What does FERPA say about how long schools must keep student education records and when they can dispose of them?

FERPA governs privacy, not retention periods

A common misconception is that the Family Educational Rights and Privacy Act (FERPA) tells schools how many years to keep student education records. It generally does not. FERPA is primarily a privacy and access law: it gives parents and eligible students the right to inspect and review education records, to seek amendment of inaccurate records, and to control the disclosure of personally identifiable information. It does not establish a master retention schedule for student records.

What FERPA does say about disposal

FERPA’s most direct rule on destruction relates to the right of access. A school generally may not destroy education records if there is an outstanding request to inspect and review them. In other words, a pending access request acts like a hold: the records must be preserved until the request is satisfied.

FERPA also requires schools to keep a record of certain disclosures of a student’s information to third parties. That disclosure log must be maintained for as long as the underlying education records are kept.

Where retention periods actually come from

Because FERPA is largely silent on how long to keep records, retention periods come from other authorities, such as:

• State law and state education agency rules, which often set specific minimums for transcripts, attendance, and discipline records.
• Other federal programs (for example, special education under IDEA, or grant and financial-aid recordkeeping requirements), each with their own retention obligations.
• Institutional records schedules developed by the school, district, or university and approved through its governance process.

Transcripts and other “permanent” academic records are frequently retained indefinitely under these schedules, while routine working records have much shorter periods.

Practical takeaways

• Treat FERPA as the privacy and access overlay, then build retention rules from state law and institutional schedules.
• Suspend destruction whenever there is an open access request, litigation hold, audit, or investigation.
• Dispose of records only under an approved retention schedule, using methods that prevent improper disclosure of personally identifiable information.

For broader principles on building defensible schedules and disposing of records consistently, see the retention and disposition topic hub.