If you run IT for a district, a charter network or a college, you have probably been told that a disposal vendor is "FERPA compliant." This page is about what that phrase can and cannot mean.
You'll see providers advertise FERPA compliant destruction.
FERPA doesn't specify a media sanitization method. The Department of Education says so directly and points to NIST for the technical side. No specified method, no certification, no approved vendor list.
But FERPA isn't silent on destruction, and the audit-or-evaluation exception is not its only destruction-relevant provision. Several bear on it, directly or through the agreements FERPA requires, plus two in IDEA Part B. They're listed below rather than counted, because the count depends on whether you treat an exception as its own provision. That's more than the version most vendor pages give you, which is usually one.
For records you hold yourself: you must not destroy any education record while a request to inspect and review it is outstanding (34 CFR 99.10(e)). The separate duty to safeguard protected information from unauthorized disclosure doesn't come from that section either. The Department attributes it to FERPA generally rather than to a single regulation, and the nearest regulatory hooks are the ones cited below: 99.31(a)(1)(ii), 99.33(a) and 99.35.
When data goes to a third party, more applies. Under the school official exception (34 CFR 99.31(a)(1)) you keep direct control over the recipient's use and maintenance of the data, and the recipient is bound by redisclosure limits at 34 CFR 99.33(a). FERPA sets destruction terms here through your own contract, and the Department treats destruction at the end of the relationship as best practice rather than a rule.
Under the studies exception (34 CFR 99.31(a)(6)) the information must be destroyed when no longer needed for the study, and the written agreement must compel destruction and state the time period.
Under the audit or evaluation exception (34 CFR 99.35) the disclosing authority must use reasonable methods to ensure its authorized representative limits use, protects the data from further disclosure and destroys it. The agreement must require destruction and specify the period. Paragraph 99.35(c) switches off the destruction and protection duties in 99.35(b) where the parent or eligible student has consented, or where the collection is specifically authorized by federal law. The written-agreement requirements in 99.35(a)(3) still stand.
And other law may impose both retention floors and specific methods. IDEA Part B is the common example: 34 CFR 300.624 governs destruction at parent request, and 34 CFR 300.611(a) defines destruction to include removing personal identifiers, not only physical destruction.
The Department of Education's own guidance on data destruction is published here and worth reading directly rather than through anyone's summary of it. One caveat, because we'd rather you heard it from us: that document is from 2014, and its technical pointer sends you to NIST SP 800-88 Revision 1, which was withdrawn in September 2025. The FERPA reasoning in it stands. The sanitization reference doesn't, and Revision 2 is the current one.
There's also a short document written for vendors rather than for schools, Responsibilities of Third-Party Service Providers under FERPA. It's worth five minutes of your time before you write the contract, because it's candid about where the responsibility sits. The record stays yours to protect. What it requires of a provider is that the provider stay under your direct control over how the data is used and kept, and that's established by what you write into the agreement rather than by anything the provider certifies to. Almost everything else it says to providers is phrased as good practice. If you want it to be binding, it has to be in the contract.
What that means is better than the marketing version, not worse. The standard you're actually held to is your own records retention schedule and your own board policy. A provider's job is to execute against that and document it in a form you can file.
This is general information, not legal advice. R2 Revive is not a law firm. What applies to you depends on your data, your contracts and your own policies, so check this with your counsel or compliance function before you act on it. Regulatory content on this page last reviewed: 2026-09-12 · Why we put it that way
How we handle school projects · Talk to a person · Use the project checklist
