Few sectors have adopted technology as quickly as education. A single district may run learning management systems, student information systems, assessment platforms, communication apps, tutoring tools, and an expanding roster of AI-assisted products — many of them adopted by individual teachers or departments without a central review. Each of those tools touches student data, and each one represents a point where the institution’s compliance obligations quietly extend beyond its own walls.

That expansion is where many schools and colleges are exposed. The Family Educational Rights and Privacy Act (FERPA) was written in 1974, long before cloud platforms, mobile apps, or machine learning existed. Yet it remains the federal standard governing how student education records are protected and shared — and under its structure, the legal responsibility for that data does not transfer to the vendor holding it. It stays with the school.

What FERPA Actually Governs

FERPA is administered and enforced by the U.S. Department of Education’s Student Privacy Policy Office, which investigates complaints, develops guidance, and provides technical assistance to the education community. The law protects “education records” — broadly defined as records directly related to a student and maintained by an educational agency or institution. That includes far more than grades and transcripts: it can extend to disciplinary records, special-education documentation, identifying information, and the data captured by the digital tools students use every day.

FERPA applies to schools, districts, and postsecondary institutions that receive funding under programs administered by the Department of Education. In practice, that covers virtually all public K-12 systems and most colleges and universities, including private institutions whose students receive federal financial aid. As a general rule, the institution must have written consent before disclosing personally identifiable information from education records — subject to a set of specific exceptions that have become central to how technology is adopted in schools.

The “School Official” Exception — and the Liability It Creates

The exception that matters most in a technology context is the “school official” provision. It allows an institution to share education records, without separate consent, with outside parties that perform a service the school would otherwise handle itself — provided those parties are under the institution’s direct control regarding the use and maintenance of the data, and have a legitimate educational interest.

This is the mechanism that makes modern EdTech possible. When a district adopts a cloud gradebook or a university licenses an analytics platform, the vendor is typically designated a “school official” so that student data can flow to it lawfully. The arrangement is routine, and for the most part it works as intended.

The complication is where accountability sits. Designating a vendor as a school official does not move the compliance obligation to that vendor. If student data is mishandled, exposed, or used outside the agreed purpose, it is the institution — not the software company — that answers for it. FERPA’s ultimate enforcement mechanism is the potential withdrawal of federal funding, and there is no private right of action for families to sue under the statute. But the practical consequences reach well beyond that: federal complaints and investigations, mandated corrective action, reputational damage, breach-notification obligations under state law, and a loss of trust among the families and students the institution serves.

In other words, schools carry the risk for data they no longer physically hold. That asymmetry is the heart of the EdTech compliance problem.

Why the Exposure Is Growing

Three trends have widened this gap considerably in recent years.

Tool sprawl. The number of digital products in use across a typical district has climbed into the hundreds, and by some industry estimates well over a thousand distinct tools are accessed across a district in a given month. Many enter through individual classrooms rather than a procurement process, which means a meaningful share of the data-sharing happening in a school has never been reviewed against FERPA at all.

Vendor breaches as routine events. Concentrating student data in a handful of large platforms creates concentrated risk. The May 2026 incident involving the Canvas learning management system — which took the platform offline during final-exam periods at many institutions — underscored how a single vendor compromise can disrupt operations system-wide and put records belonging to millions of students in question. The Department of Education subsequently sought information from the platform’s parent company regarding its FERPA obligations. For most institutions, the prudent assumption now is that an EdTech vendor breach is an operational risk to plan for, not a remote possibility.

Artificial intelligence. AI-assisted tools that analyze student behavior, generate feedback, or personalize instruction introduce new questions about what data is collected, where it is processed, whether it is used to train models, and how long it is retained. These are precisely the questions FERPA’s “legitimate educational interest” and purpose-limitation principles are meant to address — but only if someone is asking them before a tool is adopted.

A Tightening State-Law Layer

FERPA is the federal baseline, not the ceiling. Over the past decade, states have introduced hundreds of bills addressing student data privacy, and many now impose obligations that go beyond federal requirements — mandatory contract terms with vendors, prohibitions on using student data for advertising, deletion rights, and breach-notification timelines. Long-standing examples include California’s student-data provisions and New York’s Education Law 2-d, and additional comprehensive state privacy laws have continued to take effect into 2026.

For institutions operating across state lines, or serving students who reside in multiple states, this patchwork means a vendor arrangement that satisfies FERPA may still fall short of a specific state’s requirements. Compliance is no longer a single checklist; it is a layered set of obligations that has to be mapped to the jurisdictions an institution actually touches.

What Sound Governance Looks Like

The encouraging reality is that the controls reducing FERPA exposure are the same disciplined IT practices that protect any organization handling sensitive data. They do not require a large team — they require consistency and ownership.

Maintain a real inventory of tools and data flows

An institution cannot govern what it cannot see. A current record of every platform that touches student data — what it collects, where it stores it, and which staff approved it — converts invisible classroom adoptions into a manageable list. This is the single most important step, and the one most often skipped.

Put the agreement in writing before data moves

The “school official” exception depends on the institution retaining direct control over how data is used. That control has to be documented. Agreements should specify the purpose of the data sharing, prohibit secondary uses such as advertising or model training, define breach-notification timelines, and address how data is returned or destroyed when the relationship ends.

Enforce access controls and monitoring

Most student-data incidents trace back to compromised credentials or excessive access rather than exotic attacks. Role-based permissions, multi-factor authentication, and continuous monitoring limit both the likelihood and the blast radius of an exposure. These are core elements of a managed Security+ program and apply directly to the systems where education records live.

Plan for the vendor breach you don’t control

Because so much student data now sits with third parties, an institution’s resilience depends on how quickly it can respond when a vendor is compromised. A tested incident-response process, a current vendor-risk file, and reliable backup and recovery capabilities determine whether a Canvas-style event becomes a contained disruption or a prolonged crisis.

Treat compliance as a continuous program

FERPA obligations are not satisfied by a signed form at the start of a school year. New tools are adopted continuously, vendor practices change, and state requirements evolve. A standing review cycle — supported where appropriate by outside compliance consulting — keeps the institution’s posture aligned with both its tool inventory and the current legal landscape.

Final Thought: The Responsibility Doesn’t Outsource

EdTech has become inseparable from how schools and colleges operate, and the “school official” exception is what allows that ecosystem to function within the law. But the exception governs how data may be shared — not who is accountable for it. That responsibility remains with the institution, regardless of which vendor’s servers the records happen to sit on.

For administrators and IT leaders, the practical takeaway is straightforward. Know which tools touch student data, document the terms under which they hold it, control access to the systems that matter, and prepare for the breach that originates somewhere outside the institution’s own network. In an environment where student records are spread across hundreds of platforms and a single vendor incident can affect millions, that visibility is not a regulatory formality. It is the foundation of protecting the students an institution is entrusted to serve.

By Thomas McDonald