--- title: "34 CFR 99.35 FERPA: What conditions apply to disclosure of information for Federal or State program purposes?" canonical: "https://dposchool.com/ferpa/section/99.35" source: "https://www.ecfr.gov/current/title-34/section-99.35" source_note: "Source: United States Code, title 20, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 34, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 34 CFR 99.35 FERPA · Part 99: FAMILY EDUCATIONAL RIGHTS AND PRIVACY · Subpart D: May an Educational Agency or Institution Disclose Personally Identifiable Information From Education Records? # 34 CFR 99.35 FERPA: What conditions apply to disclosure of information for Federal or State program purposes? eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text **(a)(1)** Authorized representatives of the officials or agencies headed by officials listed in § 99.31(a)(3) may have access to education records in connection with an audit or evaluation of Federal or State supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs. #### 34 CFR 99.35(2) **(2)** The State or local educational authority or agency headed by an official listed in § 99.31(a)(3) is responsible for using reasonable methods to ensure to the greatest extent practicable that any entity or individual designated as its authorized representative— ##### 34 CFR 99.35(2)(i) **(i)** Uses personally identifiable information only to carry out an audit or evaluation of Federal- or State-supported education programs, or for the enforcement of or compliance with Federal legal requirements related to these programs; ##### 34 CFR 99.35(2)(ii) **(ii)** Protects the personally identifiable information from further disclosures or other uses, except as authorized in paragraph (b)(1) of this section; and ##### 34 CFR 99.35(2)(iii) **(iii)** Destroys the personally identifiable information in accordance with the requirements of paragraphs (b) and (c) of this section. #### 34 CFR 99.35(3) **(3)** The State or local educational authority or agency headed by an official listed in § 99.31(a)(3) must use a written agreement to designate any authorized representative, other than an employee. The written agreement must— ##### 34 CFR 99.35(3)(i) **(i)** Designate the individual or entity as an authorized representative; ##### 34 CFR 99.35(3)(ii) **(ii)** Specify— ###### 34 CFR 99.35(3)(ii)(A) **(A)** The personally identifiable information from education records to be disclosed; ###### 34 CFR 99.35(3)(ii)(B) **(B)** That the purpose for which the personally identifiable information from education records is disclosed to the authorized representative is to carry out an audit or evaluation of Federal- or State-supported education programs, or to enforce or to comply with Federal legal requirements that relate to those programs; and ###### 34 CFR 99.35(3)(ii)(C) **(C)** A description of the activity with sufficient specificity to make clear that the work falls within the exception of § 99.31(a)(3), including a description of how the personally identifiable information from education records will be used; ##### 34 CFR 99.35(3)(iii) **(iii)** Require the authorized representative to destroy personally identifiable information from education records when the information is no longer needed for the purpose specified; ##### 34 CFR 99.35(3)(iv) **(iv)** Specify the time period in which the information must be destroyed; and ##### 34 CFR 99.35(3)(v) **(v)** Establish policies and procedures, consistent with the Act and other Federal and State confidentiality and privacy provisions, to protect personally identifiable information from education records from further disclosure (except back to the disclosing entity) and unauthorized use, including limiting use of personally identifiable information from education records to only authorized representatives with legitimate interests in the audit or evaluation of a Federal- or State-supported education program or for compliance or enforcement of Federal legal requirements related to these programs. ### 34 CFR 99.35(b) **(b)** Information that is collected under paragraph (a) of this section must— #### 34 CFR 99.35(b)(1) **(1)** Be protected in a manner that does not permit personal identification of individuals by anyone other than the State or local educational authority or agency headed by an official listed in § 99.31(a)(3) and their authorized representatives, except that the State or local educational authority or agency headed by an official listed in § 99.31(a)(3) may make further disclosures of personally identifiable information from education records on behalf of the educational agency or institution in accordance with the requirements of § 99.33(b); and #### 34 CFR 99.35(b)(2) **(2)** Be destroyed when no longer needed for the purposes listed in paragraph (a) of this section. ### 34 CFR 99.35(c) **(c)** Paragraph (b) of this section does not apply if: #### 34 CFR 99.35(c)(1) **(1)** The parent or eligible student has given written consent for the disclosure under § 99.30; or #### 34 CFR 99.35(c)(2) **(2)** The collection of personally identifiable information is specifically authorized by Federal law. (Authority: 20 U.S.C. 1232g(b)(1)(C), (b)(3), and (b)(5)) ## Source Source: Electronic Code of Federal Regulations (eCFR), title 34, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[53 FR 11943, Apr. 11, 1988, as amended at 73 FR 74854, Dec. 9, 2008; 76 FR 75642, Dec. 2, 2011\] [34 CFR 99.35 on eCFR](https://www.ecfr.gov/current/title-34/section-99.35) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [FERPA Navigator](https://dposchool.com/ferpa) / 34 CFR 99.35 Previous: [34 CFR 99.34 FERPA: What conditions apply to disclosure of information to other educational agencies or institutions?](https://dposchool.com/ferpa/section/99.34) Next: [34 CFR 99.36 FERPA: What conditions apply to disclosure of information in health and safety emergencies?](https://dposchool.com/ferpa/section/99.36) ## For AI agents - Machine-readable index: https://dposchool.com/ferpa/llms.txt - JSON API: https://dposchool.com/ferpa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents