# 34 CFR Part 99 — Subpart D
# (Family Educational Rights and Privacy — disclosure provisions)
#
# Source: Cornell Legal Information Institute (LII), https://www.law.cornell.edu/cfr/text/34
# Authority: Public-domain federal regulatory text (17 U.S.C. § 105).
# Retrieved: 2026-05-23T06:13:30.487909+00:00
# Sections bundled: §§ 99.30, 99.31, 99.32, 99.33, 99.36, 99.37
#
# Verbatim text of each section follows, separated by '====' rulers.
# Whitespace inside sections is normalized to single blank-line paragraph breaks;
# every other character (including § and em-dashes) is preserved as-is.

==============================================================================

§ 99.30 Under what conditions is prior consent required to disclose information?

(a) The parent or  eligible student shall provide a signed and dated written consent before an  educational agency or institution discloses personally identifiable information from the student's  education records, except as provided in § 99.31.

(b) The written consent must:

(1) Specify the records that may be disclosed;

(2) State the purpose of the disclosure; and

(3) Identify the party or class of parties to whom the  disclosure may be made.

(c) When a disclosure is made under paragraph (a) of this section:

(1) If a parent or  eligible student so requests, the  educational agency or institution shall provide him or her with a copy of the  records disclosed; and

(2) If the parent of a student who is not an  eligible student so requests, the agency or institution shall provide the student with a copy of the  records disclosed.

(d) “Signed and dated written consent” under this part may include a record and signature in electronic form that—

(1) Identifies and authenticates a particular person as the source of the electronic consent; and

(2) Indicates such person's approval of the information contained in the electronic consent.

(Authority: 20 U.S.C. 1232g (b)(1) and (b)(2)(A))

[53 FR 11943, Apr. 11, 1988, as amended at 58 FR 3189, Jan. 7, 1993; 69 FR 21671, Apr. 21, 2004]

==============================================================================

§ 99.31 Under what conditions is prior consent not required to disclose information?

(a) An educational agency or institution may disclose personally identifiable information from an education  record of a student without the consent required by § 99.30 if the  disclosure meets one or more of the following conditions:

(1)

(i)

(A) The disclosure is to other school officials, including teachers, within the agency or institution whom the agency or institution has determined to have legitimate educational interests.

(B) A contractor, consultant, volunteer, or other party to whom an agency or institution has outsourced institutional services or functions may be considered a school official under this paragraph provided that the outside party—

(1) Performs an institutional service or function for which the agency or institution would otherwise use employees;

(2) Is under the direct control of the agency or institution with respect to the use and maintenance of education records; and

(3) Is subject to the requirements of § 99.33(a) governing the use and redisclosure of personally identifiable information from education records.

(ii) An educational agency or institution must use reasonable methods to ensure that school officials obtain access to only those  education records in which they have legitimate educational interests. An  educational agency or institution that does not use physical or technological access controls must ensure that its administrative policy for controlling access to  education records is effective and that it remains in compliance with the legitimate educational interest requirement in paragraph (a)(1)(i)(A) of this section.

(2) The disclosure is, subject to the requirements of § 99.34, to officials of another school, school system, or institution of postsecondary education where the student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for purposes related to the student's enrollment or transfer.

Note:

Section 4155(b) of the No Child Left Behind Act of 2001, 20 U.S.C. 7165(b), requires each State to assure the  Secretary of Education that it has a procedure in place to facilitate the transfer of disciplinary  records with respect to a suspension or expulsion of a student by a local educational agency to any private or public elementary or secondary school in which the student is subsequently enrolled or seeks, intends, or is instructed to enroll.

(3) The disclosure is, subject to the requirements of § 99.35, to authorized representatives of— 

(i) The Comptroller General of the United States; 

(ii) The Attorney General of the United States; 

(iii) The Secretary; or 

(iv) State and local educational authorities. 

(4)

(i) The disclosure is in connection with financial aid for which the student has applied or which the student has received, if the information is necessary for such purposes as to:

(A) Determine eligibility for the aid;

(B) Determine the amount of the aid;

(C) Determine the conditions for the aid; or 

(D) Enforce the terms and conditions of the aid.

(ii) As used in paragraph (a)(4)(i) of this section, financial aid means a payment of funds provided to an individual (or a payment in kind of tangible or intangible property to the individual) that is conditioned on the individual's attendance at an  educational agency or institution.

