FERPA Compliance

I. Scope

This policy applies to all George Mason University employees, contractors, volunteers, and other parties performing institutional services or acting on behalf of the University. This policy extends to all university activities, and organizations supported wholly or principally by George Mason.

II. Policy Statement

As an educational institution that receives funds administered by the Department of Education, George Mason University is subject to the requirements of The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99, as amended).  George Mason University endeavors to protect the privacy of its students, as required by FERPA.  This policy governs George Mason University’s compliance with FERPA.  To the extent this policy conflicts with or is inconsistent with FERPA, any regulations issued regarding FERPA, or any guidance issued regarding FERPA, the law, regulations or guidance shall control.

George Mason University employees may face disciplinary actions for intended or unintended violations of FERPA, up to and including termination of employment.

III. Definitions

FERPA provides definitions for many key terms relevant to the application of the law.  See 34 C.F.R. § 99.3 for definitions.  George Mason University has also adopted the following definitions for use in applying FERPA:

Custodian means the person responsible in each college or department for the educational records within that college or department.

Directory Information consists of the following:

  • Student Name
  • Email**
  • Address**
  • Phone Number**
  • *Student ID (G Number)
  • *Date of Birth
  • Major Field of Study
  • Dates of Attendance
  • Enrollment Status
  • Previous Institutions
  • Class Level
  • Degrees and Awards Received
  • Photographs
  • Participation in Officially Recognized Sports and Activities
  • Weight and Height of Athletes

*Denotes Limited Directory Information. This information will only be used for verification purposes and to school officials who have access, consistent with FERPA, to such information and only in conjunction with a legitimate educational interest.

**Denotes Directory Information that may be released pursuant to Virginia Code § 23.1-405(C).

Eligible Student is defined by FERPA as “a student who is 18 years of age or older or who attends a postsecondary institution at any age.”   For purposes of this policy, a student is deemed to have “attended” George Mason University if he/she is currently, or was formerly, enrolled in a credit or non-credit class at George Mason University.  A student is enrolled in a class once he/she has registered for the class.  Applicants for admission who were denied acceptance or, if accepted, did not enroll in courses at George Mason University are not eligible students.  Additionally, minors who attend only camp programs at George Mason University are not eligible students, unless they receive credit from the University for their participation in the camp.

Education Records are records directly related to a student that are maintained by George Mason University, or a party acting on behalf of the University.

The following records are not considered educational records:

  • Records created by a school official as a personal memory aid (such as notes of a private telephone conversation).
  • Campus police records which are maintained separately and solely for law enforcement purposes.
  • Treatment records (1) Directly related to an eligible student; (2) Made or maintained by a physician, psychiatrist, psychologist or other recognized professional or paraprofessional acting in his or her professional capacity, or assisting in a paraprofessional capacity; and (3) Made, maintained, or used only in connection with the provision of treatment to the student, and not available to anyone (including the student) other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student’s choice.
  • Records pertaining to a former student, not generated when that person was a student, such as alumni records.
  • Employment records, when employment is not contingent upon the employee’s status as a student.
  • Peer grading.

Legitimate Educational Interest means the need of a school official to access a student’s educational records in the course of performing his or her duties for the University.

In order for a school official to have a legitimate educational interest, he or she must require the student’s educational records in the course of performing his or her official duties for the University.

A legitimate educational interest exists if:

  • The information is necessary for that official to perform appropriate tasks specified in his or her position description or by a contract agreement;
  • The information is used within the context of official George Mason University business and not for purposes extraneous to the official’s areas of responsibility;
  • The information is relevant to the accomplishment of some tasks or to a determination about the student; and
  • The information is used consistently with the purposes for which the data is maintained.

School Officials means any person or entity conducting institutional services or work on behalf of the University. School officials do not necessarily need to be paid employees of the University.

School officials may include (but are not limited to):

  • Faculty
  • Staff
  • Contractors/Consultants
  • Volunteers
  • Board members
  • Trustees
  • Administrators
  • Academic partners
  • Student workers
  • Students functioning in an official University capacity

IV. Compliance

A. Students’ Rights Regarding Their Education Records

FERPA provides eligible students certain rights with respect to their educational records.  The Office of the Registrar shall establish procedures for students to request to inspect and/or amend their education records.  The Office of the Registrar shall also establish procedures for deciding whether to grant a request to amend an education record.

