Where the education record starts and stops, in the schema

In short

Under FERPA, an education record is information recorded in any medium, directly related to an identifiable student, and maintained by the institution or a party acting for it. Both prongs must hold. For a system designer that makes the boundary a field-level classification every store is tagged against — logs, caches, exports and backups included.

BuildspaceLabs28 July 20265 min read5 sections

Key takeaways

Two prongs decide it: directly related to an identifiable student, and maintained by the school or its agent.
Medium is irrelevant. A chat transcript, a prompt log and an error payload are records the moment they persist.
Any store derived from an inside store is inside until somebody proves it is de-identified.
The sole-possession exclusion dies the instant a private note syncs somewhere a second person can read it.
Tag stores and fields, not applications, and check the tags automatically — new columns join the boundary silently.

An education record is information recorded in any medium that is directly related to an identifiable student and maintained by the institution or by a party acting for it. Both conditions must hold. The definition sits in the FERPA regulations at 34 CFR 99.3, and the second prong is what makes it an engineering problem: a vendor holding student rows on a school's behalf stands inside the boundary, with the school's obligations flowing through.

This is an engineering reading of a legal definition, not legal advice, and the institution's counsel owns the edges. BuildspaceLabs holds no privacy or security certifications, so treat the classification below as a design tool rather than an assurance.

The two prongs, and what each one does to a schema

Directly related to a student. This is identifiability, and it needs no name column. A row keyed to a pseudonymous id your systems can resolve to a person qualifies, and so does free text naming them inside a field called "description".
Maintained by the institution or its agent. Custody plus durability: data in flight is not maintained, data written to disk is. A vendor stands inside through the school official exception, which is the legal footing a build rests on and the obligations it carries.
Recorded in any medium. The regulation lists handwriting, print, tape, film, microfilm, microfiche and electronic media — the sentence that pulls chat transcripts, prompt logs and support tickets into scope the moment they are stored.

So the unit of classification is a store and its fields, not an application. "The SIS is the student data system" is how a team ends up with student identifiers in an error log, a search index and a metrics warehouse that nobody classified, because none of the three feels like a student data system.

A classification table your stores can be tagged against

One row per store, with the class and the access rule attached to the row rather than to the team that owns it.

Store	What it holds	Class	Access rule
Enrolment and scheduling tables	Identified students, sections, terms	Inside	Role plus current-term scope
Gradebook and assessment	Marks, rubric feedback, submissions	Inside	Assigned instructor and the student
Discipline and safeguarding notes	Incidents tied to named students	Inside, most restricted	Named case handlers only
Advising notes in the product	Free text about a student	Inside — sharing kills the sole-possession exclusion	Advisor of record, audited reads
Support tickets naming a student	Staff or parent describing an issue	Inside — class follows content, not tooling	Support staff, redaction on export
Assistant transcripts and prompt logs	Student text, sometimes retrieved records	Inside where a student is identifiable	Break-glass with a logged reason
Application error payloads	Whatever was in the request	Inside unless identifiers are stripped before write	Scrub at source, not at read
Retrieval index and embedding store	Derived from record content	Inside — derived stores inherit class	Same filters as the source
Backups, exports and DR copies	Everything above	Inside, same class as the source	Deletion must reach them
Aggregate counts, no re-identification path	Cohort totals	Outside, subject to cohort size	Publishable after a small-cohort check

Common stores in a school product, classified

The exclusions, and the one software usually destroys

The regulation carves several categories out of the definition. Four matter to most builds.

Sole possession records. Kept in the sole possession of the maker, used only as a personal memory aid, revealed to nobody except a temporary substitute. A "private notes" feature writing plaintext to a database an administrator can query is not sole possession, whatever the interface calls it. Adding sync is how products destroy this one.
Law enforcement unit records, created and maintained by a designated unit for a law enforcement purpose. Designation and purpose both matter; a discipline record does not become one by being copied.
Employment records, unless employment is contingent on being a student — so student workers and teaching assistants usually stay inside rather than outside.
Treatment records for students aged 18 or over, made by a recognised professional in connection with treatment and disclosed only to those providing it. Widen the audience and the exclusion goes.

