Education Industry

FERPA-Compliant Data Destruction for Education

Witnessed destruction of student-record HDDs, financial-aid SSDs, and SIS backup tape for K-12 districts, colleges, universities, and education-services vendors. Methods follow NIST SP 800-88 r1. Certificate in 24 hours.

Call (866) 850-7977
  • 24-Hour Certificate of Destruction
  • Bonded & Insured Technicians
  • Continuous Chain of Custody
  • Methods follow NIST SP 800-88 r1
  • Witnessed Destruction

What FERPA Requires of Student-Record Disposal

Education data destruction satisfies two concurrent federal regimes. FERPA at 34 CFR §99.31(a)(6) requires educational institutions to protect personally identifiable information from student records, including during disposal. Higher-education institutions handling federal financial-aid data must additionally comply with the GLBA Safeguards Rule (16 CFR Part 314) as enforced by the U.S. Department of Education through Federal Student Aid Program Participation Agreements.

Three operational constraints define education destruction. First, Student Information System (SIS) drives, financial-aid platform drives, and learning-management system (LMS) drives are spread across central IT, departmental systems, and outsourced vendors — destruction must cover the full footprint with consistent FERPA documentation. Second, K-12 districts and higher-education institutions face state attorney-general inquiries on breach notification alongside FERPA enforcement. Third, the U.S. Department of Education’s FSA Program Compliance audit reviews financial-aid disposal as part of Title IV compliance.

Every job produces a Certificate of Destruction structured to satisfy FERPA enforcement-office review, GLBA examiner review for financial-aid-handling institutions, FSA Program Compliance audit evidence, and state attorney-general inquiry response. One destruction event, four audit-ready output formats.

Regulations Your Business Must Follow

FERPA 34 CFR §99.31(a)(6)
Educational institutions must protect personally identifiable information from student records, including during disposal. Documented destruction with chain-of-custody log is the FERPA-defensible disposal method. Our destruction methods follow NIST SP 800-88 r1.
GLBA Safeguards Rule 16 CFR Part 314.4(c)(8)
Higher-education institutions handling federal financial-aid data must implement secure disposal of customer information. The U.S. Department of Education enforces GLBA through Federal Student Aid Program Participation Agreements.
State Breach Notification Laws 50-state coverage
All 50 states require breach notification when student personal information is exposed. Documented destruction is the affirmative defense that student records were rendered unreadable before disposal.
State Public Records Retention State-specific schedules
Public K-12 districts and state-funded higher-education institutions are subject to state public records retention. Data Destruction Inc. retains destruction documentation for 10 years to satisfy the longest retention window in any state.
NIST SP 800-88 r1 Guidelines for Media Sanitization
The federal benchmark for media sanitization referenced by FERPA enforcement and GLBA examiners. Our destruction methods map to the Destroy category for HDDs, SSDs, flash, and magnetic tape.

What Education Buyers Face — and How We Solve It

  • Our FERPA enforcement-office inquiries focus on documentation.

    Every Certificate of Destruction is formatted to satisfy FERPA Family Policy Compliance Office inquiries — student-record asset inventory, destruction method, witness signatures, chain-of-custody reference, and FERPA 34 CFR §99.31(a)(6) conformance language.

  • Financial-aid platform drives carry GLBA-scope data.

    GLBA-scope drives (financial-aid platforms, work-study payroll systems, bursar systems) are inventoried with GLBA flag on the chain-of-custody log. The Certificate of Destruction includes GLBA Safeguards Rule 16 CFR §314.4(c)(8) conformance for financial-aid-handling assets.

  • SIS, LMS, and departmental drives are scattered across IT.

    Multi-system destruction workflow inventories Student Information System drives, learning-management system drives, financial-aid platform drives, and departmental-system drives on coordinated manifests. The Certificate of Destruction ties all originating systems to a single student-record destruction event.

  • State attorney-general inquiries can come after a breach.

    Certificate of Destruction format includes the state-attorney-general-requested fields (institution identification, asset inventory, destruction method, witness signatures, chain-of-custody reference). One document satisfies FERPA and state AG inquiries.

  • FSA Program Compliance reviews disposal as part of Title IV.

    The U.S. Department of Education's FSA Program Compliance audit reviews financial-aid disposal as part of Title IV compliance. Our destruction documentation is formatted to support FSA reviews alongside FERPA and state AG inquiries.

  • Outsourced education-services vendors share media with us.

