Toolkit · Education

The Student Records Access and Privacy Toolkit

20 U.S.C. § 1232

Type
Toolkit
Jurisdiction
National
Date
2026-02-25
Topic
Education

This toolkit supplies the letters and institutional documents that student records practice actually requires. For families it provides a records request that names the categories schools otherwise omit, an amendment request framed to the correct standard, a hearing request stating the procedural entitlements, and the statement in the record — the one right an institution cannot refuse. For institutions it provides an annual notification template with the school official definition that makes the most-used exception lawful, a disclosure log, a subpoena and emergency protocol, an education technology contract rider, and a training outline for the roles that generate violations. Each tool names the failure it prevents.

The Student Records Access and Privacy Toolkit

Education > Student Records and Privacy | Published 25 February 2026 - Updated 20 August 2026 | UpLaw - uplaw.us

How to Use This

Families need Tools 1 through 5, in order, and rarely need anything else. Institutions need Tools 6 through 12, and the one that prevents the most complaints is Tool 6 — the annual notification, specifically its definition of "school official."

Framework throughout: 20 U.S.C. § 1232g and 34 C.F.R. part 99, with survey rights at 20 U.S.C. § 1232h and 34 C.F.R. part 98, and special education access at 20 U.S.C. § 1415 and 34 C.F.R. part 300.

Tool 1 — Records Request

[Date] · [Records Officer / Principal], [School] Re: Request to inspect and review education records — [Student], DOB [ ], Grade [ ]

I am the parent of [Student]. Pursuant to 20 U.S.C. § 1232g and 34 C.F.R. part 99, I request to inspect and review my child's complete education records, including:

  1. Cumulative folder and permanent record.
  2. Attendance records, including coding and any corrections.
  3. Grades, transcripts, and course history.
  4. Assessment and standardized test results, including raw scores.
  5. Health and immunization records maintained by the school.
  6. Discipline records, referrals, incident reports, and investigation materials.
  7. Evaluations, eligibility determinations, service plans, and progress monitoring data.
  8. Correspondence maintained by the school concerning my child, including email.
  9. Records maintained on the school's behalf by any contractor or service provider.
  10. The record of requests for and disclosures of personally identifiable information from my child's records, including the parties and their stated legitimate interests.

[If applicable:] Because my child receives special education services, I request these records before the meeting scheduled for [date], as 20 U.S.C. § 1415 and 34 C.F.R. part 300 require.

I request copies and understand a reasonable copying fee may apply, and that no search or retrieval fee may be charged. Please confirm receipt and the date the records will be available; I understand the period may not exceed forty-five days from this request.

If any record is withheld, please identify it and state the basis.

Failure it prevents. A request for "the file" that produces a cumulative folder and nothing else. Item 10 is the one families forget and the one that reveals who has been looking.

Tool 2 — Amendment Request

Re: Request to amend education records — [Student]

Pursuant to 20 U.S.C. § 1232g and 34 C.F.R. part 99, I request amendment of the following records on the ground that they are inaccurate and misleading.

# Record (document, date, page) The record states This is inaccurate because Supporting documentation Requested amendment
1
2

Please advise of your decision within a reasonable time. If the District declines to amend, I request that you inform me of my right to a hearing, as the regulations require.

Drafting rules. Quote the record. State a checkable fact. Attach the document that proves it. Propose the corrected text.

⚠️ Do not argue about the outcome. Amendment reaches inaccuracy, not the fairness of a grade or a disciplinary decision; those run through the appeal process, with constitutional due process governed by Goss v. Lopez, 419 U.S. 565. A request framed as disagreement is a request that gets denied.

Tool 3 — Hearing Request

Re: Request for a hearing following refusal to amend — [Student]

The District declined my amendment request by letter dated [date]. I request a hearing under 34 C.F.R. part 99.

Please provide advance notice of the date, time, and place. I understand that:

  • the hearing officer may be an official of the District but must not have a direct interest in the outcome;
  • I will have a full and fair opportunity to present relevant evidence;
  • I may be assisted by individuals of my choice, including an attorney, at my own expense; and
  • the decision will be in writing, based solely on the evidence, and will include a summary of the evidence and the reasons.

I intend to present: [numbered list of documents and witnesses].

Please confirm whether I may make an audio recording of the proceeding.

Failure it prevents. A meeting with the person who made the original decision, called a hearing, producing an oral denial.

Tool 4 — Statement in the Record

⭐ The right that cannot be refused.

Re: Statement placed in the education record of [Student] pursuant to 34 C.F.R. part 99

Following the hearing held [date], the District declined to amend the record identified below. I request that this statement be maintained with the contested portion of the record for as long as that record is maintained, and disclosed whenever that portion is disclosed.

Contested record: [document, date, page].

Statement: [Two to five sentences. Factual, specific, dated, calm. Attach documentation.]

Model: "The referral dated 14 March states that [Student] was absent without excuse. Attached is the medical appointment confirmation and the school's own pre-approval email dated 9 March. The absence was excused in advance and the record has not been corrected."

Please confirm in writing that this statement has been placed with the contested portion.

