FRAMEWORKS / READINESS / Sector-specific
FERPA
Protection of US education records with access and disclosure requirements.
SCOPE & APPLICABILITY
What the framework actually requires
US law for eligible educational institutions; does not automatically apply outside the US.
What matters in practice
Requirements depend on scope. These are the areas to evaluate, not a guarantee of certification or regulatory compliance.
Education records
Identify records and roles.
Disclosure and access
Review access and disclosures.
Consent and documentation
Document request handling.
An operational path, not a checkbox exercise
Translate requirements into accountable activities, evidence and reviewed controls.
Identify records and roles.
Review access and disclosures.
Document request handling.
APPLICABILITY
Who should assess this framework?
For US educational institutions subject to FERPA and certain service providers processing records under contractual conditions. It does not automatically apply to Romanian schools.
BEYOND CHECKLISTS
Why this matters
Education records need governance: define what counts as a record, who may access it and under what conditions disclosure is permitted.
EVIDENCE & OPERATIONS
What your organisation should be able to evidence
This is a practical starting point, not an exhaustive set of regulatory obligations or a substitute for an independent audit.
- 01 Institution and provider applicability assessment
- 02 Education record inventory and data flows
- 03 Access roles and disclosure logs
- 04 Consent and relevant exception procedures
- 05 Service provider contracts and instructions
- 06 Documented access, amendment and review processes
FAQ
Frequently asked questions
Practical distinctions worth understanding before starting your programme.
Is FERPA an EU law?
No. FERPA is US federal legislation on education records for eligible educational institutions.
Must all EdTech platforms be FERPA certified?
There is no general official FERPA certification. Duties depend on the institution's context, access and contracts.
Does FERPA prohibit every disclosure?
No. Certain disclosures are permitted under defined conditions and exceptions. Evaluate each scenario.
FURTHER READING
Explore related resources
Use original ZebraByte articles and guides to explore security programmes, privacy governance and readiness.
Framework descriptions are educational. Applicability, service availability and any independent assessment require confirmation for your organisation.
Important scope boundary
ZebraByte can discuss readiness, technical controls and programme management. A regulator, qualified auditor or certification body makes the applicable independent determination. Support for a particular framework is subject to the agreed service scope.
Related frameworks and programmes
Need a scope assessment for your organisation?
Share your sector, systems and contractual requirements. We can outline the next practical steps and clarify whether this framework is relevant.