Which Federal Regulation or Law Governs How Researchers Can Obtain Data About Subjects' Disciplinary Status in School From Academic Records

The federal law that governs how researchers can obtain data about subjects' disciplinary status from academic records is the Family Educational Rights and Privacy Act (FERPA), codified at 20 U.S.C. § 1232g and implemented by the Department of Education at 34 C.F.R. Part 99. FERPA treats student disciplinary records as "education records" when the institution maintains them, and it controls disclosure to outside researchers through the written-consent rule and the "studies" exception at 34 C.F.R. § 99.31(a)(6). Institutional review boards, state law, and the Protection of Pupil Data rules layered on top.

Education records and the disciplinary-status mechanism

FERPA's definition of "education records" is the hinge on which everything turns. Under 34 C.F.R. § 99.3, education records are records directly related to a student and maintained by the institution or a party acting for it. Disciplinary files held by a school, a dean of students office, or a student conduct database are maintained records about an identifiable student, so they qualify. The statute then bars federal funding recipients from disclosing personally identifiable information from those records without written consent from a parent or an eligible student (one who has reached 18 or enrolled in postsecondary education).

The mechanism matters because it is a funding condition, not a standalone privacy statute with its own enforcement agency. Congress attached it to federal education funding under 20 U.S.C. § 1232g(b)(1). A school that discloses improperly risks losing federal funds, which is why compliance offices treat FERPA conservatively. For researchers, the practical consequence is that a school cannot simply hand over a discipline spreadsheet because a study sounds worthwhile.

The studies exception exists because Congress recognized that some research serves the institution's own legitimate interests. Section 99.31(a)(6) permits disclosure without consent to organizations conducting studies for or on behalf of the institution, provided the study is directed at developing, validating, or administering predictive tests, administering student aid programs, or improving instruction. That list is narrow, and disciplinary-status research often has to be framed carefully to fit it.

There is one clean path that avoids the exception entirely: de-identified data. Records stripped of all personally identifiable information, including indirect identifiers that could re-identify a subject, fall outside FERPA's disclosure restrictions. A researcher who only needs aggregate discipline rates by grade, offense category, or school can often obtain that under a data-use agreement without triggering consent requirements.

What the studies exception actually requires

The studies exception is not a broad research exemption, and this is where thin explainers mislead. Section 99.31(a)(6) imposes several conditions in sequence, and missing any one of them converts a permissible disclosure into a violation.

First, the study must be conducted for or on behalf of the educational agency or institution. A researcher who approaches a district cold, with no institutional sponsorship, is not automatically covered. Second, the disclosure must be limited to the purpose stated in a written agreement. Third, the recipient must use the data only for the stated purpose and destroy it when no longer needed. Fourth, the institution must retain direct control over the data and maintain a record of the disclosure under § 99.32.

The written agreement is the load-bearing document. The Department of Education expects it to specify the purpose and scope of the study, how data will be used and protected, a destruction timeline, and who at the institution retains oversight. Researchers who treat this as a formality discover at audit that the agreement defines what they were authorized to see. A discipline dataset disclosed under an agreement limited to "improving school climate" cannot later support a paper on disparate suspension rates unless that purpose was written in.

The data-destruction clause is the provision most often overlooked. The regulation ties continued access to the ongoing need for the data. When the study ends, the data must be destroyed. Researchers who archive discipline data indefinitely, intending to reuse it for a later paper, are outside the exception. The safe approach is to negotiate a destruction date that matches the funded period and to build an analysis plan before the data arrive.

Quantified context and enforcement reality

FERPA applies to every educational agency or institution receiving federal funds, which covers essentially all public school districts and the overwhelming majority of private institutions that participate in federal programs. That is more than 13,000 school districts and roughly 98,000 public schools in the United States. The Department's Student Privacy Policy Office administers the law and receives complaints; the office publishes an annual report to Congress, and complaint volume is tracked against a multi-year backlog rather than a fixed statutory deadline.

Enforcement is skewed toward complaint-driven investigation rather than proactive audit. The Department can require a school to remediate, and in serious cases it can withhold funds, though the withholding sanction is used rarely and is closer to leverage than a routine outcome. That asymmetry produces the counterintuitive detail researchers should internalize: the binding constraint on access is usually not the federal statute but the district's legal counsel, whose risk calculus is set by the low-probability, high-cost tail of a complaint.

Timelines vary widely and there is no statutory clock on a data-sharing agreement. A district with a dedicated research office may execute a data-use agreement in 4 to 8 weeks. A district with one general counsel and no research liaison can take 6 months or longer, and requests are frequently declined for reasons that never reach a formal FERPA analysis.

