What Does FERPA Actually Require When Schools Retire Devices?

Every school technology refresh eventually creates the same question: What happens to the student data that may remain on thousands of Chromebooks, laptops, tablets, servers and other retired devices?

The answer often gets reduced to a vague instruction to choose a “FERPA-compliant” recycler. But FERPA does not certify IT asset disposition providers, mandate a particular wiping product, or prescribe one universal retirement process. What FERPA does is protect the privacy of student education records. When those records may be stored on retired technology, districts need a defensible process that prevents unauthorized access or disclosure throughout collection, transportation, sanitization, resale and recycling. Understanding the difference between what FERPA requires and what responsible IT asset disposition looks like can help districts make better decisions without relying on misleading compliance claims.

The short answer: FERPA does not establish a technical device-disposal standard. It requires districts to protect personally identifiable information from education records against unauthorized disclosure. 

This article provides general educational information and should not be treated as legal advice. Districts should also consider applicable state laws, records-retention schedules, board policies, contracts and guidance from legal counsel.

What Does FERPA Protect?

The Family Educational Rights and Privacy Act, commonly known as FERPA, is a federal law protecting the privacy of student education records. It generally applies to schools and educational institutions receiving funding through programs administered by the U.S. Department of Education.

Under FERPA, an education record is a record that is:

• Directly related to a student; and
• Maintained by an educational agency or institution, or by a party acting for that agency or institution.

In other words, FERPA protects student records, not Chromebooks, hard drives, or other physical objects. A retired device becomes relevant to FERPA when it contains personally identifiable information from education records.

Depending on how the device was used, that information could include:

• Grades and assessment results
• Attendance and enrollment information
• Student identification numbers
• Individualized Education Programs and other special-education records
• Communications between students, parents and school personnel
• Locally stored documents and downloaded files
• Cached information from student information systems or learning platforms
• Photos, videos or audio files directly related to identifiable students
• Saved credentials or other information that could provide access to education records

Not every piece of information on a school-owned device is automatically an education record. However, districts should not assume that deprovisioning a device, disabling an account or removing it from inventory also removes the information stored locally.

Does FERPA Establish a Device-Disposal Standard?

No. FERPA does not prescribe a particular sanitization method, software platform, certification or documentation format for retired devices.

The U.S. Department of Education’s own Best Practices for Data Destruction states that FERPA does not provide specific technical requirements governing data destruction for data maintained by educational institutions. It instead requires educational agencies and institutions to safeguard protected information from unauthorized disclosure.

FERPA provides the legal privacy obligation. Standards such as NIST SP 800-88 Rev. 2 and certifications such as R2v3 help organizations build the operational controls needed to manage that obligation responsibly.

Why Retired Devices Still Present a FERPA Risk

Powering off a device does not erase its data. Neither does placing it in a storage room, removing it from a mobile device management platform or marking it retired in an asset-management system. Until the data has been appropriately sanitized or the storage media has been destroyed, information may remain recoverable.

That creates several potential failure points during a device-retirement project:

• Devices may leave a school without an accurate serialized inventory.
• Equipment may be transported without a documented chain of custody.
• A reset or deprovisioning action may be mistaken for verified sanitization.
• Failed or damaged drives may bypass the normal wiping process.
• Devices may be resold before data removal has been confirmed.
• Storage media may enter an undocumented downstream recycling channel.
• The district may receive no asset-level evidence showing what happened to its equipment.

FERPA does not provide a step-by-step ITAD workflow for preventing these outcomes. The district is responsible for establishing reasonable policies and controls appropriate to the information, equipment and risks involved.

Does FERPA Protection End When a Student Leaves the District?

Not automatically. Education records do not stop being education records merely because a student graduates, transfers or otherwise leaves the institution. If the district continues to maintain qualifying education records, FERPA may continue to govern their use and disclosure. However, that does not mean FERPA requires every piece of student information to be retained or protected forever. FERPA generally does not establish a universal retention period for education records.

