How long must a school keep student education records under FERPA before it can destroy them?

The short answer surprises many people: the federal Family Educational Rights and Privacy Act (FERPA) does not set a general minimum retention period for student education records, and it does not require schools to keep them for any fixed number of years before destruction. FERPA is primarily a privacy and access law, not a retention schedule.

What FERPA actually requires

FERPA governs how schools handle the privacy of education records and a parent’s or eligible student’s right to inspect them. It contains one key restriction on destruction rather than a retention clock:

• A school may not destroy an education record if there is an outstanding request to inspect or review it. The record must be preserved until that request has been fulfilled.
• FERPA also requires schools to keep a record of disclosures — who requested or received access to a student’s records — for as long as the underlying education record is maintained.

Outside of those rules, FERPA generally leaves the decision of how long to keep records, and when to destroy them, to the institution and to other governing authorities.

Where the actual retention periods come from

Because FERPA is silent on duration, schools set retention periods based on other sources, which is the normal way any organization builds a defensible schedule:

• State education and public-records laws, which frequently set specific minimums for transcripts, special-education files, and other categories.
• Other federal program requirements — for example, financial-aid or grant rules that carry their own recordkeeping obligations.
• Operational and legal needs, including accreditation, audit, and the possibility of litigation (which can trigger a hold suspending destruction).
• The institution’s own records retention schedule, which consolidates all of the above into approved retention and disposition instructions.

The practical takeaway

There is no single FERPA “X-year then destroy” answer. Treat FERPA as the privacy guardrail — never destroy a record with a pending access request — and look to state law, program rules, and your own approved retention schedule for the actual timelines. The same disciplined, schedule-driven approach federal agencies use under the federal records framework applies here: document the authority for each retention period and destroy only under an approved, defensible process. Permanent destruction should always follow a written schedule, not an assumption.