What Counselors Need to Know About FERPA and Career Assessment Data

If a tool collects a student's name and links it to their assessment results, those results are an education record under FERPA — the same category as grades and attendance. That has real implications for how a school evaluates and deploys any career discovery platform, not just InFocus.

Three questions to ask any vendor

Who can access the data, and how is that enforced? Access should be scoped by role and by school — a counselor at one building shouldn't be able to pull up students at another, and that boundary should be enforced at the infrastructure level, not just hidden by the UI.

Is there a signed Data Processing Agreement? A DPA is what makes a vendor a "school official" under FERPA's exception for legitimate educational interest, rather than a third party the district would need separate parental consent to share records with. If a vendor can't produce one, that's a stop-the-process question.

What's the retention and deletion policy? Districts need the ability to export a student's full record and to request deletion — and a documented retention period rather than an indefinite one.

What this looks like in practice

Every school on InFocus signs a DPA before any student data is created, enforced at the middleware level so it can't be bypassed by going around a specific page. Every access to a student record — view, export, deletion request — writes to an append-only audit log. Data is scoped per school by default, with no path for one school's data to be queried alongside another's.

None of this should be a differentiator. It should be the floor. Ask about it anyway.