FERPA Redaction: How to Redact Student Education Records

By the SladdPDF team · Published August 24, 2026 · Updated August 24, 2026

FERPA — the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g — protects the privacy of student education records at any school that receives federal education funding. When a transcript, disciplinary file, or enrollment record has to go to a third party (a newspaper under a public-records request, opposing counsel, an accreditor, a researcher), the school's job is to disclose only what the requester is entitled to and redact everyone else's personally identifiable information first.

What is FERPA and who does it cover?

FERPA is a U.S. federal law, codified at 20 U.S.C. § 1232g and implemented through regulations at 34 CFR Part 99, administered by the Department of Education's Student Privacy Policy Office (SPPO). It applies to any "educational agency or institution" — a school district, a K-12 school, a college or university — that receives funding under a program administered by the Department. In practice that covers nearly every public school and the large majority of colleges and universities in the United States.

FERPA protects "education records": records that are directly related to a student and maintained by the school or by a party acting for the school (34 CFR § 99.3). That reaches far beyond grades — enrollment files, disciplinary records, financial aid files, special-education records, and campus-police records tied to a specific student can all qualify.

Rights under FERPA start with the parents, then transfer to the student — called an "eligible student" once that happens — at age 18, or upon enrolling in a postsecondary institution at any age, whichever comes first (34 CFR § 99.5). A 17-year-old college freshman becomes the rights-holder on enrollment day, not on their eighteenth birthday.

What counts as personally identifiable information?

FERPA's definition of personally identifiable information (PII), at 34 CFR § 99.3, is deliberately broad and includes categories that redaction checklists for other laws often miss:

• The student's name
• The name of a parent or other family member
• The address of the student or student's family
• A personal identifier — Social Security number, student ID number, or biometric record
• Other indirect identifiers — date of birth, place of birth, and mother's maiden name
• Other information that, alone or in combination, is linked or linkable to a specific student and would allow a reasonable person in the school community, who does not have personal knowledge of the circumstances, to identify the student with reasonable certainty
• Information requested by a person the school reasonably believes knows the identity of the student the record is about

That last catch-all is why redacting a student record is rarely just a find-and-black-out job on names and ID numbers. Course sections, team rosters, unique disability accommodations, and small-cohort demographics can all single a student out even after the obvious identifiers are gone.

The consent rule and its exceptions

The default rule under FERPA is that a school may not disclose PII from a student's education records without prior written consent from the parent or eligible student. 34 CFR § 99.31 then lists specific circumstances where consent is not required — the list schools actually work from day to day. The most common exceptions include:

• School officials with a legitimate educational interest — including contractors and other outside parties the school uses to perform functions it would otherwise use employees for
• Other schools to which a student is transferring or seeking to enroll
• Specified officials for audit, evaluation, or enforcement of federally supported education programs
• Financial aid determinations
• Accrediting organizations carrying out their functions
• Judicial orders or lawfully issued subpoenas — but the school generally must make a reasonable effort to notify the parent or eligible student before complying, so they have a chance to seek protective action (34 CFR § 99.31(a)(9))
• Health or safety emergencies, narrowly construed
• Directory information the school has designated as such (see below)

Outside those listed exceptions, disclosing PII from an education record without consent is a FERPA violation — which is exactly the situation redaction is meant to prevent: a record can go out to satisfy a subpoena, a public-records request, or a research study while the identifying details of students who are not party to that disclosure stay in.

Directory information: the opt-out category

Schools may designate certain categories as "directory information" and disclose them without consent, provided the school has given public notice of the categories and a reasonable opportunity for parents or eligible students to opt out (34 CFR § 99.37). Directory information typically covers items like name, address, telephone listing, email address, photograph, date and place of birth, major field of study, dates of attendance, degrees and awards received, and the most recent school attended.

Two things trip schools up here. First, directory status is opt-out, not opt-in — a student who never files the opt-out is treated as having allowed disclosure of that category. Second, anything a school has not affirmatively designated as directory information, or that a specific student has opted out of, reverts to the default consent rule. A release that assumes "it's just a name and photo, that's always fine" can still violate FERPA if the school never made that designation or the student opted out.

Disciplinary records and public-records requests

A recurring flashpoint is what happens when a student disciplinary record is requested under a state public-records law — for example, by a campus newspaper. In United States v. Miami University, 294 F.3d 797 (6th Cir. 2002), the Sixth Circuit Court of Appeals held that student disciplinary records maintained by a university are "education records" under FERPA, meaning the university could not release them with student-identifying information intact in response to an Ohio public-records request. The practical effect: the records could still be disclosed, but only after redacting the information that would identify the students involved.

The same logic applies to campus police records tied to a specific student, special-education files subpoenaed in litigation, and research datasets built from student records. In each case the record can move; the PII inside it generally cannot, unless one of the § 99.31 exceptions or a directory-information designation applies.

How FERPA is actually enforced

FERPA is not enforced through student lawsuits. In Gonzaga University v. Doe, 536 U.S. 273 (2002), the U.S. Supreme Court held that FERPA's confidentiality provisions do not create individual rights enforceable through a private lawsuit under 42 U.S.C. § 1983. The remedy Congress built into the statute is administrative: a parent or eligible student can file a complaint with the Department of Education's Student Privacy Policy Office, which investigates and can require corrective action.

FERPA's formal maximum sanction is severe on paper — the Department can terminate a school's or institution's eligibility for federal education funding — but in practice SPPO has historically resolved violations through required corrective-action plans rather than the funding cutoff. That asymmetry (real regulatory exposure, no student lawsuit) is exactly why institutions build redaction into the release process itself rather than treating it as optional risk management: the fastest way to avoid an SPPO complaint is to never send unredacted PII out the door.

A practical FERPA redaction workflow

A defensible workflow for releasing a student record — to a records requester, opposing counsel, a researcher, or an accreditor — looks like this, and none of it requires uploading the record anywhere:

1. Confirm the disclosure basis first. Written consent, a § 99.31 exception, or a directory-information designation — know which one applies before you decide what stays visible.
2. Work from FERPA's PII definition, not just "names and SSNs." Include indirect identifiers (dates, addresses) and anything a reasonable person in the school community could use to identify the student.
3. Check every page, not just the obvious fields. Headers, footers, case numbers tied to a specific student, and handwritten margin notes carry PII as often as the body text does.
4. Redact with a method that deletes data, not one that covers it. A drawn rectangle in a PDF sits on top of an intact text layer that can often still be selected and copied — the same failure mode documented across many public redaction failures.
5. Strip metadata on export. Author names, prior revisions, and file titles can carry a student's name even after the visible page is clean.
6. Verify before you send. Open the exported file, select all, copy, and search for the student's name and ID number. If either shows up, the redaction did not work.

You can run this entire workflow in SladdPDF, a free browser-based redaction tool. It processes files locally with JavaScript and WebAssembly — a student record never leaves your device, and the tool works offline once loaded. Secure mode rasterizes each page on export, destroying the underlying text layer, and metadata can be stripped in the same pass. The free version redacts documents with no page limit; a Pro license unlocks high-resolution 300 DPI export.

This article is general guidance, not legal advice. FERPA determinations — especially which § 99.31 exception applies — often depend on institution-specific facts and should be checked with counsel or a registrar's office.