Data management in higher education: Student Data Rules
The Student Data Rules carries 4 published figures read from 2 sources' own pages, from 30 to 180 day, read 17 October 2026.
Enrolvo sells its own paid plan in this category (our pricing). It is not counted here: every figure in this index is another provider's own published price, read from its own page.
2 of the 12 named sources read in full publish a figure; 10 publish none, read 17 October 2026.
By duty
| Breakdown | Median | Range | Sources |
|---|---|---|---|
| dutyaccess-to-records | 45day | 45 to 45day | 1 |
| dutyrecord-of-disclosures | 30day | 30 to 30day | 1 |
| dutyconflict-notice | 45day | 45 to 45day | 1 |
| dutycomplaint-window | 180day | 180 to 180day | 1 |
| dutyregistration-fee | 40GBP | 40 to 40GBP | 1 |
Every figure, with its source
One row per source: the figure the source's own page publishes, the page, and the day it was read. A figure that is not on a page we read is not on this one.
| Source | Figure | Breakdown | Read |
|---|---|---|---|
| eCFR 34 CFR Part 99 (FERPA) | 180day | complaint-window | 2026-10-03 |
| eCFR 34 CFR Part 99 (FERPA) | 45day | access-to-records | 2026-10-03 |
| eCFR 34 CFR Part 99 (FERPA) | 45day | conflict-notice | 2026-10-03 |
| ICO data protection fee, education sector | 40GBP | registration-fee | 2026-10-17 |
| eCFR 34 CFR Part 99 (FERPA) | 30day | record-of-disclosures | 2026-10-03 |
The sentence each figure was read from (5)
- eCFR 34 CFR Part 99 (FERPA), read 2026-10-03:
(c) A timely complaint is defined as an allegation of a violation of the Act that is submitted to the Office within 180 days of the date of the alleged violation or of the date that the complainant knew or reasonably should have known of the alleged violation.
- eCFR 34 CFR Part 99 (FERPA), read 2026-10-03:
(b) The educational agency or institution, or SEA or its component, shall comply with a request for access to records within a reasonable period of time, but not more than 45 days after it has received the request.
- eCFR 34 CFR Part 99 (FERPA), read 2026-10-03:
If an educational agency or institution determines that it cannot comply with the Act or this part due to a conflict with State or local law, it must notify the Office within 45 days, giving the text and citation of the conflicting law.
- ICO data protection fee, education sector, read 2026-10-17:
If you are a registered charity, you would only pay the lowest fee tier of £40.
- eCFR 34 CFR Part 99 (FERPA), read 2026-10-03:
(iii) Upon request of an educational agency or institution, a State or local educational authority or Federal official or agency listed in § 99.31(a)(3) that maintains a record of further disclosures under paragraph (b)(2)(i) of this section must provide a copy of the record of further disclosures to the educational agency or institution within a reasonable period of time not to exceed 30 days.
Read in full, publishes no figure
10 named sources were read in full on the dates shown and print no usable figure. They are counted, never filled in.
- eCFR 34 CFR Part 99 Subpart D (disclosure), read 2026-10-17: every candidate on the page was refused
- eCFR 34 CFR Part 98 (PPRA), read 2026-10-17: read in full and no accepted figure on the page
- US ED Student Privacy Policy Office, What is FERPA?, read 2026-10-03: read in full and no accepted figure on the page
- US ED Student Privacy resources, read 2026-09-12: read in full and no accepted figure on the page
- Data Protection Act 2018 (UK), read 2026-10-17: read in full and no accepted figure on the page
- DfE data protection toolkit for schools, read 2026-09-12: read in full and no accepted figure on the page
- OAIC privacy guidance for organisations, read 2026-09-12: every candidate on the page was refused
- Office of the Privacy Commissioner of Canada, privacy topics, read 2026-09-26: read in full and no accepted figure on the page
- ICO guidance for schools, universities and colleges, read 2026-10-17: read in full and no accepted figure on the page
- ICO children's information guidance, read 2026-10-17: read in full and no accepted figure on the page
Methodology
Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).
2 of the 12 named sources that could be read published a usable figure; 10 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere.
The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in day (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 4 figures, never sentences; 9 candidate sentence(s) were refused by a reviewer with the reason recorded.
The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per jurisdiction per duty - who may see a student record, what consent is required, what notice must be given, how long records are kept, what a breach obliges and by when - quoted verbatim from the regulation with its effective date; the cross-jurisdiction comparison (which regimes give a right of access to the parent versus the student, which set a breach deadline in hours) is the figure, and the changed-since is the amendment, which is what makes a data-management page worth re-reading
9 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.
Sources (12)
- eCFR 34 CFR Part 99 (FERPA)(the publisher's own terms; quoted for reporting and comment)
- eCFR 34 CFR Part 99 Subpart D (disclosure)(the publisher's own terms; quoted for reporting and comment)
- eCFR 34 CFR Part 98 (PPRA)(the publisher's own terms; quoted for reporting and comment)
- US ED Student Privacy Policy Office, What is FERPA?(the publisher's own terms; quoted for reporting and comment)
- US ED Student Privacy resources(the publisher's own terms; quoted for reporting and comment)
- Data Protection Act 2018 (UK)(the publisher's own terms; quoted for reporting and comment)
- DfE data protection toolkit for schools(the publisher's own terms; quoted for reporting and comment)
- OAIC privacy guidance for organisations(the publisher's own terms; quoted for reporting and comment)
- Office of the Privacy Commissioner of Canada, privacy topics(the publisher's own terms; quoted for reporting and comment)
- ICO guidance for schools, universities and colleges(the publisher's own terms; quoted for reporting and comment)
- ICO children's information guidance(the publisher's own terms; quoted for reporting and comment)
- ICO data protection fee, education sector(the publisher's own terms; quoted for reporting and comment)
Cite or embed this figure
Cite or embed this figure
The Student Data Rules carries 4 published figures read from 2 sources' own pages, from 30 to 180 day, read 17 October 2026.
2 of the 12 named sources read in full publish a figure; 10 publish none, read 17 October 2026.
Student Data Rules, duty access-to-records: median 45 day across 1 source, read 17 October 2026.
Student Data Rules, duty record-of-disclosures: median 30 day across 1 source, read 17 October 2026.
Student Data Rules, duty conflict-notice: median 45 day across 1 source, read 17 October 2026.
Student Data Rules, duty complaint-window: median 180 day across 1 source, read 17 October 2026.
Student Data Rules, duty registration-fee: median 40 GBP across 1 source, read 17 October 2026.
Cite as: "Enrolvo Student Data Rules", updated 2026-10-18, https://enrolvo.com/datasets/student-data-rules/.
Download the CSV (5 rows, computed 2026-10-18)