Are state university student disciplinary records subject to public records requests, or does FERPA block them?

The short answer is: it depends, and FERPA does not function as a blanket block. State university disciplinary records sit at the intersection of two regimes — a state public-records law (which presumes disclosure) and the federal Family Educational Rights and Privacy Act (FERPA), which protects “education records.” How they interact determines what a requester actually receives.

How the two laws fit together

State public-records statutes generally require public bodies, including state universities, to release records on request unless an exemption applies. Most of these statutes contain an exemption for records whose disclosure is prohibited by other law. FERPA is one such law: it restricts the release of personally identifiable information from a student’s education records without consent. So a state law typically does not override FERPA — instead, FERPA supplies the exemption the state law recognizes.

The practical result is that personally identifiable disciplinary records are usually withheld, while the underlying public interest is often satisfied through other means.

Where records do become disclosable

FERPA itself contains carve-outs that can make some disciplinary information releasable:

• De-identified records. Information with names and other identifiers removed generally falls outside FERPA’s protection and may be released.
• Crimes of violence and certain sex offenses. FERPA permits institutions to disclose the final results of disciplinary proceedings where a student was found responsible for a qualifying offense.
• Aggregate or statistical data about disciplinary outcomes that does not identify individuals.

Courts and state attorneys general have reached differing conclusions over the years on edge cases, so outcomes vary by jurisdiction and by the specific record requested.

What records professionals should do

Treat each request as a line-by-line review rather than an all-or-nothing decision. Identify what is genuinely an “education record,” apply the narrowest withholding that the exemption supports, and release reasonably segregable, non-identifying portions. Document the legal basis for any redaction. Building privacy review into the request workflow — and mapping which fields are identifying — makes responses faster and more defensible. A structured approach to managing personal information, such as the NIST Privacy Framework, helps institutions handle these competing obligations consistently.

For more on disclosure laws and exemptions generally, see the FOIA and public records hub.