One boundary case shows how far "maintained" has been argued: in Owasso Independent School District v. Falvo, 534 U.S. 426 (2002), the Supreme Court held that papers graded by fellow students before the teacher collects them are not yet education records. The lesson for a build is that persistence into the institution's records is the trigger, which is why an ephemeral pipeline and a logged one classify differently.

The question is never whether a system is a student information system. It is whether this table, in this store, can be joined to a person the school is responsible for.

Tagging it so the boundary survives the next sprint

Inventory every store, not every service: tables, object storage prefixes, queues, caches, indexes, log destinations and backup targets. The ones teams have not classified are almost always log destinations and search indexes.
Tag each field with identifiability, custody and class, and keep the tag next to the schema so it moves with the migration that changes the column.
Apply the derived-store default: inherited class unless de-identification is demonstrated in writing.
Attach access rules to the class rather than the table, so a new table with the same class arrives pre-governed.
Enforce the tags in continuous integration. A migration adding a student identifier to an unclassified table should fail the build, because review will not catch it.
Record who classified each store and when. A review will ask, and "it has always been like that" does not close a security questionnaire.

A machine-checkable structure with a person named at each decision point is the same shape we argue for in AI agents in production, and how we scope classification work inside AI agents and automation engagements.

Where this boundary meets the rest of the product

Three neighbouring decisions depend on this classification. Some fields inside the boundary may be released without consent under a school's designated policy, which is a per-student flag your code honours rather than a paragraph in a handbook — directory information as a field, not a policy. The contract then converts these obligations into deliverables, and knowing which clauses need code that does not exist yet is the point of reading a school data agreement clause by clause.

The third is the one teams forget: anything cached on a device for offline use is a copy of the education record sitting outside your infrastructure, which makes classification part of the shell decision in a native campus app versus a web app on the home screen. The rest of the silo sits under student data privacy, engineered, within our education and edtech work.

Frequently asked questions

Short answers to the follow-ups this page tends to raise.

What is an education record under FERPA?

It is information recorded in any medium that is directly related to an identifiable student and maintained by the school or a party acting for it, as defined at 34 CFR 99.3. Both parts are required: unrecorded information is not a record, and persisted information not tied to an identifiable student is not one either. The medium is irrelevant, which is why logs and transcripts count.

Does FERPA apply to a third-party software vendor?

The statute binds institutions, and its obligations reach a vendor through the contract and the school official exception, under which the vendor performs an institutional service under the school's direct control over the use and maintenance of records. In practice the vendor is expected to behave as the school would: use data only for the contracted purpose, restrict onward disclosure, and delete on instruction.

Are chatbot transcripts education records?

Yes, once stored and a student is identifiable in or through them. A transcript of a student's own words about enrolment, grades or wellbeing is directly related to that student, and storing it makes it maintained. Practically, the transcript store needs the same access control, retention clock and deletion path as the records it discusses, and redaction has to happen before the write.

Is a private teacher note outside the education record?

Only while it genuinely stays in the sole possession of its author, serves purely as a personal memory aid, and is seen by nobody except a temporary substitute. Almost no software feature meets that test, because storing a note in a multi-tenant database with administrator access makes it accessible to others by construction. Assume a notes feature is inside the boundary.

What is the difference between an education record and directory information?

Directory information is a subset of the education record a school has designated as releasable without consent — typically name, enrolment status and similar low-sensitivity fields. It is still an education record with a different disclosure rule, and any student or parent may opt out of the designation. Treat it as a per-student flag gating outbound surfaces, never as data that has left the boundary.

FERPA
student data
data classification
privacy engineering

// shipped work

The work behind this page

Builds from our portfolio that this page draws on.

AskVault

An AI internal knowledge-search platform that answers employee questions from your own docs — grounded in citations, with knowledge gaps surfaced and deflection tracked.

Productivity AI

Notewell

An AI meeting assistant that records and transcribes every meeting, extracts the decisions and action items, assigns owners and due dates, and tracks follow-through until it's done.