The glazed frontage of the WesternTechSystems facility

Compliance · FERPA

FERPA does not tell you how to wipe a student laptop

It is the regulation most often cited in district device procurement and the one with the least to say about it. Knowing precisely what FERPA does and does not require is what lets you answer the question a board or a state regulator is actually asking.

In one paragraph

The short version

FERPA contains no media sanitization requirement. Its destruction provisions are about education records and the written agreements governing third parties who receive them — not about drives, devices or methods.

That does not mean a district has no disposal obligation. It means the obligation comes from state student-privacy law, from your contracts, from board policy and from ordinary duty of care — and that answering a question about those with a FERPA citation will not survive scrutiny. The one FERPA provision that bites hardest in a summer refresh is §99.10(e), and it is a prohibition on destroying records, not a requirement to destroy them.

1 · The obligation

What the rule actually says

Cited to the eCFR text of 34 CFR Part 99. Quoted rather than paraphrased, because the paraphrases in circulation are where most of the confusion starts.

34 CFR 99.10(e) — records under an outstanding request

…shall not destroy any education records if there is an outstanding request to inspect and review the records under this section.

A prohibition on destruction, not a requirement to destroy. It is the single FERPA provision most likely to be breached by a device refresh: a laptop collected in July can carry the only copy of something a parent asked to inspect in June.

https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-B/section-99.10

34 CFR 99.31(a)(6)(iii)(C) — the studies exception

Requires the organization to destroy all personally identifiable information when the information is no longer needed for the purposes for which the study was conducted…

The destruction duty here belongs to the organization conducting the study, and it arrives through the written agreement you made with them. This is one of the two places FERPA genuinely requires destruction.

https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.31

34 CFR 99.35(a)(3)(iii) and 99.35(b)(2) — audit and evaluation

Require the authorized representative to destroy personally identifiable information from education records when the information is no longer needed for the purpose specified

The second place. Again the obligation reaches a third party through a written agreement, and again the timeframe is whatever that agreement specifies rather than anything FERPA fixes.

https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.35

2 · The misreading

What the rule does not say

This is the section most vendor pages omit, and it is the one that decides whether the rest of the page can be trusted.

FERPA contains no media sanitization requirement. None. No method, no standard, no verification, no particle size, no overwriting specification — the word does not appear in Part 99 in that sense.
FERPA does not require a certificate of destruction. Where destruction is required at all, it is required of a third party under a written agreement, and the evidence is whatever that agreement says it is.
There is no such thing as a FERPA-certified disposal vendor. The Department of Education certifies no one for this, and the obligation stays with the educational agency or institution regardless of who does the work.
FERPA imposes no general retention period. It does not tell you how long to keep education records. State law and your own records schedule do that.
Most of what districts call FERPA obligations on device disposal are actually state student-privacy law, contractual terms with an edtech vendor, or district policy. All three are real. None of them is FERPA, and conflating them makes it harder to answer the question that is actually being asked.

3 · The evidence

What an auditor actually asks for

Confirmation that no outstanding inspection request exists

Before a cohort is collected. §99.10(e) is a prohibition with no exception for convenience, and a summer refresh is exactly when it gets overlooked.

Your own records-retention schedule

Since FERPA does not supply one, the schedule an auditor tests against is yours, usually built on state law.

Destruction evidence under third-party agreements

Where PII went out under §99.31(a)(6) or §99.35, the agreement specifies destruction — and someone has to hold the evidence that it happened.

A defensible answer on devices that never came back

The hardest question in a district refresh is not how the returned laptops were sanitized. It is what happened to the ones that did not return.

Evidence that survives a state-law question too

Because the follow-up question is usually a state student-privacy statute, and the same records should answer both.

4 · Our part

What our documentation provides against it

Artefact	What it answers
Per-serial erasure certificate	Device-level evidence for every unit processed. FERPA does not demand it; your state law, your board and your insurer frequently do.
Cohort reconciliation report	Manifest against physical arrivals, which is how a district finds out how many units are genuinely missing rather than assumed missing.
Chain-of-custody record	Building to facility, timestamped, so a cohort collected across twenty sites is one record rather than twenty.
Legal-hold segregation	Devices flagged before collection are held in restricted storage and cannot be wiped or transferred until written release is logged — which is the operational answer to §99.10(e).
Method statement	What was applied to which media class, so the evidence answers a state-law question as readily as a board one.

5 · Your part

What remains your obligation

No vendor can discharge these for you. Any vendor implying otherwise is selling you a risk you will still be holding.

Confirming no outstanding inspection request exists before records-bearing devices are collected.
Knowing your state's student-privacy statute, which is almost certainly stricter and more specific than FERPA on this subject.
Holding the destruction evidence required by your agreements with research partners and authorized representatives.
Deciding what your retention schedule says, because FERPA does not say it for you.
Chasing the devices that did not come back. We can evidence everything that reaches us and nothing that does not.

FAQ

FERPA and device disposal questions

Does FERPA require us to wipe student devices to a particular standard?

No. This is the single most common misunderstanding in district procurement, and it is worth being blunt about: FERPA contains no media sanitization requirement of any kind. It does not name a method, a standard or a verification step. What creates your sanitization obligation is state student-privacy law, your contracts with edtech vendors, your own board policy, and ordinary duty of care — all of which are real, and none of which is FERPA. A vendor telling you that FERPA requires NIST 800-88 wiping is telling you something that is not in the regulation.

So what does FERPA actually say about destruction?

Three things. You may not destroy education records while an inspection request is outstanding (§99.10(e)). Organizations conducting studies for you must destroy personally identifiable information when it is no longer needed (§99.31(a)(6)(iii)(C)). Authorized representatives receiving PII for audit or evaluation must do the same (§99.35). All three are about records and the agreements governing them, not about drives.

Is there a FERPA-certified ITAD provider?

No. The Department of Education certifies no disposal vendors, and the obligation remains with the educational agency or institution whoever performs the work. What a good provider gives you is evidence you can put in front of a board, a state regulator or a parent — not a status.

We collect thousands of devices in an eight-week summer window. Where does this usually go wrong?

Two places, and neither is the wiping. First, §99.10(e): a device collected in July can hold the only copy of something a parent asked to inspect in June, and nobody checked. Second, reconciliation: the gap between the cohort as issued and the cohort as returned is discovered at the facility, in August, when there is no time left to chase it. Both are solved by sequencing, not by technology.

The operational side of the same problem — how a district cohort is actually collected, reconciled and retired inside an eight-week summer window.

Plan the summer in the spring.

Send us the cohort, the sites and the dates. We will come back with a collection plan and the sequence that keeps §99.10(e) out of your way.

Request an assessment (469) 718-0004