Student data privacy begins the moment a family enrolls a child in school, and it does not end on graduation day. Each year, districts ask families for home addresses, phone numbers, household details, emergency contacts, language needs, medical information and eligibility for services. Over thirteen years of school, those forms, along with grades, attendance, assessments, discipline and digital learning activity, build a detailed record of a young person’s life. Most families never ask what happens to that record once their child leaves.
What happens to student records after graduation depends on the record, the school district and the state. Some information is kept permanently, some is destroyed after a set number of years, and some sits with outside companies that schools hired along the way. This article explains what counts as student data, what happens to a student’s records and ID number after graduation, how long schools keep transcripts, and what districts should do to protect the information they hold.
What counts as student data?
Personally identifiable information, often shortened to PII, is any information that can identify a student directly or indirectly. In schools it covers far more than names and ID numbers. It includes birth dates and home addresses, state-issued student identifiers, parent and guardian contact information, attendance, discipline and academic records, special education documents and accommodation plans, health information shared with the school, and demographic data such as race, ethnicity and primary language.
What is FERPA?
The federal Family Educational Rights and Privacy Act, or FERPA, is the main federal law on student records. It protects students’ education records and gives parents the right to see them. Those rights move to the student at 18, or earlier if the student enrolls in college; FERPA calls that student an eligible student. Many states add their own student privacy laws on top of FERPA.
What happens to your student ID number when you graduate?
A graduate usually has two ID numbers, and they are handled differently. The district ID, the number on a student badge and in school accounts, stops being used when the student leaves. School email and learning accounts are switched off on a schedule the district sets; one Massachusetts district, for example, disables student accounts after graduation, typically in September, and lets graduates request a short reactivation to save their work. The records connected to that number are not deleted with the account.
The state student ID lasts longer. States assign each public school student a unique identifier and use it in statewide longitudinal data systems, which the federal government supports so states can follow students’ progress from early learning through school, college and work. The National Center for Education Statistics describes these as K–12 and P-20W data systems, meaning early learning through the workforce. Washington’s system, for instance, links records from all four sectors through a separate matching ID. A few states now set limits. Nevada’s 2025 law requires the state to move a student’s data, including the ID number, into an archive within a year of graduation, remove the personally identifying details, and destroy the archived data ten years after the student turns 22.
How long do high schools keep transcripts?
Usually, permanently. FERPA itself does not set a retention period: it does not require schools to keep records, and it does not require them to destroy records after graduation, according to the U.S. Department of Education’s Student Privacy Policy Office. Retention is set by state schedules and district policy. Texas’s schedule for school districts, for example, makes the high school academic record permanent, keeps the cumulative record for prekindergarten through eighth grade for five years after a student withdraws, and keeps special education records for five years after services end.
Special education files have an added rule. Under the federal Individuals with Disabilities Education Act, a school must tell parents when the information it collected is no longer needed to serve the child, and must destroy it if the parents ask. The school may still keep a permanent record of the student’s name, address and phone number, grades, attendance, classes attended, and the grade level and year completed.
Data kept too long is data at risk
A student who stays in one district from kindergarten through 12th grade may leave more than a decade of records behind. Information is added every year and rarely removed, and many districts have no routine review to decide whether older records are still needed. The Department of Education’s privacy office has advised that while transcripts may need to be kept indefinitely, much other information may no longer be needed once a student graduates. Every record kept past its use is one more record that can be exposed.
The risk is not theoretical. In December 2024, a hacker broke into PowerSchool, one of the most widely used student information systems, and later claimed to have taken records on more than 62 million students and 9.5 million teachers, TechCrunch reported; the company said it could not confirm a precise number. The 19-year-old responsible was sentenced to four years in prison in October 2025. A breach of that size reaches everyone whose records a system still holds, which is why retention decisions matter.
Third-party vendors and expanded access
Schools now rely on dozens of outside companies, from learning platforms to transportation software, and each one that receives student information becomes another place that information is stored. School photography is a common example that receives little attention. Photo companies collect students’ names, grades, schools and images every year, and a single company may hold a student’s pictures from kindergarten to graduation. Families are rarely told how long those images are kept or how they are protected, and districts do not always ask.
State laws are starting to close that gap. Utah’s 2026 law, which takes effect July 1, 2026, requires education technology vendors to return or delete all personally identifiable student data when a contract ends, without waiting for the school to ask. Districts remain responsible for student data even when an outside company handles it, so contracts should say what data the vendor may collect, how it is secured, who can see it, whether it is shared with subcontractors, how long it is kept, and what happens to it when the contract ends.
What districts should do now
Districts can earn families’ trust with a few concrete practices. Publish a plain-language privacy policy and a retention schedule that says how long each kind of record is kept. Review each year what data is collected and stop collecting what is not needed. Check vendors’ privacy practices before signing and again each year, and require deletion at the end of every contract. Give families a named contact for privacy questions.
Families have a role too. Parents can ask which companies hold their child’s data, request to see their child’s education records, and, for special education records, ask that information no longer needed be destroyed. Graduates should request copies of their transcripts and save their school-account work before their accounts close. Student data represents real children and families who trusted their schools with it, and that responsibility lasts well beyond graduation day.
Related reading
Subscribe to edCircuit to stay up to date on all of our shows, podcasts, news, and thought leadership articles.
More on School Safety
