FERPA Exceptions: 34 CFR 99.31 for Research

Under the Family Educational Rights and Privacy Act, FERPA generally prohibits the release of personally identifiable information from education records without prior written consent from the parent or eligible student. However, federal regulations under 34 CFR § 99.31 define specific FERPA exceptions that permit educational institutions to disclose education records without prior consent under defined conditions. For scholars pursuing education research, obtaining student data means working within these regulatory pathways or using de-identified data under 34 CFR § 99.31(b). The wider funding picture for the field is covered in our guide to education research funding.

While the broader statute is defined in our foundational guide on FERPA, this guide analyzes how institutional researchers, sponsored projects, and third-party analysts obtain and manage research data under 34 CFR § 99.31(a)(6) and related non-consensual disclosure mechanisms.

What FERPA Exceptions Are and Who Governs Them

The Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99) protects the privacy of student education records at educational agencies and institutions that receive funds under programs administered by the U.S. Department of Education. The U.S. Department of Education’s Student Privacy Policy Office (SPPO) publishes official guidance.

The baseline legal rule states that an educational agency or institution must obtain signed, dated written consent before disclosing personally identifiable information (PII) from education records. A FERPA exception is a narrowly drafted regulatory provision under 34 CFR § 99.31 that allows an institution to disclose PII without prior written consent, provided that strict administrative and technical criteria are satisfied. A FERPA exception does not compel a school to release records; rather, it gives the institution discretionary legal authority to disclose qualifying records without violating federal compliance mandates.

Who Can Access Education Records Without Consent

Under 34 CFR § 99.31(a), federal regulations enumerate 16 distinct exceptions to prior written consent. In university and school district settings, research initiatives typically intersect with four primary categories:

Studies Exception (34 CFR § 99.31(a)(6)): Permits disclosure to organizations conducting studies for, or on behalf of, educational agencies or institutions to develop predictive tests, administer student aid programs, or improve instruction.
Audit or Evaluation Exception (34 CFR § 99.31(a)(3)): Permits disclosure to authorized representatives of the Comptroller General of the United States, the U.S. Attorney General, the Secretary of Education, or state and local educational authorities to audit or evaluate federal- or state-supported education programs.
School Official Exception (34 CFR § 99.31(a)(1)): Permits disclosure to other school officials, including teachers, within the institution whom it has determined to have legitimate educational interests. A contractor or consultant to whom the institution has outsourced a function can qualify if it meets the conditions in the regulation, including being under the institution’s direct control for use and maintenance of the records.
Health and Safety Emergency Exception (34 CFR § 99.31(a)(10) and § 99.36): Permits disclosure to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health or safety of students or others.

What the Studies and Audit Exceptions Require

When external researchers request research data for a third party FERPA framework, the studies exception under 34 CFR § 99.31(a)(6) serves as the primary gateway. To invoke this exception lawfully, the proposed research must satisfy three regulatory conditions:

Strict Purpose Limitation: The study must be conducted exclusively to (A) develop, validate, or administer predictive tests; (B) administer student aid programs; or (C) improve instruction. A study outside these three purposes does not fit this exception.
Institutional Nexus (“For, or On Behalf Of”): The study must be conducted for, or on behalf of, the educational agency or institution. The regulation also states that the institution is not required to initiate a study or to agree with or endorse its conclusions.
Mandatory Written Agreement: The disclosing institution and the research entity must enter into a written agreement with the organization; the required terms are listed below.

Additionally, while student rights inspection waivers exist under 34 CFR § 99.12 (as examined in our guide to the FERPA waiver), waiver provisions apply to individual applicant inspection rights and do not substitute for institutional research data agreements.

Written Agreement Requirements for the Studies Exception

Under 34 CFR § 99.31(a)(6)(iii)(C), the written agreement between the institution and the external research organization must contain four elements:

Purpose, Scope, and Duration: The agreement must specify the precise purpose, scope, and duration of the study, as well as the exact data elements and PII to be released.
Use Restrictions: The agreement must require the organization to use PII from education records only to meet the purpose or purposes of the study as stated in the agreement.
Identity Protection Safeguards: The agreement must require the study to be conducted in a manner that does not permit personal identification of parents and students by anyone other than representatives of the organization with legitimate interests.
Mandatory Destruction and Schedule: The agreement must require the organization to destroy all PII when it is no longer needed for the purposes of the study and specify the time period in which it must be destroyed.

The regulations also attach a consequence to the destruction requirement. Under 34 CFR § 99.67(c), if the Department’s enforcement office finds that a third party outside the institution violated the destruction condition in § 99.31(a)(6)(iii)(B), the institution that supplied the information may not allow that party access to PII from education records for at least five years.

