FERPA Compliance Guide for School IT Administrators

Your teachers are merging PDFs. Your registrar is compressing transcripts. Your special ed coordinator is converting IEPs to PDF. Are they using tools that upload student records to third-party servers? If so, your district may have a FERPA problem.

What FERPA Protects

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. It applies to all schools that receive federal funding — which is virtually every public K-12 school and most colleges and universities.

Education records include any record directly related to a student that is maintained by the school. This covers:

• Transcripts and grade reports
• IEPs (Individualized Education Programs) and 504 plans
• Disciplinary records
• Attendance records
• Financial aid applications
• Student ID numbers, names, addresses, photos
• Psychological evaluations and counseling notes

How PDF Tools Can Violate FERPA

FERPA prohibits the disclosure of PII from education records without written consent from the parent (or eligible student). When a staff member uploads a PDF containing student PII to an online tool like iLovePDF or SmallPDF, that constitutes a disclosure to a third party.

The "School Official" Exception — and Its Limits

FERPA allows disclosure to "school officials" with "legitimate educational interests." Some districts try to extend this to third-party tools by adding them as designated school officials in their annual FERPA notice.

But this requires:

1. A written agreement with the vendor defining their role as a school official
2. The vendor being under the direct control of the school regarding use of records
3. Confirmation the vendor won't re-disclose the data
4. Annual notification to parents about the arrangement

For a free online PDF tool that your staff found on Google? Good luck satisfying those requirements.

The Simpler Solution: Don't Upload

The cleanest way to avoid FERPA issues with document tools is to use tools that never upload files. If student records never leave the school's device, there's no disclosure.

Checklist for School IT Teams

Before approving any document tool for staff use, verify:

• ☐ Does the tool upload files to a server? (If yes, you need a DPA)
• ☐ Does the tool require user accounts? (If yes, that's PII collection)
• ☐ Does the tool store files after processing? (If yes, for how long?)
• ☐ Can you verify the tool's claims via browser DevTools?
• ☐ Is the tool accessible to students with disabilities (508/WCAG)?
• ☐ Does it work on school Chromebooks and iPads?
• ☐ Does it work offline (for schools with limited connectivity)?

Common Workflows in Schools