Retention requirements may instead come from:

• State and local records-retention schedules
• District or board policies
• Grant and funding requirements
• Contractual obligations
• Litigation holds
• Other federal or state laws

FERPA also prohibits an institution from destroying education records while there is an outstanding request from a parent or eligible student to inspect and review them. A district should therefore apply its authorized retention schedule before destroying records, not assume either that all records must be kept indefinitely or that old records can be erased without review.

Can an ITAD Provider Receive Devices That Have Not Yet Been Sanitized?

Potentially, but the relationship must be structured carefully. FERPA permits certain contractors and other outside parties performing outsourced institutional services to be treated as school officials when specific requirements are satisfied. Among other things, the provider must:

• Perform an institutional service or function for which the district would otherwise use employees;
• Operate under the district’s direct control regarding the use and maintenance of education records;
• Use the information only for the authorized purpose;
• Follow FERPA’s restrictions on use and redisclosure; and
• Meet the criteria established in the district’s annual FERPA notification for a school official with a legitimate educational interest.

Whether a particular vendor relationship satisfies those conditions depends on the facts, the district’s policies and the governing agreement. A contract should clearly address custody, permitted use, security, sanitization, incident response, downstream handling and final destruction of any remaining data.

Districts should be wary of two opposite but equally misleading claims:

• That FERPA always prohibits a district from transferring unsanitized devices to an outside provider; or
• That hiring any recycling company automatically makes the transfer permissible.

What Is the Role of NIST SP 800-88 Rev. 2?

The National Institute of Standards and Technology’s Guidelines for Media Sanitization, NIST SP 800-88 Rev. 2, provides a risk-based framework for making data on storage media infeasible to access.

NIST organizes media sanitization into three broad methods:

• Clear: Applies logical techniques that sanitize data against ordinary recovery methods while allowing the media to remain usable.
• Purge: Uses stronger logical or physical techniques to make recovery infeasible even with advanced laboratory methods while potentially preserving the media for reuse.
• Destroy: Physically damages the media so it cannot be reused as storage and data recovery is infeasible.

The appropriate method depends on factors such as:

• The type of storage media
• The sensitivity of the information
• The capabilities of the device
• The condition of the media
• Whether the sanitization result can be verified
• Whether the equipment will be reused, resold or recycled

Physical destruction is not automatically the safest or most responsible answer for every functioning device. When an approved sanitization method can be performed and verified, preserving the device for reuse or resale may protect the data while retaining economic value. When sanitization cannot be completed or verified, physical destruction may be the appropriate path.

What Should a Defensible Device-Retirement Process Include?

A strong process should address the complete journey of each asset rather than treating data wiping as an isolated technical task.

1. Establish an Accurate Inventory

The district and its ITAD provider should agree on how equipment will be identified and reconciled. Relevant information may include:

• Asset tag
• Serial number
• Manufacturer and model
• Device type
• Storage-media type
• Functional condition
• Assigned location
• Final disposition

Serialized tracking helps identify missing equipment, document exceptions and connect each asset with its sanitization or destruction outcome.

2. Preserve a Documented Chain of Custody

Districts should know who controlled the equipment at each stage of the project. Chain-of-custody documentation may include pickup locations, dates, quantities, transportation details, receiving confirmation and any discrepancies discovered during reconciliation.

3. Select the Appropriate Sanitization Method

The process should account for the device, storage technology, information sensitivity, condition and intended disposition. A method that works for one type of storage media may not be appropriate for another. Sanitization procedures should be current, repeatable and aligned with an established standard such as NIST SP 800-88 Rev. 2.

4. Verify the Result

Attempting a wipe is not the same as confirming that it succeeded. A defensible process should identify failed sanitization attempts and prevent affected devices from proceeding to reuse or resale. Equipment that cannot be successfully sanitized should be routed to an approved physical-destruction process.

5. Document Erasure, Destruction and Final Disposition

Documentation should allow the district to reconcile the original inventory with the completed project.

Depending on the engagement, final reporting may include:

• Serialized inventory
• Chain-of-custody records
• Sanitization results
• Certificates of erasure
• Certificates of physical destruction
• Recycling documentation
• Resale and value-recovery reporting
• Exception records
• Final disposition reports

FERPA does not prescribe one certificate format. The purpose of documentation is to provide reliable evidence that the district’s approved process was followed.