Why it works. It is permanent, it travels with the record, and it must go out to every recipient the contested portion goes to. It is the strongest tool a family has and the least used.

Tool 5 — Directory Information Opt-Out

Re: Directory information — [Student], DOB [ ]

☐ I direct that no directory information be disclosed without my prior written consent, including name, address, telephone listing, email address, photograph, date and place of birth, grade level, enrollment status, participation in activities and sports, height and weight of athletic team members, dates of attendance, degrees, and honors or awards. This includes publication on the District's website and social media accounts, in printed programs and yearbooks, and any release to outside requesters.

☐ I direct that the following categories not be disclosed [list], and consent to disclosure of the remainder.

☐ [Secondary students] I separately direct that my child's name, address, and telephone listing not be released to military recruiters or institutions of higher education.

Please confirm receipt, describe how this election is recorded, and describe how it is communicated to teachers, coaches, athletic staff, and communications personnel.

Why the last sentence matters. Opt-outs fail operationally, not legally. The most common violation in this entire field is a photograph posted by someone who never saw the list.

Tool 6 — Annual Notification Template (Institutions)

ANNUAL NOTIFICATION OF RIGHTS UNDER 20 U.S.C. § 1232g

1. The right to inspect and review the student's education records within 45 days of the day the [School] receives a request. Parents or eligible students should submit a written request to [office, address, email] identifying the records they wish to inspect. [School] will notify them of the time and place where the records may be inspected.

2. The right to request amendment of records the parent or eligible student believes are inaccurate, misleading, or in violation of privacy rights. The request should be in writing, identify the part to be changed, and specify why it should be changed. If [School] decides not to amend, it will notify the parent or eligible student of the decision and of their right to a hearing.

3. The right to provide written consent before [School] discloses personally identifiable information, except to the extent disclosure without consent is authorized.

One exception permits disclosure without consent to school officials with legitimate educational interests. A school official is a person employed by [School] in an administrative, supervisory, academic, research, or support staff position; a person serving on the board; a person or company with whom [School] has contracted to perform a special task, such as an attorney, auditor, medical consultant, therapist, or technology service provider; and a parent or student serving on an official committee or assisting another school official. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill professional responsibility.

[School] discloses education records without consent to officials of another school in which a student seeks or intends to enroll.

4. The right to file a complaint concerning alleged failures to comply, with [enforcement office address].

5. Directory information. [School] designates the following as directory information: [list]. To opt out, submit written notice to [office] by [date]. [State whether granular opt-outs are available and what a blanket opt-out means in practice.]

6. Transfer of rights. These rights transfer to the student at age 18 or upon enrollment at a postsecondary institution.

⭐ The bolded paragraph is the one that matters. An institution that has not defined "school official" and "legitimate educational interest" cannot lawfully rely on the exception it uses hundreds of times a day — including for every technology vendor.

Tool 7 — Disclosure Log

Maintained with the education records and inspectable by the parent or eligible student.

# Date Student Records disclosed Party receiving Legitimate interest / exception relied on Redisclosure permitted? Staff member

Log every disclosure except: to the parent or eligible student; to school officials; directory information; consented disclosures; and certain subpoenas ordering nondisclosure.

Log in particular: other schools, audit and evaluation officials, financial aid, studies organizations, accreditors, judicial orders and subpoenas, health and safety emergencies, and juvenile justice disclosures.

Failure it prevents. A parent asks who has seen the file and the institution cannot answer — which is itself a violation and reads badly in every complaint that follows.

Tool 8 — Subpoena and Court Order Protocol

  • [ ] Route every subpoena and government request to one named person. Front office staff do not respond.
  • [ ] Identify the type. Judicial order; civil subpoena; grand jury subpoena; law enforcement subpoena; administrative demand.
  • [ ] Determine the notice obligation. Make a reasonable effort to notify the parent or eligible student in advance so the order may be challenged — except for a federal grand jury subpoena or certain law enforcement subpoenas ordering nondisclosure, and except where the parent is a party to a child abuse and neglect proceeding meeting the statutory conditions.
  • [ ] Document the notice or the basis for not giving it.
  • [ ] Produce only what is called for.
  • [ ] Redact other students' information.
  • [ ] Record the disclosure in the log.
  • [ ] Do not volunteer records outside the scope.
  • [ ] Escalate to counsel where the demand is broad, where nondisclosure is ordered, or where the student is the subject of a criminal investigation.

Tool 9 — Emergency Disclosure Record

Complete contemporaneously. The health or safety exception requires it.

Date and time: [ ] · Student: [ ] · Staff member: [ ]

1. The articulable and significant threat to the health or safety of the student or others: [specific facts known at the time].

2. Basis for believing the threat existed: [source and content of the information].

3. Parties to whom information was disclosed: [each recipient].

4. Why each recipient's knowledge was necessary to protect health or safety: [per recipient].

5. Information disclosed: [specific, not "the file"].

6. Duration: the emergency is understood to have ended on [date/time].

7. Logged in the disclosure record: ☐ yes

⚠️ The exception covers the emergency, not the aftermath. Disclosures made after the threat has passed, or broader than protection requires, fall outside it.

