This subpart implements the Family Educational Rights and Privacy Act (FERPA or the Act), 20 U.S.C. 1232g. Additional FERPA-implementing regulations are found at 34 CFR part 99.

It is the Department's policy to designate as its authorized representative, for purposes of compliance with FERPA, any contractor that will collect or receive access to personally identifiable information (PII) from student education records in connection with the conduct of an audit, evaluation, study, compliance review, or other Federal law enforcement activity. The Department will notify such contractors, or prospective contractors, prior to award or during contract performance of their obligations to protect student privacy in compliance with FERPA. Further, the Department will incorporate into all relevant solicitations and contracts the provisions and clauses needed to implement FERPA requirements. The aforementioned policies do not apply to Federal Student Aid (FSA) contracts for the origination, servicing, or collection of student financial aid, provided such contracts do not include tasks relating to the conduct of an audit, evaluation, study, compliance review, or other enforcement activity.

During acquisition planning, the requiring activity, in consultation with the Department's Senior Agency Official for Privacy (SAOP) and Director of the Student Privacy Policy Office (SPPO Director), must review requirements to determine whether the contract will require the Department to share PII from students' education records with its contractor or authorize its contractor to collect such PII from students' education records for the purposes of conducting a study, evaluation, or audit of a federally supported education program, or the enforcement of Federal legal requirements that relate to such education programs. The requiring activity must notify the contracting officer of the determination.

The contracting officer must insert the clause at 3452.224–73 in all solicitations and contracts, including those for the acquisition of commercial products or commercial services, when a requiring activity has provided notification that a contractor will collect or receive access to PII from student education records in connection with carrying out an audit, evaluation, study, compliance review, or other Federal law enforcement activity on behalf of the Department. The contracting officer must fill out paragraph (b) of the clause at 3452.224–73 with the type(s) of PII to be collected or accessed by contractor.