Does FERPA require schools to destroy student education records, or just restrict who can see them?

The short answer: the Family Educational Rights and Privacy Act (FERPA) is primarily about access and disclosure, not destruction. It governs who may see and share student education records and gives families certain rights over those records. It does not impose a general mandate to destroy them.

What FERPA actually requires

FERPA is a confidentiality and rights law. At its core, it does three things:

• Limits who can access education records, generally requiring consent before personally identifiable information is disclosed to third parties.
• Grants eligible students and parents the right to inspect, review, and request correction of records.
• Requires schools to protect the records and account for certain disclosures.

So the heart of FERPA is restricting who can see and share the data — not erasing it.

Where retention and destruction fit in

FERPA does include one important guardrail on disposal: a school generally may not destroy a record while there is an outstanding request to inspect or review it. Beyond that, FERPA does not set a fixed retention period or require routine destruction.

Retention and destruction schedules for student records usually come from other sources, such as:

• State education laws and state records-retention schedules.
• Institutional or district records management policies.
• Accreditation, audit, financial-aid, or grant requirements.
• Other federal laws that apply to specific record types.

In practice, this means a school can lawfully keep records under FERPA, secure them, and dispose of them only when a separate retention rule allows — and never while an access request is pending.

The records management takeaway

Treat FERPA as a privacy control layered on top of a retention schedule, not as the schedule itself. Sound practice combines both:

• Apply a documented retention schedule (driven by state and program rules) to decide when records may be destroyed.
• Apply FERPA-aligned access controls, consent tracking, and disclosure logging to govern who may see them in the meantime.
• Coordinate disposition with legal holds so nothing is destroyed while a request or hold is active.

Aligning these with a recognized privacy approach — such as the NIST Privacy Framework — and a records management standard helps institutions defend both their access controls and their disposal decisions.

Learn more on the privacy and PII topic hub.