FERPA Exceptions Relevant to Educational Research

The following table compares the primary non-consensual disclosure pathways under 34 CFR § 99.31 relevant to academic research, sponsored projects, and higher education assessment:

Exception Name	Regulatory Citation	Permissible Scope / Purpose	Mandatory Safeguards & Requirements
Studies Exception	34 CFR § 99.31(a)(6)	Developing predictive tests, administering student aid, or improving instruction for or on behalf of the institution.	Written agreement with the four required elements; no personal identification by anyone other than the organization’s representatives with legitimate interests; PII destroyed when no longer needed.
Audit / Evaluation Exception	34 CFR § 99.31(a)(3)	Auditing or evaluating federal- or state-supported education programs by authorized educational authorities or their agents.	Written agreement designating any authorized representative who is not an employee; PII used only for the audit or evaluation, protected from further disclosure, and destroyed in line with § 99.35.
School Official Exception	34 CFR § 99.31(a)(1)	Disclosure to school officials, including teachers and qualifying outsourced parties, with legitimate educational interests.	Institution determines legitimate educational interests; an outsourced party must be under the institution’s direct control for use and maintenance of the records.
De-Identified Data Standard	34 CFR § 99.31(b)	Release of records after all personally identifiable information has been removed, including de-identified student-level data for education research (§ 99.31(b)(2)).	Reasonable determination that a student’s identity is not personally identifiable, whether through single or multiple releases, taking other reasonably available information into account.
Health and Safety Emergency	34 CFR § 99.31(a)(10) & § 99.36	Emergencies where knowledge of the information is necessary to protect the health or safety of the student or other individuals.	Institution may consider the totality of the circumstances; disclosure follows a determination of an articulable and significant threat (§ 99.36(c)).

How a Research Request Typically Moves Through an Institution

The regulation does not prescribe a calendar, but a studies-exception request generally involves these stages:

Scope alignment: The research team confirms that the study serves one of the three purposes in § 99.31(a)(6)(i): predictive tests, student aid programs, or improving instruction. Projects supported by entities such as the Spencer Foundation or federal agencies still need the institution to agree to the data request.
Written agreement: The institution and the organization enter into the written agreement containing the four § 99.31(a)(6)(iii)(C) elements.
Data use: The organization uses the PII only for the stated purpose and keeps personal identification limited to its representatives with legitimate interests.
Destruction: The organization destroys the PII when it is no longer needed for the purposes of the study, within the period the agreement specifies.

Common Mistakes in Research Exception Compliance

Research offices and investigators frequently encounter compliance pitfalls when relying on FERPA exceptions:

Treating IRB approval as FERPA clearance: IRB review is a separate regime under the Common Rule (45 CFR 46). Disclosure of education-record PII without consent still has to meet a condition in 34 CFR § 99.31, or the researcher needs consent that satisfies FERPA.
Treating the Exception as an Entitlement: FERPA exceptions are permissive, not mandatory. The regulation says an institution “may” disclose under these provisions, and § 99.31(a)(6)(iv) confirms it is not required to initiate a study, so an institution can decline a request even when a study would qualify.
Omitting Mandatory Agreement Terms: An agreement for the studies exception must specify the purpose, scope, duration and information to be disclosed, and the destruction period; leaving these out means the § 99.31(a)(6)(iii)(C) condition is not met.
Neglecting re-identification risk: De-identified release under 34 CFR § 99.31(b) requires a reasonable determination that a student’s identity is not personally identifiable, whether through single or multiple releases and taking other reasonably available information into account.
Confusing Internal Access with External Sharing: Access as a school official under § 99.31(a)(1) is for the institution’s own legitimate educational interests; sharing the PII with an external organization needs its own basis, such as the studies exception or consent. Redisclosure is limited by § 99.33.

Frequently Asked Questions About FERPA Exceptions in Research

Can educational institutions share research data for a third party under FERPA without consent?

Yes, but only if the disclosure satisfies a specific statutory exception under 34 CFR § 99.31. Most commonly, third-party disclosures occur under the studies exception (34 CFR § 99.31(a)(6)) or the audit/evaluation exception (34 CFR § 99.31(a)(3)), both of which involve written agreements limiting how the data is used and requiring its destruction.

What does FERPA prohibit regarding student records?

FERPA generally prohibits an institution from disclosing personally identifiable information from education records without consent from a parent or eligible student, unless one of the 16 conditions in 34 CFR § 99.31(a) applies.

Does the FERPA health and safety exception apply to public health research?

No. The health or safety emergency exception in 34 CFR § 99.36 applies to disclosures made in connection with an emergency, where knowledge of the information is necessary to protect the health or safety of the student or other individuals. It is not a research pathway; research disclosures run through the studies exception or de-identified data.

What is the penalty for improperly redisclosing FERPA research data?

Under 34 CFR § 99.67(c), if the Department’s enforcement office finds that a third party outside the institution violated the destruction requirement of the studies exception, the institution may not allow that party access to PII from education records for at least five years. Redisclosure limits themselves are in 34 CFR § 99.33.

Sources

All sources checked November 7, 2026.

34 CFR § 99.31, conditions under which prior consent is not required: https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.31
34 CFR § 99.33, limitations on redisclosure: https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.33
34 CFR § 99.35, disclosure for Federal or State program purposes: https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.35
34 CFR § 99.36, health and safety emergencies: https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.36
34 CFR § 99.67, enforcement (five-year rule): https://www.law.cornell.edu/cfr/text/34/99.67
U.S. Department of Education, Student Privacy Policy Office, FERPA FAQs: https://studentprivacy.ed.gov/frequently-asked-questions

FERPA Exceptions: 34 CFR 99.31 for Researchers