schools may charge a fee
Parents or eligible students have the right to request that a
school correct records which they believe to be inaccurate or
misleading. If the school decides not to amend the record, the
parent or eligible student then has the right to a formal hearing.
After the hearing, if the school still decides not to amend the
record, the parent or eligible student has the right to place a
statement with the record setting forth his or her view about the
Generally, schools must have written permission from the parent
or eligible student in order to release any information from a
student's education record. However, FERPA allows schools to
disclose those records, without consent, to the following parties
or under the following conditions (34 CFR § 99.31):
- School officials with legitimate educational interest;
- Other schools to which a student is transferring;
- Specified officials for audit or evaluation purposes;
- Appropriate parties in connection with financial aid to a
- Organizations conducting certain studies for or on behalf of
- Accrediting organizations;
- To comply with a judicial order or lawfully issued
- Appropriate officials in cases of health and safety
- State and local authorities, within a juvenile justice system,
pursuant to specific State law.
Schools may disclose, without consent, directory information
such as a student's name, address, telephone number, date and place
of birth, honors and awards, and dates of attendance. However,
schools must tell parents and eligible students about directory
information and allow a reasonable amount of time for them to
request that the school not disclose directory information about
them. Schools must notify parents and eligible students annually of
their rights under FERPA. The actual means of notification (special
letter, inclusion in a PTA bulletin, student handbook, or newspaper
article) is left to the discretion of each school.
Student directory information can be accessed through UB’s Online
Directory. If a student has chosen to restrict their
information, it won't appear in the directory.
The Information Security Office has an online course available in
UBlearns called Handling Data Safely. The course covers FERPA, in addition to other relevant
- Log in using your UBITName and password, then go to the Courses
- Search for "Handling Data Safely" and when it appears, click
the “Go” button, then “Enroll” from the
- Click “Submit,” then “OK.”
This course should now appear in your courses list. Once
enrolled, take Units 1, 2 and 4. Unit 3 should only be taken by a
staff member who deals with student data, such as PeopleSoft. Unit
5 should only be taken by staff dealing with purchasing and use of