Edge cases that change the answer

Several situations pull disciplinary data out of the ordinary path or place it under a second regime simultaneously.

The postsecondary separation is the most important boundary. FERPA applies to disciplinary records held by colleges in the same way, but the campus security and crime statistics rules that look related come from a different statute. Researchers who assume one compliance office covers both discover that they need separate agreements.

Juvenile justice interactions create a genuine puzzle. Discipline records that document an arrest or a referral to juvenile authorities may fall outside FERPA entirely, because certain law enforcement unit records maintained by a school resource officer are excluded from the education-records definition under § 99.8. If the researcher's only exposure to the subject is through a law-enforcement channel, the analysis shifts to state juvenile confidentiality law, which varies enormously.

Data protections under the Protection of Pupil Rights Amendment (PPRA) apply to surveys and certain data collection funded by the Department, and can restrict asking students about disciplinary background. State school-records statutes in states like California, Washington, and Massachusetts impose stricter disclosure limits than FERPA, and the stricter rule controls. Special education records intersect with the Individuals with Disabilities Education Act, which adds consent and access conditions on discipline documentation for students with IEPs. Institutional review boards can approve a study that is still FERPA-illegal; IRB approval is necessary but not sufficient, and investigators routinely conflate the two. Parents retain FERPA rights until the student turns 18 or enters postsecondary education, so consent signatures must come from the right party.

The counterintuitive detail worth stating plainly: retrospective research on adult former students can still be blocked. If the records were created when the subjects were minors, and the institution has not classified them as eligible students for disclosure purposes, the historical discipline files may remain parent-controlled.

Table 1: Comparison of data-access pathways

The table's message is that no single row is universal. Most discipline-status studies combine rows: de-identified aggregate data for descriptive analysis, plus a studies-exception agreement for any linked individual-level records.

Timeline table: the actual path from request to data

Misconceptions that cause real problems

The most common misconception is that FERPA forbids research access to discipline records. It does not. It forbids disclosure without consent unless a specific exception applies, and the studies exception was written to enable exactly this kind of work.

A second misconception is that de-identified data is always safe. Re-identification through small cells is a real risk. A discipline table broken down by grade, race, disability status, and offense in a school of 300 students can leave cells of one or two. The Department treats deductive disclosure as a privacy failure even when direct identifiers are absent.

A third is that IRB approval equals compliance. The IRB reviews ethics and risk; the district's FERPA officer reviews legal authority to disclose. Investigators who arrive with an approval letter and no agreement often find the process reset to zero.

A fourth is that discipline records are categorically outside education records because they feel quasi-legal. Outside a genuine law-enforcement unit exception, the opposite is true: the school maintains them, so they are in.

Practical actions for researchers

Start with the data minimization decision before contacting anyone. Determine the minimum granularity you need, because every additional variable increases the re-identification exposure and the district's hesitation.

Draft the purpose clause to match a specific enumerated purpose in § 99.31(a)(6), and quote the regulation language rather than paraphrasing it. Ask the district whether a research liaison or data governance committee exists; route the request there, not to the records clerk. Propose a destruction date at least 30 days after the final analysis milestone and offer to certify destruction in writing. Request the disclosure record that the institution must maintain under § 99.32, and confirm you will receive a copy for your files. Test every planned table for small-cell counts below a threshold you agree on, commonly fewer than 10 students in a cell, before requesting extraction. If juvenile justice or IEP documentation is involved, ask separately whether the state statute imposes a stricter rule and get the answer in writing.

On the timeline side, plan for a 3 to 6 month lead time on individual-level discipline data and 4 to 8 weeks for aggregate requests. Build an analysis plan and a table shell before the agreement is signed; the drafting conversation goes faster when you can show exactly which cells you need.

Limitations and how to read this

FERPA's statutory text and implementing regulations are stable, but state overlays are not, and they are revised more frequently than the federal rule. The practical effect is that a pathway that worked in one state may be blocked in another for reasons that have nothing to do with the Department of Education. None of the process descriptions here substitute for a review of your institution's specific written agreement, your state's records statute, and the advice of a qualified education-law attorney. The mechanisms described are general and may be modified by contract terms, state law, or institutional policy in ways this article cannot anticipate.

Disclaimer: This article is general educational information about federal student-records law, not a legal opinion and not a compliance determination for any specific study or institution. FERPA analysis is fact-specific, and state law often imposes stricter requirements than the federal rule. Consult a qualified education-law attorney or your institution's privacy office before requesting, receiving, or disclosing disciplinary records.