By Audience: Education Technology Vendors

The resources on this page are intended for vendors and other third party providers who are developing, or selling educational technology apps or services that utilizes or collect or uses Students’ Personally Identifiable Information.  Resources found here are intended to provide technical assistance and best practices for those vendors to ensure they are properly handling FERPA-protected information.

Guidance

Improving the Effectiveness and Efficiency of FERPA Enforcement

The Department is committed to protecting student privacy. To provide more timely and effective assistance to parents and students and to address a recommendation made by the Department’s Office of the Inspector General to “implement a risk-based approach to processing and resolving FERPA complaints,”  the Department is modifying its investigatory practices to more efficiently address and resolve complaints and violations under FERPA.  

Best Practices

LEA Website Privacy Transparency Review Final Report

The Student Privacy Policy Office (SPPO) at the U.S. Department of Education (Department) performed a four-year review of a nationally representative sample of the websites of 1,504 local education agencies (LEAs) to identify whether and how these websites include information about student privacy.

Recorded Webinars

Credit Interoperability and Blockchain Solutions - Webinar

In the first installment of our three part webinar series, we will discuss an important credit interoperability use case — reverse transfer, where postsecondary institutions facilitate data transactions between with other academic institutions to award credentials to students when they physically transfer. During this session, we will explore where in the implementation of this system occur implications for data privacy and security, how FERPA applies in these cases, and what questions were addressed by the institutions involved to ensure FERPA compliance.

Guidance

Best Practices for Data Destruction

The Data Destruction Document is a best practices guide on properly destroying sensitive student data after it is no longer needed.  It details the life cycle of data and discusses various legal requirements relating to the destruction of data under FERPA, and examines a variety of methods for properly destroying data.  The guide also discusses best practices for data destruction and provides some real-world examples of how to implement it within your organization.