Skip to main content
govconCyber — Federal Cybersecurity Law Reference
Browse requirements
X-CUI-FERPA Informational

Protect Student Records

Official citation: FERPA (20 USC 1232g; 34 CFR 99)

Class: informational · Severity: medium

Requirement text

FERPA (20 USC 1232g; 34 CFR 99)

What it means

Student education records are protected by FERPA, and when handled under federal contracts they are CUI in the Privacy/education category. 20 USC 1232g and 34 CFR Part 99 limit disclosure of personally identifiable information from education records. EdTech vendors and institutions sharing student data with the government should treat it as restricted.

Required by

  • — FERPA (20 USC 1232g; 34 CFR 99)

Educational reference only — not legal advice. Consult a qualified assessor or attorney for binding compliance determinations.