Skip navigation

Office of the Registrar

FERPA FAQ for DU Employees


FERPA stands for Family Educational Rights and Privacy Act (sometimes called the Buckley Amendment). Passed by Congress in 1974, the Act grants four specific rights to the adult student:

  • the right to see the information that the institution is keeping on the student
  • the right to seek amendment to those records and in certain cases append a statement to the record
  • the right to consent to disclosure of his/her records
  • the right to file a complaint with the FERPA Office in Washington, D.C.

Just about any information provided by a student to the University for use in the educational process is considered a student educational record. For example :

  • personal information
  • enrollment records
  • grades
  • schedules

The type of media in which you find this information doesn’t matter. Student educational records may be:

  • a document in the registrar's office
  • a computer printout in your office
  • a class list on your desktop
  • a computer display screen
  • notes you have taken during an advisement session
  • Student educational records are considered confidential and may not be released without the written consent of the student.
  • As a faculty or staff member, you have a responsibility to protect educational records in your possession.
  • Some information is considered public (sometimes called "directory information"). This info can be released without the student's written permission. However, the student may consider this info confidential as well. Directory information is: name, address, phone, dates of attendance, degrees received, major program, height and weight of athletes, email address, full- or part-time status and date of birth.
  • You have access to student information only for legitimate use in completion of your responsibilities as a university employee. “Need to know” is the basic principle.
  • If you are ever in doubt, do not release any information until you contact the Office of the Registrar at 303-871-2284 or The Office of the Registrar is responsible for student record information.
As a DU employee, may I access students’ education records?

University faculty and staff may access students’ education records for the sole and explicit purpose of allowing them to carry out their official University functions. Any other use is prohibited. It is the responsibility of each school official to understand his or her legal responsibilities under FERPA and other privacy regulations at the University of Denver. Failure to adhere to privacy regulations can result in disciplinary action up to and including termination.

School officials with legitimate educational interest may access student information. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility. The University of Denver defines school officials as follows:

University officials with legitimate educational interests include a person employed by the University in an administrative, supervisory, academic, research, or staff position (including law enforcement unit personnel and health staff); a person or company with whom the University has contracted (such as an attorney, auditor, or collection agent); a person serving on the Board of Trustees; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her institutional duties.

What rights does FERPA afford students with respect to their education records?
  • The right to inspect and review their education records within 45 days of the day DU receives a request for access. Students should submit to the Office of the Registrar written requests that identify the records they wish to inspect. The Office of the Registrar will arrange access (coordinating with appropriate offices) and notify the student of the time and place where records may be inspected.
  • The right to request an amendment to the student’s education records that the student believes are inaccurate or misleading. Students may ask to amend a record that they believe is inaccurate or misleading. They should write the Office of the Registrar, clearly identify the part of the record they want changed, and specify why it is inaccurate or misleading. If DU decides not to amend the record as requested by the student, we will notify the student of the decision and advise the student of his or her right to a hearing regarding the request for amendment. Additional information regarding the hearing will be provided to the student when notified of a hearing.
  • The right to consent to disclosures of personally identifiable information contained in the student’s education records, except to the extent that FERPA authorizes disclosure without consent (such as to school officials).
  • The right to file a complaint with the U.S. Department of Education concerning alleged failures of DU to comply with the requirements of FERPA. The name and address of the office that administers FERPA is:

    Family Policy Compliance Office
    U.S. Department of Education
    400 Maryland Ave.,S.W.
    Washington,DC 20202-4605
Who is protected under FERPA?

Students who are currently or formerly enrolled, regardless of their age or status in regard to parental dependency are protected under FERPA. Students who have applied to but have not attended DU do not come under FERPA guidelines for DU, but records (e.g., transcripts) from previously attended schools are protected by FERPA. FERPA rights terminate at death.

What is not included in an education record?
  • Sole possession records or private notes held by school officials that are not accessible or released to other personnel;
  • law enforcement or campus security records that are solely for law enforcement purposes and maintained solely by the law enforcement unit;
  • records relating to individuals who are employed by the institution (unless contingent upon attendance);
  • records relating to treatment provided by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional and disclosed only to individuals providing treatment; and
  • records that contain information about an individual obtained only after that person is no longer a student, i.e., alumni records.
What is directory information?