6. Evaluate Downstream Responsibility

Data security is not the only concern when devices reach the end of their useful life. Nonfunctional equipment and destroyed storage media should enter a responsible recycling process with documented downstream controls. Vendor certifications do not replace the district’s own due diligence, but independently audited standards can help districts evaluate whether a provider has established processes for data security, environmental responsibility and material tracking.

How Vantage Point ITAD Handles Retired Education Technology

Vantage Point ITAD performs data sanitization in-house after equipment arrives at our facility.

Our data-sanitization process is formally aligned with NIST SP 800-88 Rev. 2 across our equipment and workflows. We select the appropriate sanitization technique based on the type and condition of the media, the project requirements and the need to protect data while preserving residual value whenever possible. Equipment that can be securely sanitized and verified may remain eligible for resale or reuse. When data cannot be successfully erased and verified, the affected storage media is physically shredded and routed through our responsible recycling process.

Project documentation can include serialized inventories, chain-of-custody records, certificates of erasure or destruction and final disposition reporting. Equipment and shredded materials designated for recycling are managed through our R2v3-certified process and transferred to qualified downstream partners for final recycling. This approach allows districts to protect student information, document what happened to their equipment and recover value from reusable technology instead of unnecessarily destroying functional assets.

Frequently Asked Questions About FERPA and Retired School Devices

• Does FERPA require schools to wipe Chromebooks before disposal?

FERPA does not mandate a specific Chromebook-wiping procedure. It does require districts to safeguard personally identifiable information from education records against unauthorized disclosure. Districts should therefore ensure that any protected data remaining on retired Chromebooks is appropriately sanitized or destroyed before the equipment is released for unrestricted reuse, resale or recycling.

• Is deprovisioning or performing a factory reset enough?

Not necessarily. Deprovisioning removes a device from management but does not automatically prove that all locally stored data has been sanitized. Whether a reset is sufficient depends on the device, storage architecture, information involved and the district’s approved sanitization procedure. The completed result should be verified and documented.

• Does FERPA require physical destruction of every school hard drive?

No. FERPA does not require universal physical destruction. When an appropriate sanitization technique can be successfully completed and verified, a functioning drive or device may remain eligible for reuse or resale. Physical destruction is appropriate when data cannot otherwise be reliably sanitized.

• Does FERPA require districts to follow NIST SP 800-88?

FERPA does not specifically mandate NIST SP 800-88. However, NIST SP 800-88 Rev. 2 provides authoritative, current guidance for establishing and performing a media-sanitization program. Districts can use it to translate FERPA’s privacy obligations into defensible technical procedures.

• Does FERPA require certificates of erasure or destruction?

FERPA does not prescribe a particular certificate. Certificates and serialized reports are nevertheless valuable because they document that equipment completed the approved sanitization or destruction process.

• Can a district send devices containing student data to an ITAD provider?

Potentially. An outside provider may qualify as a school official under FERPA when the applicable requirements are satisfied, including direct district control over the use and maintenance of the records and restrictions on use and redisclosure. Districts should address those obligations through appropriate policies, vendor evaluation and contractual controls.

• Does FERPA protect student records forever?

FERPA protections do not automatically disappear when a student leaves the district, but FERPA does not require schools to retain every education record indefinitely. Districts should follow applicable retention schedules and must not destroy records while a valid request to inspect them remains outstanding.

• Is an R2v3-certified provider automatically “FERPA compliant”?

No certification automatically guarantees FERPA compliance. R2v3 certification demonstrates audited controls related to electronics reuse, recycling, data security and downstream accountability. Those controls can support a district’s responsible ITAD process, but FERPA compliance depends on the complete set of policies, agreements and practices surrounding the education records.

Planning a Large Device Retirement?

Thousands of ESSER-funded Chromebooks and other student devices are now approaching the end of their useful lives. Our ESSER Fleet Retirement Guide explains how districts can begin planning for inventory, logistics, data sanitization, value recovery and responsible recycling.

Download the ESSER Fleet Retirement Guide

Vantage Point ITAD helps schools and districts manage the complete technology-retirement process from packaging and transportation to data sanitization, resale, and responsible recycling.