What student records does FERPA let a school destroy, and what has to be kept permanently?

A common misconception is that FERPA tells schools which student records to destroy and which to keep forever. It does not. The Family Educational Rights and Privacy Act is primarily a privacy and access law, not a retention schedule. Understanding that distinction is the key to answering this question correctly.

What FERPA Actually Controls

FERPA governs who may see a student’s education records, how those records are disclosed, and the rights of students and parents to inspect and request corrections. It applies to most schools that receive federal funding.

FERPA’s main retention-related rule is a preservation hold: a school generally may not destroy an education record while there is an outstanding request to inspect or review it. Beyond that, FERPA does not set fixed retention periods and does not require any record to be kept permanently. It also imposes specific recordkeeping duties around disclosure logs for certain releases of personally identifiable information.

What Decides Destruction and Permanent Retention

Because FERPA is largely silent on time periods, the actual decisions come from other sources, applied through the institution’s records retention schedule:

• State education laws and regulations, which often set minimum keeping periods for attendance, enrollment, and similar records.
• Accreditation requirements, which can dictate how long academic and program records are retained.
• Other federal programs (for example, financial aid rules) that carry their own retention obligations.
• Litigation or audit holds, which suspend disposition until the matter closes.

In practice, many institutions choose to keep the permanent academic record (the transcript) indefinitely, because students need it for decades and no rule favors its destruction. Transient or supporting materials, by contrast, are typically eligible for routine destruction once their retention period lapses and no hold applies.

The Practical Takeaway

Treat FERPA as the privacy and access framework, and treat your retention schedule as the authority on disposition. A defensible approach documents the legal basis for each retention period, suspends destruction during any access request or hold, and disposes of records consistently through an approved schedule rather than ad hoc deletion.

For broader guidance on managing records in digital systems, see the electronic records topic hub.

These same principles, sound schedules, documented authority, and disciplined holds, underlie federal recordkeeping practice generally.