(Authority: 20 U.S.C. 1232g(b)(1)(D))

(5)

(i) The disclosure is to State and local officials or authorities to whom this information is specifically—

(A) Allowed to be reported or disclosed pursuant to State statute adopted before November 19, 1974, if the allowed reporting or disclosure concerns the juvenile justice system and the system's ability to effectively serve the student whose  records are released; or

(B) Allowed to be reported or disclosed pursuant to State statute adopted after November 19, 1974, subject to the requirements of § 99.38.

(ii) Paragraph (a)(5)(i) of this section does not prevent a State from further limiting the number or type of State or local officials to whom  disclosures may be made under that paragraph.

(6)

(i) The disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions to:

(A) Develop, validate, or administer predictive tests;

(B) Administer student aid programs; or

(C) Improve instruction.

(ii) Nothing in the Act or this part prevents a State or local educational authority or agency headed by an official listed in paragraph (a)(3) of this section from entering into agreements with organizations conducting studies under paragraph (a)(6)(i) of this section and redisclosing personally identifiable information from  education records on behalf of educational agencies and institutions that disclosed the information to the State or local educational authority or agency headed by an official listed in paragraph (a)(3) of this section in accordance with the requirements of § 99.33(b).

(iii) An educational agency or institution may disclose personally identifiable information under paragraph (a)(6)(i) of this section, and a State or local educational authority or agency headed by an official listed in paragraph (a)(3) of this section may redisclose personally identifiable information under paragraph (a)(6)(i) and (a)(6)(ii) of this section, only if—

(A) The study is conducted in a manner that does not permit personal identification of parents and students by individuals other than representatives of the organization that have legitimate interests in the information;

(B) The information is destroyed when no longer needed for the purposes for which the study was conducted; and

(C) The educational agency or institution or the State or local educational authority or agency headed by an official listed in paragraph (a)(3) of this section enters into a written agreement with the organization that—

(1) Specifies the purpose, scope, and duration of the study or studies and the information to be disclosed;

(2) Requires the organization to use personally identifiable information from education records only to meet the purpose or purposes of the study as stated in the written agreement;

(3) Requires the organization to conduct the study in a manner that does not permit personal identification of parents and students, as defined in this part, by anyone other than representatives of the organization with legitimate interests;

and

(4) Requires the organization to destroy all personally identifiable information when the information is no longer needed for the purposes for which the study was conducted and specifies the time period in which the information must be destroyed.

(iv) An educational agency or institution or State or local educational authority or Federal agency headed by an official listed in paragraph (a)(3) of this section is not required to initiate a study or agree with or endorse the conclusions or results of the study.

(v) For the purposes of paragraph (a)(6) of this section, the term organization includes, but is not limited to, Federal, State, and local agencies, and independent organizations.

(7) The disclosure is to accrediting organizations to carry out their accrediting functions.

(8) The disclosure is to parents, as defined in § 99.3, of a dependent student, as defined in section 152 of the Internal Revenue Code of 1986. 

(9)

(i) The disclosure is to comply with a judicial order or lawfully issued subpoena.

(ii) The educational agency or institution may disclose information under paragraph (a)(9)(i) of this section only if the agency or institution makes a reasonable effort to notify the  parent or  eligible student of the order or subpoena in advance of compliance, so that the  parent or  eligible student may seek protective action, unless the  disclosure is in compliance with—

(A) A Federal grand jury subpoena and the court has ordered that the existence or the contents of the subpoena or the information furnished in response to the subpoena not be disclosed; 

(B) Any other subpoena issued for a law enforcement purpose and the court or other issuing agency has ordered that the existence or the contents of the subpoena or the information furnished in response to the subpoena not be disclosed; or

(C) An ex parte court order obtained by the United States Attorney General (or designee not lower than an Assistant Attorney General) concerning investigations or prosecutions of an offense listed in 18 U.S.C. 2332b(g)(5)(B) or an  act of domestic or international terrorism as defined in 18 U.S.C. 2331.

(iii)

(A) If an educational agency or institution initiates legal action against a  parent or student, the  educational agency or institution may disclose to the court, without a court order or subpoena, the  education records of the student that are relevant for the  educational agency or institution to proceed with the legal action as plaintiff. 

(B) If a parent or  eligible student initiates legal action against an  educational agency or institution, the  educational agency or institution may disclose to the court, without a court order or subpoena, the student's  education records that are relevant for the  educational agency or institution to defend itself. 

(10) The disclosure is in connection with a health or safety emergency, under the conditions described in § 99.36.

(11) The disclosure is information the  educational agency or institution has designated as “directory information”, under the conditions described in § 99.37.

