What do FERPA and university policy require when I collect mentee data for a campus program?

If your mentees are students enrolled at the institution running the program, then yes, most of what you collect on the application is very likely an education record under FERPA, and it is protected the moment it lands in your file. FERPA, the Family Educational Rights and Privacy Act, covers records that are directly related to a student and maintained by an educational agency or institution or by a party acting for it. A mentoring application with a name, a student ID, a major, a graduation year and a short essay about career goals meets that description comfortably.

What that means in practice is narrower than most coordinators fear and stricter than most volunteer programs actually behave. You can still run the program. You can still match people. What you cannot do is treat the applicant pool as a general contact list, hand rosters to outside volunteers without a basis for it, or move the data into a tool the institution has never reviewed.

The three questions worth settling before intake opens are these: who inside the institution may see this, what may be released outside it, and under what authority does anything leave the building. Everything below is a way of answering those three.

When mentoring application data becomes an education record

Two conditions have to be true. The record must be directly related to a student, and it must be maintained by the institution or someone acting on its behalf. A campus program run out of the alumni office, a college's advising unit or a student affairs department satisfies the second condition on the day the first application is submitted.

The practical trigger is enrollment, not funding. A program funded entirely by a corporate sponsor, staffed by volunteers and administered inside a university department is still handling education records if the mentees are enrolled students. Conversely, an association program whose mentees happen to be students but which is run by an outside nonprofit with no institutional relationship is generally outside FERPA, though state privacy law and your own contracts still apply.

Where the line gets blurry

Mixed cohorts are the common headache. If half your mentees are enrolled undergraduates and half are recent graduates, you are holding two categories of record in one spreadsheet. The workable answer is to protect the whole file at the stricter standard rather than trying to apply different handling rules row by row. Sorting by enrollment status at the moment of a disclosure is where mistakes happen.

Note also that your own notes count. Meeting logs, coordinator comments about a pair that is not working, and a note that a mentee withdrew mid term are all directly related to an identifiable student and maintained by the program. They are records. Write them as if the student could request to see them, because a student may request to inspect their education records.

Keep reading: How did one professional association rebuild a mentoring program that had lost half its mentors?

Directory information and what you still cannot publish

Each institution designates its own directory information and publishes that designation in an annual notification. Typical items include name, enrollment status, major field of study, dates of attendance, degrees and awards, and participation in officially recognized activities. Directory information may generally be disclosed without written consent, unless the student has filed a request to withhold it, usually called a FERPA block or privacy hold.

This matters more than it sounds, because two things follow.

• Your institution's list is the only list that governs. Do not work from a general list you found online. Ask the registrar for the current designation in writing and keep the copy.
• Blocks are live. A student who filed a privacy hold after applying to your program should not appear in a public cohort announcement. That means checking the block status against the registrar before publication, not once at intake.

And what almost never counts as directory information: the essay, the goals, the salary question if you asked one, the disability or accommodation disclosure, the reason someone wants a mentor. Those are the fields most likely to end up in a celebratory newsletter and the ones least defensible there. A quote from a mentee's application requires written consent, full stop, no matter how flattering it is.

Legitimate educational interest and sharing rosters with volunteer mentors

FERPA permits disclosure without consent to school officials with a legitimate educational interest, as defined in the institution's own annual notification. Faculty, staff and certain contractors can be school officials. The question is whether your mentors are.

Alumni volunteers with no institutional role usually are not. Faculty and staff mentors usually are. An adjunct mentoring outside their teaching duties sits somewhere uncomfortable in between and should be settled by your counsel, not by you.

The design consequence is simple and it is the single most useful rule in this article: give an outside mentor only the information their assigned mentee has consented to share, and give it only for that mentee. No cohort roster. No spreadsheet of the unmatched pool. No forwarded application PDF for a mentee who was assigned to someone else. If a mentor asks to browse candidates and pick, redesign the process rather than the disclosure.

Keep reading: Are employers still funding women's mentoring programs, and what are they asking for in return?

