--- title: "34 CFR 99.67 FERPA: How does the Secretary enforce decisions?" canonical: "https://dposchool.com/ferpa/section/99.67" source: "https://www.ecfr.gov/current/title-34/section-99.67" source_note: "Source: United States Code, title 20, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 34, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 34 CFR 99.67 FERPA · Part 99: FAMILY EDUCATIONAL RIGHTS AND PRIVACY · Subpart E: What Are the Enforcement Procedures? # 34 CFR 99.67 FERPA: How does the Secretary enforce decisions? eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 34 CFR 99.67(a) **(a)** If an educational agency or institution or other recipient of Department funds under any program administered by the Secretary does not comply during the period of time set under § 99.66(c), the Secretary may take any legally available enforcement action in accordance with the Act, including, but not limited to, the following enforcement actions available in accordance with part D of the General Education Provisions Act— #### 34 CFR 99.67(a)(1) **(1)** Withhold further payments under any applicable program; #### 34 CFR 99.67(a)(2) **(2)** Issue a complaint to compel compliance through a cease and desist order; or #### 34 CFR 99.67(a)(3) **(3)** Terminate eligibility to receive funding under any applicable program. ### 34 CFR 99.67(b) **(b)** If, after an investigation under § 99.66, the Secretary finds that an educational agency or institution, other recipient, or third party has complied voluntarily with the Act or this part, the Secretary provides the complainant and the agency or institution, other recipient, or third party with written notice of the decision and the basis for the decision. ### 34 CFR 99.67(c) **(c)** If the Office finds that a third party, outside the educational agency or institution, violates § 99.31(a)(6)(iii)(B), then the educational agency or institution from which the personally identifiable information originated may not allow the third party found to be responsible for the violation of § 99.31(a)(6)(iii)(B) access to personally identifiable information from education records for at least five years. ### 34 CFR 99.67(d) **(d)** If the Office finds that a State or local educational authority, a Federal agency headed by an official listed in § 99.31(a)(3), or an authorized representative of a State or local educational authority or a Federal agency headed by an official listed in § 99.31(a)(3), improperly rediscloses personally identifiable information from education records, then the educational agency or institution from which the personally identifiable information originated may not allow the third party found to be responsible for the improper redisclosure access to personally identifiable information from education records for at least five years. ### 34 CFR 99.67(e) **(e)** If the Office finds that a third party, outside the educational agency or institution, improperly rediscloses personally identifiable information from education records in violation of § 99.33 or fails to provide the notification required under § 99.33(b)(2), then the educational agency or institution from which the personally identifiable information originated may not allow the third party found to be responsible for the violation access to personally identifiable information from education records for at least five years. (Authority: 20 U.S.C. 1232g(b)(4)(B) and (f); 20 U.S.C. 1234c) ## Source Source: Electronic Code of Federal Regulations (eCFR), title 34, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[76 FR 75643, Dec. 2, 2011\] [34 CFR 99.67 on eCFR](https://www.ecfr.gov/current/title-34/section-99.67) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [FERPA Navigator](https://dposchool.com/ferpa) / 34 CFR 99.67 Previous: [34 CFR 99.66 FERPA: What are the responsibilities of the Office in the enforcement process?](https://dposchool.com/ferpa/section/99.66) Next: [34 CFR Appendix A to Part 99 FERPA: Crimes of Violence Definitions](https://dposchool.com/ferpa/section/appendix-a-to-part-99) ## For AI agents - Machine-readable index: https://dposchool.com/ferpa/llms.txt - JSON API: https://dposchool.com/ferpa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents