What records does FERPA require a school to keep, and when can a student's education records be destroyed?

The Family Educational Rights and Privacy Act (FERPA) is often misunderstood as a records-retention law. It is not. FERPA is primarily a privacy and access statute: it governs who may see, amend, and disclose a student’s education records, and it gives students (or parents, for minors) rights over those records. It does not, on its own, set a master list of records every school must create or a fixed number of years each must be kept.

What records FERPA covers

FERPA applies to “education records” broadly defined: records directly related to a student and maintained by an educational agency or institution (or a party acting for it). In practice this includes items such as transcripts, grades, enrollment and attendance records, disciplinary files, and similar student-specific information. Certain materials are excluded, including sole-possession notes kept by an individual, some law-enforcement unit records, and employment records unrelated to student status.

Rather than mandating creation of specific documents, FERPA assumes a school maintains the records it needs to operate and then regulates how those records are handled, disclosed, and corrected.

When education records can be destroyed

FERPA places one key limit on destruction: a school generally may not destroy an education record while there is an outstanding request to inspect or review it. Outside of that, FERPA does not prescribe retention periods.

Actual retention and destruction timelines come from other sources:

• State education laws and regulations, which often set minimum retention for transcripts and student files.
• Accreditation and program requirements.
• Federal program rules tied to specific funding (for example, financial-aid or grant records).
• The institution’s own approved records retention schedule.

Some records, such as official transcripts, are commonly retained permanently, while routine or transitory student records may be eligible for disposal after a defined period once no legal hold or pending request applies.

Practical guidance

Treat FERPA as the privacy and access layer, and build retention into a written schedule that aligns with state law, funding rules, and recognized recordkeeping practice. Confirm no inspection request or litigation hold is active before any disposition, and document the destruction.

For related frameworks and standards, see the compliance standards hub.