(12) The disclosure is to the  parent of a student who is not an  eligible student or to the student.

(13) The disclosure, subject to the requirements in § 99.39, is to a victim of an  alleged perpetrator of a crime of violence or a non-forcible sex offense. The  disclosure may only include the  final results of the disciplinary proceeding conducted by the institution of postsecondary education with respect to that alleged crime or offense. The institution may disclose the final results of the disciplinary proceeding, regardless of whether the institution concluded a violation was committed. 

(14)

(i) The disclosure, subject to the requirements in § 99.39, is in connection with a disciplinary proceeding at an institution of postsecondary education. The institution must not disclose the final results of the disciplinary proceeding unless it determines that— 

(A) The student is an alleged perpetrator of a crime of violence or non-forcible sex offense; and 

(B) With respect to the allegation made against him or her, the student has committed a violation of the institution's rules or policies. 

(ii) The institution may not disclose the name of any other student, including a victim or witness, without the prior written consent of the other student. 

(iii) This section applies only to disciplinary proceedings in which the final results were reached on or after October 7, 1998. 

(15)

(i) The disclosure is to a  parent of a student at an institution of postsecondary education regarding the student's violation of any Federal, State, or local law, or of any rule or policy of the institution, governing the use or possession of alcohol or a controlled substance if— 

(A) The institution determines that the student has committed a disciplinary violation with respect to that use or possession; and 

(B) The student is under the age of 21 at the time of the disclosure to the  parent. 

(ii) Paragraph (a)(15) of this section does not supersede any provision of State law that prohibits an institution of postsecondary education from disclosing information. 

(16) The disclosure concerns sex offenders and other individuals required to register under section 170101 of the Violent Crime Control and Law Enforcement Act of 1994, 42 U.S.C. 14071, and the information was provided to the  educational agency or institution under 42 U.S.C. 14071 and applicable Federal guidelines.

(b)

(1) De-identified records and information. An educational agency or institution, or a  party that has received  education records or information from  education records under this part, may release the  records or information without the consent required by § 99.30 after the removal of all personally identifiable information provided that the  educational agency or institution or other  party has made a reasonable determination that a student's identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information.

(2) An educational agency or institution, or a  party that has received  education records or information from  education records under this part, may release de-identified student level data from  education records for the purpose of education research by attaching a code to each  record that may allow the recipient to match information received from the same source, provided that—

(i) An educational agency or institution or other  party that releases de-identified data under paragraph (b)(2) of this section does not disclose any information about how it generates and assigns a  record code, or that would allow a recipient to identify a student based on a  record code;

(ii) The record code is used for no purpose other than identifying a de-identified  record for purposes of education research and cannot be used to ascertain personally identifiable information about a student; and

(iii) The record code is not based on a student's social security number or other personal information.

(c) An educational agency or institution must use reasonable methods to identify and authenticate the identity of parents, students, school officials, and any other parties to whom the agency or institution discloses personally identifiable information from  education records.

(d) Paragraphs (a) and (b) of this section do not require an educational agency or institution or any other  party to disclose  education records or information from  education records to any  party except for parties under paragraph (a)(12) of this section.

(Authority: 20 U.S.C. 1232g(a)(5)(A), (b), (h), (i), and (j)).

[53 FR 11943, Apr. 11, 1988; 53 FR 19368, May 27, 1988, as amended at 58 FR 3189, Jan. 7, 1993; 61 FR 59296, Nov. 21, 1996; 65 FR 41853, July 6, 2000; 73 FR 74852, Dec. 9, 2008; 74 FR 401, Jan. 6, 2009; 76 FR 75641, Dec. 2, 2011]

==============================================================================

§ 99.32 What recordkeeping requirements exist concerning requests and disclosures?

(a)

(1) An educational agency or institution must maintain a  record of each request for access to and each  disclosure of personally identifiable information from the  education records of each student, as well as the names of State and local educational authorities and Federal officials and agencies listed in § 99.31(a)(3) that may make further  disclosures of personally identifiable information from the student's  education records without consent under § 99.33(b).

(2) The agency or institution shall maintain the record with the  education records of the student as long as the  records are maintained.

(3) For each request or disclosure the  record must include:

(i) The parties who have requested or received personally identifiable information from the education records; and

(ii) The legitimate interests the parties had in requesting or obtaining the information.

(4) An educational agency or institution must obtain a copy of the  record of further  disclosures maintained under paragraph (b)(2) of this section and make it available in response to a  parent's or  eligible student's request to review the  record required under paragraph (a)(1) of this section.

