Log and audit third-party data disclosures made under FERPA's school official / legitimate educational interest exception

Steps

1. Before disclosing, confirm the recipient meets the institution's published criteria for a "school official" with "legitimate educational interest," as required to be specified in the annual FERPA notification under 34 CFR 99.7(a)(3)(iii).
2. For a vendor/contractor (not an employee), apply the four-part outsourcing test in 34 CFR 99.31(a)(1)(i)(B): the party performs an institutional service/function the institution would otherwise use employees for; is under the institution's direct control over use and maintenance of the records; is subject to the use-limitation in 99.33(a); and meets the institution's published school-official criteria.
3. Note that 34 CFR 99.32(d) exempts most school-official disclosures (including qualifying outsourced parties) from FERPA's own 99.32 recordkeeping mandate — build an internal audit log voluntarily rather than relying on a federal logging obligation for these disclosures.
4. For each internal audit log entry, capture the recipient, the specific legitimate-educational-interest determination, the data elements disclosed, the date, and the governing contract/DPA reference so direct control can be demonstrated if challenged.
5. For any disclosure category NOT exempted under 99.32(d) (e.g., to state/local educational authorities or federal officials listed in 99.31(a)(3) who may redisclose further), maintain the formal 99.32 record of requesting/receiving parties and their stated legitimate interest, retained with the student's education record for as long as that record is kept.