Institutions may disclose information on a student without violating FERPA if it has designated that information as “directory information.” DU designates the following as directory information: the student's name, addresses, telephone numbers, electronic mail addresses, photographic images, date and place of birth, major field of study, full-time or part-time status, class (e.g., graduate, sophomore, junior), participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, anticipated date of graduation, degree(s), honors or awards received, including selection to a dean’s list or honorary organization, the most recent previous educational agency or institution attended by the student.

DU designates directory information to perform specific functions such as enrollment verifications. As a matter of practice, not all directory information is disclosed to third parties. For example, DU does not disclose students’ addresses and telephone numbers even those are designated directory information for specific safety purposes.  Contact the Office of the Registrar for additional information.  

May a student request that directory information not be released?

Any student wishing that directory information not be released must submit a “Request to Withhold Information” form to the Office of the Registrar. Requests must be submitted each fall.

How do I know if a student has requested that directory information not be released? What do I do?

When using the Banner information system, a pop-up window will appear when accessing information for students who have requested that directory information be suppressed. The pop-up window states: Warning: Information about this person is confidential. An indication that the student information is confidential will appear on Banner web screens and on many Banner reports.

If a student has requested that directory information not be released, no information about that student should be shared with any third party (i.e., the student or anyone who is not a University Official). Academic and student service departments should require that the student appear in person with a picture identification to conduct business. Business should not be conducted over the telephone. If any third party should request any information about the student, the University employee should state “there is no information available for that individual.” Direct inquiries to the Office of the Registrar.

Who may have access to student information?
  • The student and any outside party who has the student’s written authorization.
  • School officials (defined above) who have “legitimate educational interests.”
  • A Teaching Assistant (TA) or a Graduate Assistant (GA) may be granted access to educational records for courses they are assigned to, or for courses which they are assisting with instruction.
  • Parents of a dependent student as defined by the Internal Revenue Code may have access to the student’s education records. The parent must attest to dependency status and file a form annually with the Office of the Registrar. Students may revoke parents’ access to their educational records, thus it is important to determine if a release is in effect (see below).
  • A person in response to a lawfully issued subpoena or court order, as long as DU first makes a reasonable attempt to notify the student. All subpoenas and court orders for student information should be referred to the Office of the Registrar. Law enforcement officials seeking student information should be referred immediately to the University Counsel (x14646) or the Office of the Registrar (x13897).
  • DU may notify parents or guardians when a dependent student under the age of 21 is placed on judicial probation or suspended or dismissed.
How do I know if a student has released educational records to a third party such as a parent?

Students’ information releases are recorded in the Banner system by the Office of the Registrar. iBanner users may view releases on the DU FERPA Information Release Form (SZAFRPA) form. Students, faculty and advisers may see if a release is in place using PioneerWeb Faculty & Adviser self-service. The form shows the valid period for the release; the specific information (e.g., grades) that may be released, and the party to whom the information may be released.

Educational records should never be shared with any third party (including parents) if a release is not in place.

There are two ‘blanket’ releases that are not recorded on SZAFRPA. Varsity athletes sign a standard release provided by the NCAA that authorizes release of information to the NCAA and other parties for athletes. Foreign students sign a release to the U.S. Citizenship and Immigration Services office as part of their I-20 form. Inquiries from NCAA should be referred to the Department of Athletics. Inquiries from U.S. Citizenship and Immigration Services should be referred to the Office of Internationalization.

What can I include in a letter of recommendation for a student?

Faculty and staff are often asked to write letters of recommendation for students. While personal observations do not require a written release, disclosure of any educational record (such as GPA or classroom performance) requires a written release. A customized release form for letters of recommendation is available on the Registrar’s website. Alternatively, DU faculty and staff may ask a student to submit the standard release via PioneerWeb, which specifies information which may be released in the letter of recommendation.

When is the student’s consent not required to disclose information?

