FERPA FAQ

expand all

What Data Is Protected?

All student data contained within the education record is protected and may not be disclosed without signed student consent with exception of Directory Information, which is identified in the Student Rights, Rules, and Responsibilities Handbook and outlined below.

At UNH, we consider the student to be the “owner” of the information in the record and UNH to be the “custodian” of that record.

Required protections begin when an institution defines the individual as a student and ends at the student’s death.  At UNH, FERPA protection begins at the point when a student first registers for a UNH course or the student’s first day of classes during the first UNH term, whichever comes first.

Directory Information

FERPA permits Directory Information to be released without student consent. Permission to use student directory information must be granted from the appropriate data steward. To request permission, complete the Data Access Request form. 

UNH Directory Information includes the following:

  • Students name, address, telephone number, and email address
  • Major field of study
  • Participation in officially recognized sports or activities
  • Weight and height of members of athletic teams
  • Dates of attendance
  • Degrees and awards received
  • Most recent previous educational institution or agency attended by the student
  • Class
  • Honors
  • Enrollment status

A student has the right to block disclosure of all Directory Information by a non-disclosure form to the Office of the Registrar.

Note: Grades are also considered "directory" information to the extent that honor rolls may be published.  Transcripts of students' academic records or students' g.p.a. may be released to the faculty advisers of officially recognized honor societies on campus upon request unless the student has filed an objection to this specific procedure with the Office of the Registrar. Only faculty members and appropriate administrators have the right to access student records.

Who Must Comply?

Anyone, including work study students, with access to education records for UNH students (including prior students).

Who Can Access Information Protected by FERPA?

“School officials” with a “legitimate educational interest” may be granted access to education records without the consent of the student.  Legitimate educational interest at UNH is defined as need to know, not a want to know. 

FERPA does not identify specific criteria for determining limits of ‘legitimate educational interest.’ The UNH data steward for student data is responsible for determining what does and does not constitute a legitimate educational interest for UNH. Typically, the data must be needed in order to fulfill one’s assigned job responsibilities.

UNH may disclose information from an education record to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health or safety of a student or other individuals. 

How is access to information protected by FERPA requested/granted?

Data steward approval is required in order to access all information protected by FERPA.

  • Individuals may be granted access to information protected by FERPA that is already available in an application like Banner Student.  This type of access is approved by the data steward as part of the account management process.
  • Access to information protected by FERPA outside of an existing application must be requested via the process outlined below.
  • Access to information protected by FERPA by a new application must be requested via the process outlined below. 

At UNH, the University Registrar is the data steward for FERPA student information. Graduate student FERPA stewardship is coordinated between the Registrar and the Graduate School.  Requests for access must be submitted via the Data Access Request form. 

Does the use of FERPA protected information require special handling?

To comply with FERPA, UNH must “use reasonable methods" to ensure only authorized users access or use the student education records to which they have been authorized.  Authorized users are those school officials who have been deemed to have a legitimate educational interest to access specific education records.

Reasonable methods include implementing administrative, technical, and physical controls to prevent unauthorized access or disclosure.

  • Administrative Controls:
  • Technical Controls:
    • Defense in Depth Security Strategy
    • Storage requirements
    • Access controls
      • Access to student education records stored in electronic form must have appropriate access controls enforced to ensure only those UNH users who are authorized to access the records of that student have access
  • Physical Controls:
    • Information protected by FERPA in printed form cannot be left out on employee's desks
    • Computers should be locked if leaving one’s desk.
    • Student files must be stored securely.

Can information protected by FERPA be shared? If so, with whom?

Under FERPA, students must consent to any disclosure of their education records that is not covered by a legitimate educational interest.  This means that those who are authorized to access this type of information must not share it with any person, including other UNH faculty, staff, or students, without first either 1) obtaining the consent of the student or 2) confirming that person has a legitimate educational interest and can be given access to the information without student consent.

Are there restrictions on where Information protected by FERPA can be stored?

UNH has a legal and ethical responsibility to protect the privacy and security of education data, including personally identifiable information, regardless of the mechanism used to store it.  For specifics on where regulated data, including information protected by FERPA can be stored, see Storage Options in menu above.

Are there special requirements for disposal of information protected by FERPA?

Electronically stored protected information must be deleted* according to the standard set by UNH IT.  Equipment used to store and process FERPA protected data that is submitted to the SEED program will be disposed of in the appropriate manner. Printed protected information must be disposed in secure designated shredding receptacles.

*deleted: the Retention Disposal Policy > TB

Legitimate education interest means there is a need to know, not a want to know.  As FERPA does not identify criteria for determining limits of ‘legitimate educational interest' this responsibility falls to the UNH data stewards for student information.  To confirm that a 'legitimate educational interest' exists, contact the appropriate data steward. 

At UNH, the University Registrar is the data steward for FERPA student information. Graduate student FERPA stewardship is coordinated between the Registrar and the Graduate School. To request permission to use information about students, complete the Data Access Request form. 

This responsibility falls to the UNH data stewards for student information.  To confirm that a 'legitimate educational interest' exists, contact the University Registrar.

FERPA assigns rights to the student when the student turns 18 years old or when the student is “in attendance” at a post-secondary institution. 

At UNH, a student may grant a parent, or other individual of the student’s choosing, access to semester grades, financial aid, and billing and payment information via the Parent Portal. The student must consent to share each type of information available in that application with the parent or other individual of the student’s choosing via that application.

At UNH, a student provides consent to a parent to access semester grades via the Parent Portal.

If a student does not want information disclosed as public, or "directory," information and do not want your records released to honor societies, a completed Non-Disclosure Form must be submitted.

Yes, however, a UNH faculty or staff may send and receive protected student information through official University email addresses only. A student may only be sent and receive protected information about themselves from a faculty or staff member.  Student email accounts are @wildcats.unh.edu. Faculty and staff email accounts are @unh.edu.