(5) An educational agency or institution must  record the following information when it discloses personally identifiable information from  education records under the health or safety emergency exception in § 99.31(a)(10) and § 99.36:

(i) The articulable and significant threat to the health or safety of a student or other individuals that formed the basis for the disclosure; and

(ii) The parties to whom the agency or institution disclosed the information.

(b)

(1) Except as provided in paragraph (b)(2) of this section, if an  educational agency or institution discloses personally identifiable information from  education records with the understanding authorized under § 99.33(b), the  record of the  disclosure required under this section must include:

(i) The names of the additional parties to which the receiving party may disclose the information on behalf of the  educational agency or institution; and

(ii) The legitimate interests under § 99.31 which each of the additional parties has in requesting or obtaining the information.

(2)

(i) A State or local educational authority or Federal official or agency listed in § 99.31(a)(3) that makes further  disclosures of information from  education records under § 99.33(b) must  record the names of the additional parties to which it discloses information on behalf of an  educational agency or institution and their legitimate interests in the information under § 99.31 if the information was received from:

(A) An educational agency or institution that has not  recorded the further  disclosures under paragraph (b)(1) of this section; or

(B) Another State or local educational authority or Federal official or agency listed in § 99.31(a)(3).

(ii) A State or local educational authority or Federal official or agency that records further  disclosures of information under paragraph (b)(2)(i) of this section may maintain the  record by the student's class, school, district, or other appropriate grouping rather than by the name of the student.

(iii) Upon request of an educational agency or institution, a State or local educational authority or Federal official or agency listed in § 99.31(a)(3) that maintains a  record of further  disclosures under paragraph (b)(2)(i) of this section must provide a copy of the  record of further  disclosures to the  educational agency or institution within a reasonable period of time not to exceed 30 days.

(c) The following parties may inspect the record relating to each student:

(1) The parent or  eligible student.

(2) The school official or his or her assistants who are responsible for the custody of the records.

(3) Those parties authorized in § 99.31(a) (1) and (3) for the purposes of auditing the recordkeeping procedures of the  educational agency or institution.

(d) Paragraph (a) of this section does not apply if the request was from, or the  disclosure was to:

(1) The parent or  eligible student;

(2) A school official under § 99.31(a)(1);

(3) A party with written consent from the  parent or  eligible student;

(4) A party seeking  directory information; or

(5) A party seeking or receiving  records in accordance with § 99.31(a)(9)(ii)(A) through (C).

(Approved by the Office of Management and Budget under control number 1880-0508)

(Authority: 20 U.S.C. 1232g(b)(1) and (b)(4)(A))

[53 FR 11943, Apr. 11, 1988, as amended at 61 FR 59297, Nov. 21, 1996; 73 FR 74853, Dec. 9, 2008]

==============================================================================

§ 99.33 What limitations apply to the redisclosure of information?

(a)

(1) An educational agency or institution may disclose personally identifiable information from an education  record only on the condition that the  party to whom the information is disclosed will not disclose the information to any other  party without the prior consent of the  parent or  eligible student.

(2) The officers, employees, and agents of a party that receives information under paragraph (a)(1) of this section may use the information, but only for the purposes for which the  disclosure was made.

(b)

(1) Paragraph (a) of this section does not prevent an  educational agency or institution from disclosing personally identifiable information with the understanding that the  party receiving the information may make further  disclosures of the information on behalf of the  educational agency or institution if—

(i) The disclosures meet the requirements of § 99.31; and

(ii)

(A) The educational agency or institution has complied with the requirements of § 99.32(b); or

(B) A State or local educational authority or Federal official or agency listed in § 99.31(a)(3) has complied with the requirements of § 99.32(b)(2).

(2) A party that receives a court order or lawfully issued subpoena and rediscloses personally identifiable information from  education records on behalf of an  educational agency or institution in response to that order or subpoena under § 99.31(a)(9) must provide the notification required under § 99.31(a)(9)(ii).

(c) Paragraph (a) of this section does not apply to  disclosures under §§ 99.31(a)(8), (9), (11), (12), (14), (15), and (16), and to information that postsecondary institutions are required to disclose under the Jeanne Clery  Disclosure of Campus Security Policy and Campus Crime Statistics  Act, 20 U.S.C. 1092(f) (Clery Act), to the accuser and accused regarding the outcome of any campus disciplinary proceeding brought alleging a sexual offense.