When the disclosure is:

  • to school officials (defined above) who have a legitimate educational interest;
  • to federal, state, and local authorities involving an audit or evaluation of compliance with educational programs;
  • in connection with financial aid (this includes veterans’ benefits);
  • to accrediting organizations;
  • to parents who have filed a Request for Disclosure of Educational Records for a dependent student;
  • to comply with a judicial order or subpoena;
  • in a health or safety emergency;
  • releasing directory information;
  • releasing the results of a disciplinary hearing to an alleged victim of a crime of violence.

Other than sharing information with individuals to whom the student has signed a release, these needs should be coordinated through the Office of the Registrar.

Outside contractors may perform work as the University’s agent under specific circumstances. Contact the Office of the Registrar for additional information.

Disclosure to Parents

When a student turns 18 years old or enters a postsecondary institution at any age, all rights afforded to parents under FERPA transfer to the student. In nearly every case, university employees should only disclose information to parents when a release is in place (see page 2). However, FERPA permits some circumstances in which schools may share information with parents without the student's consent. For example:

  • Schools may disclose education records to parents if a health or safety emergency involves their son or daughter.
  • Schools may inform parents if the student who is under age 21 has violated any law or its policy concerning the use or possession of alcohol or a controlled substance.
  • A school official may generally share with a parent information that is based on that official's personal knowledge or observation of the student.

Disclosure to Contractors and Agents

The University may engage contractors or agents to perform work on its behalf. If performing such work includes access to education records, the contractor is designated as a “school official” as defined above. In order to be provided with access to confidential education records, a formal agreement with the contractor must include the following:

  • The University of Denver retains full ownership rights in the confidential student information;
  • The contractor will use the information solely for the purpose stated in the agreement;
  • The contractor will release student information only to University of Denver officials;
  • The contractor will institute and maintain reasonable controls to ensure the integrity and security of the information;
  • The contractor will indemnify and hold the University harmless from any direct loss, cost, damage or expense suffered by the University as a direct result of the contractor’s failure to comply with its obligations under the agreement;
  • The contract will comply with FERPA, the Financial Modernization Act of 1999 and other laws concerning the privacy and confidentiality of information and records;
  • The contractor will return or destroy all information provided under the agreement upon termination of the agreement or written request of the University of Denver.

These terms must be included in the contract or may be incorporated by signing an Agent/Contractor Agreement available from the Office of the Registrar. The Office of the Registrar must review any contract or agreement involving the release of education records as defined above.

Balancing Student Privacy and School Safety

University officials are regularly asked to balance the interests of safety and privacy for individual students. While FERPA generally requires institutions to ask for written consent before disclosing information, it also allows colleges and universities to take key steps to maintain campus safety.

Health or Safety Emergency

In an emergency, FERPA permits school officials to disclose without student consent education records, including personally identifiable information from those records, to protect the health or safety of students or other individuals. At such times, records and information may be released to appropriate parties such as law enforcement officials, public health officials, and trained medical personnel. [34 CFR § 99.31(a)(10) and § 99.36]. This exception to FERPA's general consent rule is limited to the period of the emergency and generally does not allow for a blanket release of personally identifiable information from a student's education records. DU officials may disclose information from education records to parents if a health or safety emergency involves their son or daughter.

FERPA and Student Health Information

DU may share student medical treatment records with parents under the circumstances described above. While these records may otherwise be governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HIPAA Privacy Rule excludes student medical treatment records and other records protected by FERPA.

Disciplinary Records

While student disciplinary records are protected as education records under FERPA, there are certain circumstances in which disciplinary records may be disclosed without the student's consent. DU Community Standard officials may disclose to an alleged victim of any crime of violence or non-forcible sex offense the final results of a disciplinary proceeding conducted by the institution against the alleged perpetrator of that crime, regardless of whether the institution concluded a violation was committed. An institution may disclose to anyone – not just the victim – the final results of a disciplinary proceeding, if it determines that the student is an alleged perpetrator of a crime of violence or non-forcible sex offense, and with respect to the allegation made against him or her, the student has committed a violation of the institution's rules or policies [34 CFR §§ 99.31(a)(13) and (14)].