Tool 10 — Education Technology Contract Rider

STUDENT DATA PROTECTION ADDENDUM

1. School official designation. Provider performs an institutional service or function for which [District] would otherwise use employees, is under the direct control of [District] with respect to the use and maintenance of education records, and is subject to the requirements of 20 U.S.C. § 1232g and 34 C.F.R. part 99 governing use and redisclosure. [District] designates Provider as a school official with a legitimate educational interest in its annual notification.

2. Ownership. All student data remains the property of [District]. Provider acquires no rights in it.

3. Permitted use. Provider shall use student data solely to provide the contracted service. Provider shall not use it for advertising, shall not create profiles for non-educational purposes, shall not use it to improve products beyond the contracted service, and shall not sell, rent, or trade it.

4. Redisclosure. Provider shall not disclose student data except to subprocessors listed in Exhibit A, bound by equivalent obligations, or as required by law with prompt notice to [District] unless prohibited.

5. Security. Provider shall maintain a written information security program aligned to [framework], including access controls, multifactor authentication for administrative access, encryption in transit and at rest, and logging with retention of not less than [N] days.

6. Incident notification. Provider shall notify [District] in writing within [24/48/72] hours of confirming any security incident affecting student data, cooperate fully in the investigation, preserve evidence, and shall not notify students, parents, or the public without [District]'s prior written consent except as required by law.

7. Deletion. On termination or on [District]'s request, Provider shall delete or return all student data within [N] days and certify deletion in writing.

8. Access. Provider shall assist [District] in responding to requests to inspect, review, and amend records within timeframes permitting [District] to meet its forty-five day obligation.

9. Audit. [District] may audit compliance annually on [N] days' notice, and promptly following an incident.

10. State law. Provider shall comply with all applicable state student privacy statutes, which may impose obligations exceeding those above.

11. No unilateral changes. Provider shall not modify these terms or its privacy policy as applied to student data without [District]'s prior written consent.

12. Survival and indemnity. Sections 2–7 survive termination. Provider indemnifies [District] against costs arising from Provider's breach, excluded from any limitation of liability.

Failure it prevents. A free classroom tool whose standard terms permit product-improvement use of student work — which defeats the school official exception and violates many state statutes outright.

Tool 11 — Staff Training Outline

Fifteen minutes, annually, with sign-in sheets. Aimed at the roles that actually generate violations.

Front office.

  • Never release information about a student over the phone, to anyone, including someone who says they are a parent.
  • Route every subpoena, court order, police request, and government inquiry to [name].
  • Records requests go to [name] the same day, logged.

Teachers.

  • Notes shared with anyone stop being sole possession records.
  • Do not post student names or photographs anywhere without checking the opt-out list.
  • Do not sign a class up for an application that is not on the approved list.
  • Grades and discipline are not discussed with other parents, ever.

Coaches and activity sponsors.

  • Rosters with medical or eligibility detail are education records.
  • Team social media accounts are subject to the opt-out list.
  • Injury information is not shared with other families.

Counselors and administrators.

  • The health or safety exception is narrow and requires contemporaneous documentation (Tool 9).
  • Amendment requests trigger a decision and, if refused, an explicit offer of a hearing.
  • Every non-exempt disclosure is logged.

Communications staff.

  • Check the opt-out list before every publication, post, and press release.
  • Yearbook, programs, and website are all disclosures.

Tool 12 — Administrative Complaint Outline

1. Complainant and relationship to the student. 2. Institution and the responsible official.

3. The right at issue: ☐ access ☐ amendment ☐ disclosure ☐ annual notification.

4. Chronology. Dated: the request; the institution's responses; each communication. Attach every letter.

5. What the institution did or failed to do, specifically.

6. Why it violates the statute or regulations, citing 20 U.S.C. § 1232g and 34 C.F.R. part 99, or the survey provisions at 20 U.S.C. § 1232h and 34 C.F.R. part 98.

7. Timeliness. Filed within 180 days of the violation or of when the complainant knew or should have known, or a statement of good cause for an extension.

8. Relief requested: production, correction, filing of a statement, corrective policy action.

Understand the limits. There is no private right of action — Gonzaga University v. Doe, 536 U.S. 273 held the nondisclosure provisions are not enforceable by an individual under 42 U.S.C. § 1983. Consider parallel state remedies, which increasingly provide enforceable rights against both institutions and vendors.

Tool 13 — Quick Reference

Do Never
Request in writing, dated Ask orally and lose the clock
List record categories explicitly Ask for "the file"
Request the disclosure log Assume nobody tracks access
Cite 20 U.S.C. § 1415 for pre-meeting access Wait forty-five days for an IEP meeting next week
Frame amendment around checkable facts Argue the outcome was unfair
Request the hearing when amendment is refused Accept an oral denial
File the statement in the record Skip the one right that cannot be refused
Decide directory information deliberately Discard the annual notice
Sign a release before college Assume dependency gives access
Check state law Assume the federal statute is the whole story

Related Documents