(d) An educational agency or institution must inform a  party to whom  disclosure is made of the requirements of paragraph (a) of this section except for  disclosures made under §§ 99.31(a)(8), (9), (11), (12), (14), (15), and (16), and to information that postsecondary institutions are required to disclose under the Clery  Act to the accuser and accused regarding the outcome of any campus disciplinary proceeding brought alleging a sexual offense.

(Authority: 20 U.S.C. 1232g(b)(4)(B))

[53 FR 11943, Apr. 11, 1988, as amended at 61 FR 59297, Nov. 21, 1996; 65 FR 41853, July 6, 2000; 73 FR 74853, Dec. 9, 2008; 76 FR 75642, Dec. 2, 2011]

==============================================================================

§ 99.36 What conditions apply to disclosure of information in health and safety emergencies?

(a) An educational agency or institution may disclose personally identifiable information from an education  record to appropriate parties, including  parents of an  eligible student, in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.

(b) Nothing in this Act or this part shall prevent an  educational agency or institution from—

(1) Including in the education records of a student appropriate information concerning disciplinary action taken against the student for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community;

(2) Disclosing appropriate information maintained under paragraph (b)(1) of this section to teachers and school officials within the agency or institution who the agency or institution has determined have legitimate educational interests in the behavior of the student; or

(3) Disclosing appropriate information maintained under paragraph (b)(1) of this section to teachers and school officials in other schools who have been determined to have legitimate educational interests in the behavior of the student.

(c) In making a determination under paragraph (a) of this section, an  educational agency or institution may take into account the totality of the circumstances pertaining to a threat to the health or safety of a student or other individuals. If the  educational agency or institution determines that there is an articulable and significant threat to the health or safety of a student or other individuals, it may disclose information from  education records to any person whose knowledge of the information is necessary to protect the health or safety of the student or other individuals. If, based on the information available at the time of the determination, there is a rational basis for the determination, the Department will not substitute its judgment for that of the  educational agency or institution in evaluating the circumstances and making its determination.

(Authority: 20 U.S.C. 1232g (b)(1)(I) and (h))

[53 FR 11943, Apr. 11, 1988; 53 FR 19368, May 27, 1988, as amended at 61 FR 59297, Nov. 21, 1996; 73 FR 74854, Dec. 9, 2008]

==============================================================================

§ 99.37 What conditions apply to disclosing directory information?

(a) An educational agency or institution may disclose  directory information if it has given public  notice to  parents of students in  attendance and  eligible students in  attendance at the agency or institution of:

(1) The types of personally identifiable information that the agency or institution has designated as directory information;

(2) A parent's or  eligible student's right to refuse to let the agency or institution designate any or all of those types of information about the student as  directory information; and

(3) The period of time within which a parent or  eligible student has to notify the agency or institution in writing that he or she does not want any or all of those types of information about the student designated as  directory information.

(b) An educational agency or institution may disclose  directory information about former students without complying with the  notice and opt out conditions in paragraph (a) of this section. However, the agency or institution must continue to honor any valid request to opt out of the  disclosure of  directory information made while a student was in  attendance unless the student rescinds the opt out request.

(c) A parent or  eligible student may not use the right under paragraph (a)(2) of this section to opt out of  directory information disclosures to—

(1) Prevent an educational agency or institution from disclosing or requiring a student to disclose the student's name, identifier, or institutional email address in a class in which the student is enrolled; or

(2) Prevent an educational agency or institution from requiring a student to wear, to display publicly, or to disclose a student ID card or badge that exhibits information that may be designated as  directory information under § 99.3 and that has been properly designated by the  educational agency or institution as  directory information in the public  notice provided under paragraph (a)(1) of this section.

(d) In its public notice to  parents and  eligible students in  attendance at the agency or institution that is described in paragraph (a) of this section, an  educational agency or institution may specify that  disclosure of  directory information will be limited to specific parties, for specific purposes, or both. When an  educational agency or institution specifies that  disclosure of  directory information will be limited to specific parties, for specific purposes, or both, the  educational agency or institution must limit its  directory information disclosures to those specified in its public  notice that is described in paragraph (a) of this section.

(e) An educational agency or institution may not disclose or confirm  directory information without meeting the written consent requirements in § 99.30 if a student's social security number or other non-directory information is used alone or combined with other data elements to identify or help identify the student or the student's records.

(Authority: 20 U.S.C. 1232g(a)(5) (A) and (B))

[53 FR 11943, Apr. 11, 1988, as amended at 73 FR 74854, Dec. 9, 2008; 76 FR 75642, Dec. 2, 2011]