Written consent: what a usable release actually says

A FERPA consent must be signed and dated, and must specify the records to be disclosed, the purpose of the disclosure, and the party to whom the disclosure may be made. An electronic signature is acceptable if the institution can authenticate it. A checkbox on a form that says "I agree to participate" is not a release.

A release that will survive review names each element rather than gesturing at categories. Something along these lines, adapted with your counsel:

Consent element	Weak version	Usable version
Records	My program information	My name, class year, major, career interest fields and the two short answer responses in my application
Purpose	Program administration	To be matched with and introduced to a mentor, and to allow that mentor to prepare for our meetings
Recipient	Program partners	The individual volunteer mentor assigned to me, and program staff in the Office of Alumni Engagement
Duration	Ongoing	The 2026 to 2027 program year, ending June 30, 2027
Withdrawal	Not mentioned	I may revoke this in writing; revocation is not retroactive to disclosures already made

Separate the sponsor consent from the mentor consent. A student may be perfectly willing to have a mentor read her essay and completely unwilling to have a corporate funder receive her name. Bundling those into one signature is how programs lose participants and how counsel loses patience.

School official designation and vendor agreements for outside tools

Any outside system that stores applications, matches pairs, or holds meeting notes is a party acting for the institution. Under the school official exception, a vendor may be treated as a school official if it performs a service the institution would otherwise use employees for, is under the institution's direct control regarding use and maintenance of the records, and uses the data only for the authorized purpose without redisclosure.

The contract terms your procurement office will look for are predictable. Have them ready and the review takes weeks instead of a semester.

1. An explicit FERPA school official designation clause naming the institution as the controller of the data.
2. A prohibition on redisclosure and on using student data to train or improve unrelated products.
3. Named subprocessors and the hosting region.
4. Breach notification with a defined timeline back to the institution.
5. Deletion and export on termination, in a usable format, within a stated number of days.
6. Access controls that let you restrict a mentor's view to their own pair.

The tool that fails this review most often is not a mentoring platform. It is the shared consumer spreadsheet, the personal email account and the survey tool someone signed up for with a credit card. Shadow systems are the real exposure.

See how MentorPairing handles this for mentoring program administration

Retention, deletion and who owns the file when you leave the role

FERPA does not set a retention period. Your institution's records schedule does, and so may your state. Ask for the schedule that covers student program participation records and follow it rather than inventing one.

Set a deletion rule per field, not per file. Application essays rarely need to outlive the program year. Aggregate participation counts and outcomes may need to live for years for accreditation or reporting. Splitting those at the point of design saves an ugly cleanup later.

On departure, the answer is unambiguous even when the practice is not: the records belong to the institution. Nothing goes to a personal drive, a personal email archive or a laptop that leaves with you. Write down where every file lives, who has admin access to each system, and how a successor gets it. A program whose entire history is a spreadsheet in one coordinator's account is one resignation away from starting over.

Working with your registrar and general counsel before intake opens

Go early, go specific, and go with drafts. A meeting request that asks "can we run a mentoring program" produces caution. A meeting request that attaches the application form, the consent language, the mentor agreement and the vendor's FERPA clause produces edits, which is what you want.

Bring four questions. What is our current directory information designation. Are alumni volunteer mentors school officials under our annual notification. Does this consent form meet our standard. Who signs the vendor agreement and what is the queue time. Answers to those four settle most of the program's data design.

Where this leaves you

Compliance here is mostly architecture. If your system can show which mentee consented to what, restrict each mentor to a single pair, hold meeting logs under institutional control, and produce a clean export when the program year closes, then the FERPA conversation becomes short and the program runs.

MentorPairing was built for that shape of work: structured application intake with the consent fields attached to the record, matching that suggests pairs without exposing the pool, mentor access scoped to the assigned mentee, meeting logs that stay with the program, and reporting you can hand to a dean without exporting anyone's essay. Bring it to your registrar with the questions above and you will have a program that holds up in year three, not just at launch.