    We accept vendor-returned media (testing-vendor drives, LMS-hosting vendor drives, SIS-platform RMA returns) under a chain-of-custody log that ties the asset back to the institution and the vendor. Cross-vendor destruction documentation consolidates on a master Certificate.

Audit Documentation You Receive

  • Certificate of Destruction

    Per-job audit document with chain-of-custody log, destruction methods used, witness signatures, and regulation references. Issued by Data Destruction Inc. within 24 hours.

  • Chain of Custody Log

    Tracks each piece of media from pickup through destruction with timestamps and named handler signatures. Required for audit defense.

  • Serialized Inventory

    Asset-by-asset inventory with serial numbers, manufacturer, model, and asset tag for every destroyed drive. Reconciled against the pickup manifest before destruction.

  • Witness Signatures

    Named-witness verification with printed names, signatures, dates, and times. Customer-witnessed at your facility or independent third-party witnessed at our destruction facility.

  • Insurance Certificate (on request)

    General liability and cyber liability coverage information for your records, audit team, or insurance broker.

  • FERPA + GLBA Disposal Conformance Memo

    Per-job FERPA and GLBA conformance memo citing 34 CFR §99.31(a)(6), 16 CFR §314.4(c)(8), destruction method applied, chain-of-custody reference, and FSA Program Compliance audit support. One document satisfies FERPA, GLBA, FSA, and state AG inquiries.

CoD

Certificate of Destruction

Issued by Data Destruction Inc. within 24 hours of destruction

Frequently Asked Questions

Do you sign a non-disclosure agreement or contract before pickup?
Yes. Data Destruction Inc. signs an NDA or vertical-specific contract with every education client before any pickup is scheduled. The document is delivered electronically within 4 business hours of quote acceptance and is countersigned before our truck is dispatched. Both parties retain the executed document for the full 10-year documentation retention period.

What does the Certificate of Destruction include for Education audits?
The Certificate of Destruction includes six audit fields: asset serial numbers, destruction method used, date and time of destruction, named witness signature, operator and company identification, and chain-of-custody reference number. Each field is populated within 24 hours of destruction. The certificate format is built to satisfy auditor, regulator, and insurance documentation requirements.

Can a education client witness the destruction?
Yes. Customer-witnessed destruction is available at your facility through our mobile shredding service, or you can send a representative to witness destruction at our facility. The witness signs the Certificate of Destruction with printed name, signature, and timestamp. Independent third-party witnessing is also available when required by your audit or insurance program.

What destruction methods do you use for education media?
We use shredding for HDDs (≤25 mm particle size), shredding for SSDs and flash media (≤2 mm particle size), and degaussing followed by shredding for magnetic backup tapes. Each method maps to NIST SP 800-88 r1 Destroy category for the specific media type. The method used for each asset is recorded on the Certificate of Destruction.

Does your documentation satisfy a FERPA FPCO inquiry?
Yes. Every Certificate of Destruction is formatted to satisfy FERPA Family Policy Compliance Office inquiries: student-record asset inventory, destruction method (NIST 800-88 r1 category), witness signatures, chain-of-custody reference, and 34 CFR §99.31(a)(6) conformance language. The format has been accepted in FERPA enforcement-office inquiries as evidence of disposal compliance for student records.

Do you handle financial-aid platform drives under GLBA?
Yes. GLBA-scope drives (financial-aid platforms, work-study payroll systems, bursar systems) are inventoried with GLBA flag on the chain-of-custody log. The Certificate of Destruction includes GLBA Safeguards Rule 16 CFR §314.4(c)(8) conformance for financial-aid-handling assets, supporting U.S. Department of Education FSA Program Compliance audits alongside FERPA inquiries.

Can you destroy SIS, LMS, and departmental drives on a coordinated manifest?
Yes. Multi-system destruction workflow inventories Student Information System drives, learning-management system drives, financial-aid platform drives, and departmental-system drives on coordinated manifests. The Certificate of Destruction ties all originating systems to a single student-record destruction event while preserving per-system line items for institutional audit reconciliation.

How do you support a state attorney-general inquiry after an incident?
Certificate of Destruction format includes the line items state attorney-general offices request during breach inquiries: institution identification, asset inventory, destruction method, witness signatures, chain-of-custody reference, and FERPA/GLBA conformance memos. One document satisfies the federal FERPA inquiry and the state AG inquiry in parallel, with both reviews citing the same underlying destruction event.

Explore More

Related Industries

Compliance Resources

Our Services

Ready to destroy education data securely?

Bonded · Insured · 24-Hour Certificate of Destruction · Methods follow NIST SP 800-88 r1

Call (866) 850-7977