PPRA: Which Institutions and Students It Covers

For ppra: which institutions and students it covers, think in terms of a chain: a student, a survey response, a purpose, an authorization, a recipient, a safeguard and a retention date. Break any link and the sharing fails, even if every other link is sound. This guide walks that chain link by link, so the reader can see exactly where a proposed sharing holds and where it breaks.

Personal survey topics require the highest standard of notification and permission, since the injury of an unwanted disclosure is greatest there.

Redisclosure is its own decision: a receiver who lawfully received a record might not pass it on unless a requirement or consent covers that second sharing.

State law can add duties on top of federal law, and an university operating in several states must track the strictest applicable requirement for each file.

Proctoring tools collect some of the most sensitive data on campus, and their adoption needs a higher standard of review than a routine classroom tool.

Third-party tools connected to a learning system may receive more data than the integration was meant to pass, and the actual data flow should be tested, not assumed.

Former students retain rights over files held regarding them, and alumni processes ought not to treat those files as unprotected history.

Library systems hold borrowing and access information that can reveal interests and beliefs, and that information should not be treated as low sensitivity by default.

Advising platforms hold some of the most personal narrative information on site, because advisers record context that grades alone never show.

Platforms that feed directory information to outside directories need an opt-out verify built into the feed, not added as a manual afterthought.

Accessibility information in a learning platform may reveal disability status, and access to it should be limited to employees who need it for support.

Handle transfer and withdrawal files with care, since a student's rights over files previously held do not end when enrolment ends.

Audit AI tools for data retention, prompt handling and output storage, since AI systems create records that routine audits miss.

Set security baselines before a new platform launches, since retrofitting safeguards following adoption rarely restores information previously shared.

Retain inventories current, and treat an inventory that is a year out of date as no inventory at all.

Run confidentiality impact assessments for new platforms, and keep the assessment with the procurement record, not in a separate folder nobody opens.

Read exceptions narrowly and on their own terms, and do not stretch an exemption to cover a purpose that merely resembles the named one.

Identify the authority before the information moves, not following, since retrospective authority is usually no authority at all.

Bound accrediting disclosures to the scope of the exception, and send only what the accreditation objective requires.

Consider an education app for younger students that tracks behavior across sessions and shares aggregates with a third party, without a confidentiality review.

In that illustration the platform shall retain grades, attendance and advising notes, but the college excludes sensitive comments from the export and keeps them in the existing system.

In that illustration the faculty member pauses, the privacy officer reviews the tool, and the course adopts a tool whose contract excludes training use.

In that illustration the removal is logged, and the office may demonstrate a reviewer that the schedule was followed.

The contract in that illustration names the data, limits use to the institution's purposes, bans advertising use, and sets removal ninety days following the contract ends.

Punishing escalation is an error, because employees who are punished for asking shall stop asking and start deciding quietly.

Answering a complaint regarding denied access without reasons is an error, since an unexplained refusal cannot be challenged or learned from.

Delaying deletion of children's data following a deletion request is an error, because the data continues to be used while the request waits.

This guide does not substitute for a college's own policies or counsel, and a conflict between the two should be resolved in favour of the college's own advice.

A reader who applies that structure, and who escalates the cases it can not settle, will make better decisions than a reader who memorises any single rule in this ledger.