By Audience: Postsecondary School Officials

This guidance document is intended to help educational agencies and institutions create visual “maps” of how their data flows in the data systems.  Including maps in data governance plans can help organizations better understand what data are in their systems, where the data reside, what sources they come from, why those data are collected, what limitations or restrictions apply, how they are linked, and what policy questions those data are used to answer.

mapping data flow flows

This document lists mandatory requirements for written agreements under the studies exception and the audit or evaluation exception, as specified in the Family Educational Rights and Privacy Act.

Letter to Senator Ron Wyden providing clarification on the applicability of the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) to college and university students’ medical records, including therapy and treatment records, held by educational institutions.

Letter to Representative Suzanne Bonamici providing clarification on the applicability of the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) to college and university students’ medical records, including therapy and treatment records, held by educational institutions. 

This brief provides best practices for data security and data management trainings for educational leaders. The brief discusses key training concepts to follow, content, delivery methods, and possible audiences for these trainings.

This brief outlines critical threats to educational data and information systems. Threats are divided into two categories: technical and non-technical. A brief description of each threat is followed by a suggestion of appropriate risk mitigation measures.

This checklist is designed to assist stakeholder organizations with establishing and maintaining a successful data governance program by summarizing the key data privacy and security components of such a program and listing specific best practice action items.

This case study illustrates a scenario where the Student Privacy Policy Office (SPPO) investigates an alleged violation of the Family Educational Rights and Privacy Act, resulting in SPPO imposing a 5-year ban on sharing education data with the offending party.

This case study illustrates a scenario where a State educational agency creates high school feedback reports using the audit or evaluation exception under the Family Educational Rights and Privacy Act.