What is FERPA and how does it relate to school device management?

Skie for Enterprise · Updated

Short answer

FERPA is a United States law that protects the privacy of student education records and gives parents and eligible students certain rights over them. If you serve US schools it may apply to the data around managed devices. No software makes a school FERPA compliant. This is general information, not legal advice.

The Family Educational Rights and Privacy Act covers education records held by schools that receive US federal funding. It gives parents, and students once they reach a certain age, the right to see records and to ask for corrections, and it limits who the school can share records with without consent.

Vendors acting on a school's behalf are often covered by a rule that lets a school share records with a service provider that does work the school would otherwise do itself, under the school's direct control. Whether a particular device management setup meets that is a question for the school's counsel and its own policies.

What matters in practice is what the school can show. Who has access to the data? Can the school control that access? Is there a written agreement that says what the vendor may do with the data? Skie offers roles and page access, an audit log and a narrow collection of data. Message content is not collected at all.

Data rights are the harder part. Skie does not yet offer a self-service export or deletion tool for a whole organisation. Backups and the lost-device police report can be downloaded, student-linked data is cleared when a student is reassigned, and requests beyond that go through support. A school that needs more should say so in the agreement.

A practical tip: designate one person at the school to receive record requests about device data, and tell families who that is. When the request comes, you will not be hunting for an owner.