FERPA and Records Retention

FERPA for Faculty and Staff

Key Terms/Definitions

Education Records

Records that are directly related to a student and that cannot be disclosed without the prior written consent of the student, with certain limited exceptions. These include any record maintained by the institution that is related to the student (in any format or medium) with some narrowly defined exceptions:

  • Records in the “sole possession of the maker” (e.g. private advising notes) and are not shared with others
  • Law enforcement records created by a law enforcement agency for that purpose
  • Employment records (unless the employment is based on student status)
  • Medical/psychological treatment records
  • Alumni records (i.e. those created after the student was enrolled

Legitimate Educational Interest

A demonstrated “need to know” by University officials acting in the student’s educational interest to include faculty, administrative, clerical, and professional employees. FERPA allows for education records to be disclosed to a University official that has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibilities for the University.

Directory Information

Information that may be released without prior written consent as defined by the University, provided that the student does not opt to withhold release of directory information. Common examples include: name, address (local, home and e-mail), telephone (local and home), academic program of study, dates of attendance, date of birth, most recent educational institution attended, and degrees and awards received.

NOTE: Every student has the right to have directory information suppressed from public release. To determine if a student has submitted a request to withhold directory information, access the student’s Personal Information option under the Faculty and Advisors folder of Banner Self-Service. If you see “Confidential Information for (Name)” at the top of the form, then that student’s directory information must not be released. Please contact the Registrar’s Office if you have any questions.


With reference to FERPA, the term “parent” refers to either parent if the student is financially dependent (IRS definition).

Common Issues for Faculty and Staff

Posting Grades

The public posting of grades by the student’s name, identification number, or any part of the Social Security number, without the student’s written consent, is a violation of FERPA. However, if the instructor posts grades in such a manner that only the instructor and the individual student know the unique identifier, then that is generally acceptable. It is recommended that such a posted list not be in the same order as the class roster.

Class Attendance

Attendance should not be recorded by passing around a class list that contains a student’s SSN or UMID.

Returning Graded Tests and Assignments

Distributing graded work in a way that exposes the student’s identity or leaving personally identifiable graded papers unattended is no different from posting grades publicly. If the papers contain “personally identifiable” information, then leaving them unattended for anyone to see is a violation of FERPA.

Course Websites

In this age of increasing technology, many courses are supported by class Web sites and/or discussion groups. Only directory information can be available to the general public and other class members, so it is recommended that such websites have a security layer such that only class members and instructors can access appropriate information.

Letters of Recommendation

Written permission of the student is required for a letter of recommendation if any information included in the recommendation contains information from the education record (grades, GPA and other non-directory information) or is an assessment of student performance, such as his/her rank in the class. Statements made from personal observation or knowledge do not require a signed release.

Communication with Parents

In order to release confidential information to parents or other third parties, a student must provide prior written consent. Students can submit a FERPA Records Release Authorization form to the Registrar’s Office, designating a specific person for which confidential information may be provided. To determine if a student has a release, you may contact the Registrar’s Office, or review the appropriate student forms in BANNER.

NOTE: Even though a student may have submitted a signed records release form noting that confidential information may be shared with a parent or other third party, the University is not compelled to release such information. The only party to which the University must disclose information from the education record is the student. WHEN IN DOUBT, DO NOT RELEASE CONFIDENTIAL INFORMATION.

Additional Resources

American Association of Collegiate Registrars and Admissions Officers (AACRAO)

Alabama Records Disposition Authority