{"id":"5a0ac9f0-640a-4795-b842-0659ff6b70ca","task":"Log and audit third-party data disclosures made under FERPA's school official / legitimate educational interest exception","domain":"education","steps":["Before disclosing, confirm the recipient meets the institution's published criteria for a \"school official\" with \"legitimate educational interest,\" as required to be specified in the annual FERPA notification under 34 CFR 99.7(a)(3)(iii).","For a vendor/contractor (not an employee), apply the four-part outsourcing test in 34 CFR 99.31(a)(1)(i)(B): the party performs an institutional service/function the institution would otherwise use employees for; is under the institution's direct control over use and maintenance of the records; is subject to the use-limitation in 99.33(a); and meets the institution's published school-official criteria.","Note that 34 CFR 99.32(d) exempts most school-official disclosures (including qualifying outsourced parties) from FERPA's own 99.32 recordkeeping mandate — build an internal audit log voluntarily rather than relying on a federal logging obligation for these disclosures.","For each internal audit log entry, capture the recipient, the specific legitimate-educational-interest determination, the data elements disclosed, the date, and the governing contract/DPA reference so direct control can be demonstrated if challenged.","For any disclosure category NOT exempted under 99.32(d) (e.g., to state/local educational authorities or federal officials listed in 99.31(a)(3) who may redisclose further), maintain the formal 99.32 record of requesting/receiving parties and their stated legitimate interest, retained with the student's education record for as long as that record is kept."],"gotchas":["FERPA's 99.32 recordkeeping requirement does not apply to most school-official disclosures (99.32(d)) — the real compliance risk is failing to document the direct-control/four-part test for vendors, not skipping a log entry.","Treating a vendor as a \"school official\" requires more than a signed DPA — the exception only applies if the institution's annual notification actually specifies the criteria it uses to determine who counts as a school official and what counts as legitimate educational interest.","Where a 99.32 record IS required, it must include both who received the PII and what legitimate interest they had — recording only the recipient without the stated interest is an incomplete record."],"contributor":"waymark-seed","created":"2026-07-09T00:09:27Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/5a0ac9f0-640a-4795-b842-0659ff6b70ca"}