FERPA & Student Data: IT Compliance for Schools

What does FERPA require from a school's IT setup?

FERPA requires schools to protect the privacy of student education records and control who can access them. In practice that means encrypted storage and transfer, role-based access, audit logs, vetted vendor data agreements, and secure devices. FERPA names no specific technology, so the burden of building reasonable safeguards falls on your IT program.

Which laws govern student data privacy?

FERPA is the foundation, but it rarely stands alone. School IT decision-makers usually have to reconcile several overlapping rules at once:

• FERPA (Family Educational Rights and Privacy Act) protects the privacy of education records and gives parents and eligible students rights over them.
• COPPA (Children's Online Privacy Protection Act) governs how online services collect data from children under 13 — directly relevant when a school authorizes ed-tech tools on behalf of students.
• PPRA (Protection of Pupil Rights Amendment) covers surveys and the collection of certain sensitive information.
• State student privacy laws such as California's SOPIPA and dozens of similar statutes add contract and data-handling requirements on top of federal law.

A district doesn't need to memorize every clause, but the systems that store and move student data do need to satisfy all of them at once. That is a coordination problem best handled with structured compliance IT services rather than a patchwork of one-off fixes.

Why is FERPA compliance harder for schools than it looks?

The records themselves are scattered. Student data lives in the student information system, the gradebook, the special-education platform, email, shared drives, and every learning app a teacher signs up for. Each of those is a place data can leak. The most common weak points we see in K-12 environments are predictable:

• Teachers adopting free apps without a signed data agreement, so student data flows to a vendor the district never vetted.
• Shared or reused passwords and no multi-factor authentication on systems holding records.
• Former staff and graduated students who still have active accounts.
• Unencrypted student laptops and tablets that walk out the door and never come back.

None of these are exotic. They're the everyday reality of running technology for hundreds or thousands of users, most of whom are children. Getting ahead of them is far cheaper than a breach — the cost of prevention is a fraction of a single reportable incident and the parent notifications, investigations, and lost trust that follow.

How does an LMS like Canvas or Google Classroom fit in?

Your learning management system is where a lot of student data concentrates: assignments, grades, discussion posts, and identity data for every student. Platforms like Canvas and Google Classroom will sign data protection agreements and offer FERPA-aligned controls, but those controls only help if they're actually turned on and configured. That means enforcing single sign-on, limiting third-party integrations, reviewing which apps students can connect, and locking down sharing settings so records don't spill into public or personal accounts.

The LMS is also a good example of why IT support built for schools matters. A generalist provider may know the software; a provider that understands education knows which LMS settings map to which FERPA obligation, and how to document that mapping if a parent or auditor ever asks.

How do 1:1 devices and MDM protect student data?

Once a district hands every student a Chromebook, laptop, or tablet, each device becomes a potential exit point for student data. Mobile device management (MDM) is the control layer that keeps that fleet safe. Good device management lets you enforce full-disk encryption, push security updates, restrict which apps can be installed, filter content, and — critically — remotely lock or wipe a device that's lost or stolen. Without MDM, a single misplaced laptop can turn into a reportable disclosure. With it, that same laptop is an encrypted brick to anyone but its owner.

Managing hundreds or thousands of devices this way is not a part-time job. It's a core reason many districts lean on a managed provider for both the day-to-day IT management and the security tooling that keeps the fleet compliant.

Why do vendor data agreements matter so much?

Under FERPA's "school official" exception, a district can share student data with a vendor only when that vendor is under the school's direct control and uses the data only for the authorized purpose. The document that establishes that control is the data privacy agreement (DPA). Every ed-tech tool that touches student data should have one, and it should spell out how data is used, how it's secured, how long it's kept, and what happens when the contract ends.

This is where COPPA and FERPA intersect: when a school consents to a service on behalf of students under 13, the school is effectively standing in for parents, so the DPA has to hold the vendor to real standards. A strong compliance program keeps a living inventory of every vendor, every DPA, and every data flow — so nobody has to guess who has access to what. Building and maintaining that inventory is one of the clearest wins from professional compliance-focused IT support.

What should a district do first?

Start with visibility. You can't protect data you can't see. A practical first pass looks like this:

• Inventory every system and app that holds student data, and confirm each has a signed data agreement.
• Turn on multi-factor authentication and single sign-on across core systems and the LMS.
• Enroll every 1:1 device in MDM with encryption and remote wipe enabled.
• Set a routine for deprovisioning accounts when staff leave or students graduate.
• Keep audit logs so you can prove who accessed records and when.

Districts that also handle sensitive operational or financial data — payroll, health records for staff, grant reporting — should treat this as part of a broader security posture. The same discipline that protects student records is closely related to the ransomware defenses covered in our guide on how school districts can survive a ransomware attack.

Frequently asked questions

Is FERPA compliance a one-time project?

No. Student data, staff, vendors, and devices change constantly, so compliance is an ongoing program of access reviews, vendor checks, and device management — not a box you check once and forget.

Do we need a specialized IT provider, or will any MSP do?

Any competent provider can secure systems, but education has its own regulations and vendor-agreement norms. A provider experienced with schools will already understand FERPA, COPPA, and the LMS and MDM tools you rely on, which shortens the path to compliance.

What happens if a student device is lost?

With encryption and MDM in place, you remotely lock or wipe the device and the data stays protected. Without those controls, a lost device can become a reportable data disclosure under FERPA.

Ready to lock down student data the right way? Compare vetted providers — free.