B. Disclosure of Directory Information

FERPA authorizes the release of Directory Information without a student’s consent.  George Mason University assumes that students consent to the release of this information unless they submit a request to withhold disclosure of directory information to the Office of the University Registrar.

C. Disclosure of Educational Records and Student Information

A student may give written consent to release their protected educational records to a third party by submitting a request to the Office of the University Registrar.  Students can rescind their consent via written notification at any time, which will prevent the continued release of that information.

FERPA permits the disclosure of education records without the consent of the student in certain circumstances, as stated in 34 C.F.R. § 99.31.  George Mason University may disclose education records without consent in the circumstances described in 34 C.F.R. § 99.31.

The Office of the Registrar shall establish procedures for the release of educational records of a dependent student, as defined by the federal Family Educational Rights and Privacy Act (20 U.S.C. § 1232g), to a parent at their request.

The Code of Virginia section 23.1-405(C), effective July 1, 2018, prohibits all public or private institution of higher education in Virginia from disclosing a student’s email, address, or phone number pursuant to FERPA’s “directory information” exception, 34 C.F.R. § 99.31(a)(11), or the Virginia Freedom of Information Act, Va. Code § 2.2-3700 et seq., unless the student has affirmatively consented in writing to such disclosure.  Accordingly, George Mason University shall not disclose this information to a third party, non-school official unless (1) a student has provided their affirmative consent in writing; or (2) another FERPA exception applies.

George Mason University reserves the right to decline the release of educational records to any third party.

D. Access of Education Records by School Officials

School officials shall not access the education record of a student unless they have a legitimate educational interest (see definition above) in accessing the information.

In order for a non-employee (e.g., contractor, consultant, volunteer) to be considered a school official, that individual must:

  • Be performing an institutional service or function for which the George Mason University would otherwise use employees;
  • Be under the direct control of George Mason University with respect to the use and maintenance of education records;
  • Acknowledge in writing that they are a school official and agree in writing to comply with the requirements of FERPA and this policy;
  • Receive training regarding compliance with FERPA and this policy

Student workers and students acting in an official capacity for the University (e.g., members of Community Adjudication Boards) may access the education records of other students if they have a legitimate education interest in accessing the information.  Students in these roles, must agree in writing to comply with the requirements of FERPA and this policy and receive training regarding compliance with FERPA and this policy.  If a student improperly accesses education records in violation of FERPA and this policy, that student may be terminated from his/her position and/or referred to the Office of Student Conduct.

E. University Systems

All administrative systems, applications, and programs, both free and purchased, which share, store, request or access student education records, including a student email address, must be approved by the Architecture Standards Committee as specified in University Policy Number 1307: Procurement and/or Development of Administrative Systems/Applications to meet the requirements of FERPA.

F. Training

All George Mason University employees who handle or have access to education records, including all instructional/research and administrative/professional faculty, must complete one FERPA training session upon employment and biennial training thereafter.

V. Forms

  • Consent to Release Student Information Form
  • Prevent Disclosure of Student Information Form
  • Request to Inspect Educational Records Form
  • Request to Amend Educational Records Form
  • HB1 Opt-In Form

VI. Responsibilities

The Office of the University Registrar will oversee training of University employees and other parties as required, and will serve as the point of contact for assisting employees and eligible students regarding FERPA related issues or concerns. Questions can be directed to:

Office of the University Registrar


Custodians of Educational Records: All employees named as a Custodian for educational records within their purview are responsible for assisting the Office of the University Registrar in complying with FERPA requests.

VII. Dates

A. Effective Date:

This policy will become effective upon the date of approval by the Senior Vice President for Administration and Finance and the Provost and Executive Vice President.

B. Date of Most Recent Review:


VIII. Timetable for Review

This policy, and any related procedures, shall be reviewed every three years or more frequently as needed and revised in accord with any changes made to the Family Educational Rights and Privacy Act.

IX. Signatures


Senior Vice President

for Administration and Finance

Provost and Executive Vice President

Date approved: December 13, 2018

Revised: March 5, 2021