FERPA and Student and Exchange Visitor Information System (SEVIS)

FERPA permits institutions to comply with information requests from the Department of Homeland Security (DHS) and its Immigration and Customs Enforcement Bureau (ICE) in order to comply with the requirements of SEVIS. SEVIS compliance is administered by the Office of Internationalization.

Electronic Information Resources

DU employs a number of electronic information systems which contain confidential student information. These include Banner, Blackboard and other learning management systems, the DU portfolio and others. The same principles of confidentiality that apply to paper records also apply to electronic data.

May I use social media such as Facebook or blogs in my classroom?

FERPA does not forbid instructors from using social media in the classroom, but common sense guidelines should be used to ensure the protection of students. Information posted to such media are public and may be viewed by others. You must inform students of this fact and should consider it if requiring students to use them. Students should not be required to release any personal information on a public site. Instructor comments or grades on student material should never be made public.

How may I use information from the DU data reporting views, the DU Operational Data Store or Enterprise Data Warehouse?

These data tools are made available for specific communication tasks and internal reporting. Specific policies exist for use of data from these tools. Contact the Office of the Registrar or Information Technology for additional information.

Requirements for Electronic Data Protection

  • Protected student information may be stored only in approved storage locations.
  • Protected student information stored on office computers, home computers and laptops must be encrypted. The Information Technology website lists an approved, easy-to-use encryption tool.
  • Before computers and rewritable storage media (e.g., hard disks, other magnetic media, and flash memory devices such as key chain storage devices) are transferred between University departments or to different employees within a University department, all files that the recipients are not explicitly authorized to access must be deleted and free space must be erased.
  • When computers and rewritable storage media are discarded or sold outside the University, rewritable storage media must be erased by overwriting with meaningless data.
  • Media such as CDs and DVDs that are not rewritable must be physically destroyed before they are discarded.

The complete policy for secure computing may be seen at Questions can be directed to Information Technology at 303.871.2100

How do I get additional information about FERPA?

The Office of the Registrar administers FERPA for the University of Denver. All inquiries regarding FERPA should be referred to:

The Office of the Registrar
University of Denver
2197 S. University Blvd., Room G45
Denver, CO 80208

The University of Denver Privacy Policy may be seen at:

Academic Departments Document Retention

Advising Plans Notes from faculty after advisement sessions with students 5 years
Appeal for Grade Change Student requested through their department a review and consideration of a different final grade 1 year
Applications for Admission Applicants who do not enroll, whether they are accepted or rejected,
Applicants who enroll
1 year
5 years
Blackboard Accounts Instructor virtual grade book 2 years
Correspondence To and from faculty member regarding student issues 5 years
Course Syllabi Instructor outline of the course requirements. May include information about tests, projects, reading assignments, as well as required textbooks 5 years
Disciplinary Actions on Students Information received 5 years
Examinations, Tests, Quizzes Examinations, tests, quizzes, and term papers used to demonstrate student’s knowledge of materials learned in a particular course 1 year

A comprehensive document retention schedule is located at:

Click here to view a complete FERPA Guide for University of Denver Employees.

FERPA FAQ for University of Denver Families

How can I learn how my child is doing?

The best approach is to ask your student. Communicating with young adults, as you may well know, sometimes isn’t easy. They are not always as forthcoming as we would like. The college years, however, are a period of remarkable growth and maturation. The ability and willingness of students to share information and insights usually grows, especially as they acquire the confidence that comes with assuming greater responsibility for their own lives.

How does my student learn his or her grades?

Students obtain their grades on their secure DU web account: PioneerWeb. Students receive a personal announcement as soon as grades are available. Student may print an official University of Denver grade notification from the web site.

How can I find out about my student’s grades, and will I be notified if my student is put on academic probation, or is subject to academic dismissal?

Information about grades and academic standing is given directly to students. Most parents find out this information by asking their student. Doing so fosters trust and a sense of mutual responsibility. You can, of course, ask your student to keep you routinely informed about his/her academic performance. Many students send parents official grade notification that they have printed from PioneerWeb. DU does not routinely mail grades. Students may request that grades be mailed to parents by filling out a “Request to Mail Grades” form, available from the Office of the Registrar.

