FERPA: Rights and Protections for Student Data (OSUIT context)

FERPA Overview

FERPA stands for the Family Educational Rights and Privacy Act. It is a federal law that governs access to and the use of student data/PII in education records.
FERPA protects your PII during your time at an educational institution and after you attend or receive educational funding.
The act grants parents specific rights to access, to seek amendment of, and to have some control over the disclosure of their children's education records.
The purpose is to ensure privacy and appropriate handling of student records by educational agencies and institutions.

When a student turns 18 years old or enters a postsecondary institution, FERPA rights transfer from the parents to the student (become the rights of the eligible student).
The transcript references a resource: An Eligible Student Guide to the Family Educational Rights and Privacy Act published by the Department of Education. A copy should be downloaded/read for details.

FERPA protects your student data by restricting access and disclosure of education records.
Education records are those kept by educational agencies and institutions (e.g., OSUIT).
Eligible students have the right to view their education records, such as academic transcripts. Note: this right to view does not automatically guarantee the right to obtain a copy of those records.
Right to amend: Eligible students may request modification or changes to records if they believe they are inaccurate.
Right to control disclosure: Schools may not disclose PII from an eligible student’s records to outside entities without the student’s consent.
There are exceptions to disclosure (see the eligible student guide for specifics). The transcript points you to review the sidebar link for information on these exceptions.

Access: Only eligible students can view their education records (e.g., transcripts).
Copying: Viewing rights do not automatically imply a right to a copy; process for obtaining copies may vary by institution.
Amendments: Students can request amendments, but the institution is not always required to change the record.
Accuracy: The focus is on accuracy of records; institutions consider the request, but may deny if the record is deemed accurate.

Disclosure: Schools cannot disclose PII from a student’s education records to outside entities without consent, with exceptions noted in the guidance.
OSU IT/IR practice: The OSU IT Information Resources office reports only summarized data that cannot identify individual students, protecting privacy.
Exceptions: There are specific exceptions to disclosure and consent requirements. Review the linked Eligible Student Guide for details.

FERPA includes several exceptions to the general rule requiring consent for disclosure. Consult the Eligible Student Guide referenced in the resource sidebar for a complete list and explanations of these exceptions.

A key provision of FERPA is that educational institutions must notify eligible students of their FERPA rights on an annual basis.
This annual notification ensures ongoing awareness of rights to access, amend, and control disclosures.

For questions about FERPA at OSUIT, contact the Office of the Registrar.
Explore Oklahoma State University FERPA resources for students for additional guidance and context.
OSUIT emphasizes privacy in practice, including reporting practices that protect student identities (e.g., summarizing data rather than exposing individual records).

Complete the questions about student data rights and FERPA to verify your understanding before moving to the next lesson.
Review the link to the Eligible Student Guide for details on exceptions and procedures.
Be prepared to consider how FERPA rights apply to your own records and what questions to ask the registrar if you need access or amendments.

Our next lesson will cover tips for proactively managing your personal data security and protecting your information.

Builds on prior lessons about personally identifiable information (PII) and how institutions handle sensitive data.
Relates to foundational privacy principles, data governance, and the balance between student privacy and legitimate institutional needs.

PII: personally identifiable information
Eligible student: an individual who has reached 18 years of age or is enrolled in a postsecondary institution, to whom FERPA rights transfer
Education records: records maintained by educational agencies or institutions that contain information directly related to a student
Annual notification: yearly reminder to students of their FERPA rights
Consent: permission required for disclosure of PII in most cases, subject to listed exceptions

No numerical or statistical data are provided in this transcript. (If needed, include figures from the Eligible Student Guide or OSUIT policy in your notes.)