FERPA: Do's and Don'ts

A quick reference for faculty and staff on protecting student privacy.

Do's

Use university email or the LMS

Keep student communication off personal email and text. Canvas is fine. 

BCC group emails

So students can't see each other's addresses.

Keep personal notes to yourself

Notes you never share stay private. Anything you share with others becomes part of the record. Example: jotting “seemed distracted in class today” in your own private notebook is fine — sharing that same note with a colleague makes it part of the student's record.

Verify who you're talking to

Confirm identity before sharing anything by phone, or send the caller to the Registrar.

Send outside requests to the Registrar

Subpoenas or police requests should go to the Registrar or legal counsel — not you.

Shred what you no longer need

Hold onto student records only as long as they're needed for teaching or advising, then dispose of them properly. Don't toss rosters or papers with student names or ID numbers in the trash.

Don't post grades publicly

Never post grades where they're linked to a name or ID.

Don't tell parents grades without written consent

This is true even if a parent is upset or pays the bill.

Don't leave records or screens exposed

Lock your computer when you step away.

Don't use ID-based lists for attendance

Use a blank sign-in sheet instead.

Don't put ID numbers in email subject lines

Keep identifying numbers out of subject lines — they're often visible in previews and notifications.

Don't forward emails without checking them first

Old replies in the thread might contain grades or private details.

Don't write judgmental comments in student files

Students can request to see these notes — keep them factual. Example: Canvas internal comments.

Don't share with colleagues without a need to know

Only share a student's information with other staff if it's genuinely part of their job.

Don't use student data for research without approval

Get approval from the Institutional Review Board (IRB) first. SRJC appoints the President.