I had easy access to my child’s school records before, so why don’t I have the same access to records kept by DU?

Under FERPA, the access rights that parents and legal guardians had in the elementary and secondary school setting are transferred to students, once a student has turned eighteen, or is attending any post-secondary educational institution.

How can we obtain a release to access our student’s educational records?

Students can complete a “Release of Confidential Student Record Information” which permits university officials to share educational information with parents or other third parties. This release may be completed online in DU’s secure web portal, PioneerWeb, once your student matriculates at DU.

Additionally, FERPA permits – but does not require – “disclosure [of information in the students education records] to the parents of a dependent student, as defined in section 152 of the Internal Revenue Code of 1986” [part 99.31 (a) (8)]. Although we feel this mechanism does not foster communication with your student, DU will release certain information to parents of a dependent without a student’s consent. Parents may fill out a “Parental Request for Disclosure of Educational Records” form for this purpose.

Both release forms are available from the Office of the Registrar or by visiting the Registrar’s web site: Click on “Home” then click on “Forms.” Releases cannot be processed until a student matriculates to DU and should not be submitted in advance.

Can my student have bills sent to me?

Students view bills via DUPay. Students may set up 'authorized users' via DUPay. Authorized users can log into DUPay to view your student account balance and make payments on behalf of a student. Students may give authorized users access to statement and payment history. Access to DUPay as an authorized user does not constitute a FERPA release for University-held records.

Will I be informed if my daughter or son is treated at Health or Counseling Services?

Health and Counseling Services’ records are subject to even more restrictions than are educational records. Those restrictions extend to the need to keep confidential the identity of students seeking services. There are important reasons for these confidentiality requirements, including the proven therapeutic benefits associated with encouraging students to talk openly and candidly with a physician, psychologist or other health professional without fear that their conversations will be reported to others. Many students, however, welcome their parents’ interest in their physical and mental health and are willing to give consent for treatment providers to communicate with their parents.

What if my son or daughter is under 18?

The privacy regulations mandated by FERPA apply to all college students, even those who are not yet 18 years old. Regarding consent for medical or psychological treatment, while the need to maintain confidentiality is still very important, students who are under 18 must have parental consent for treatment. The exception to this requirement is in the case of an emergency or if there is a compelling reason why seeking parental consent would be detrimental. Consultation and treatment for mental health and substance abuse issues and sexual/reproductive health issues are also excluded from the requirement for parental consent.

Will I be notified if my child is hurt or in danger?

In the event of a potentially life-threatening emergency FERPA allows parents or guardians to be notified without prior consent from the student. In those rare events, the University will make every reasonable effort to notify parents about the situation. Most situations, however, do not constitute an imminently life-threatening danger and parents would not be contacted without the student’s permission. We urge students to provide the University with emergency contact information. Students may do so on the web.

I’ve heard about changes in FERPA allowing notice to the public if a student commits a crime of violence, and allowing notice to parents when a student violates drug or alcohol laws. What is DU’s position on these provisions?

These changes in FERPA allow, but do not require, releases of final results of campus disciplinary proceedings regarding specified crimes of violence or non-forcible sex offenses, and disclosures to parents of “the student’s violation of any Federal, State, or local law, or any policy of the institution, governing the use or possession of alcohol or a controlled substance” if certain conditions apply. Currently, DU has decided not to make public the identities of individuals suspended or dismissed for any crime of violence or non-forcible sex offenses specified in the law, nor will it always notify parents of students under the age of 21 when the institution determines that the student has committed a disciplinary violation of DU’s Alcohol and Illicit Drug Policy. However, in accordance with the exceptions to FERPA defined above, DU may notify parents or guardians when a dependent student under the age of 21 is placed on judicial probation or suspended or dismissed.

How do I get more information about FERPA?

The Office of the Registrar administers FERPA for the University of Denver. All inquiries regarding FERPA should be referred to:

The Office of the Registrar
University of Denver
2197 S. University Blvd., Room G45
Denver, CO 80208

The University of Denver’s Privacy policy may be viewed on the web at FERPA information for students may be viewed on the web at

Click here to view a complete FERPA Guide for University of Denver Families.