(GENERAL-24-129) Guidance for State Grant Agencies and Institutions of Higher Education on the Access, Disclosure, and Use of FAFSA Data for the Application, Award, and Administration of Student Aid Programs

This Electronic Announcement (EA) provides guidance on permitted and prohibited access, disclosure, and use of personally identifiable information (PII) from the Free Application for Federal Student Aid (FAFSA^®) (referred to herein as “FAFSA data”) by institutions of higher education (IHEs), state grant agencies, and their respective contractors that receive this information beginning with the 2024-25 FAFSA cycle. The definitions of FAFSA data and non-FAFSA data used in this guidance do not include federal tax information (FTI). This guidance is provided to IHEs and state grant agencies as they are the entities that directly receive FAFSA data through the Institutional Student Information Records (ISIRs), authorized by the Student Aid Internet Gateway (SAIG) agreements. The governing laws discussed in this guidance are the Higher Education Act (HEA), the Family Educational Rights and Privacy Act, as amended (FERPA), and the Privacy Act of 1974, as amended (Privacy Act).

A separate EA will follow in the near future that provides guidance on permitted and prohibited access, disclosure, and use of FTI by IHEs and state grant agencies. FTI is governed by the Internal Revenue Code of 1986, as amended (IRC), and has more stringent access, disclosure, and use requirements than other FAFSA data. This guidance only addresses proper access, disclosure, and use of non-FTI FAFSA data. No inferences should be made regarding FTI based on this guidance.

For reference, GENERAL-23-34 provides relevant information on FTI definitions, access, and use. GENERAL 24-35 also provides more information on how state grant agencies can disclose FAFSA Filing Status Information to eligible entities, and GENERAL-24-93 provides guidance on how IHEs and state grant agencies can use FAFSA data for means-tested benefit outreach. Federal Student Aid’s (FSA’s) Training Center includes webinars that cover additional details related to FAFSA data use as well as an introduction to FTI and FAFSA Data Use from the 2023 FSA Training Conference.

FAFSA data includes: information obtained directly from a FAFSA applicant (applicant) or other contributor on the FAFSA form (e.g., personal circumstances, student dependency status, federal benefits receipt, financial assets, manually entered tax data not imported from the IRS) as well as other information that appears on the ISIR that the U.S. Department of Education (Department) derives from such FAFSA data and FTI, such as Pell Grant eligibility status, the Student Aid Index (SAI), verification status, total income, adjusted available income, and discretionary net worth.

For the full list of FAFSA data received on the ISIR, refer to the 2024–25 FAFSA Specifications Guide, Volume 6 – ISIR Guide at Partner Connect Knowledge Center for Handbooks, Manuals, or Guides.

Not all data associated with the awarding and administration of aid is considered FAFSA data, and therefore is not under the same data use restrictions mandated by the HEA. Financial aid information that is not considered to be FAFSA data includes: total aid awarded; grant aid and/or loan receipt and amount by source; and unmet financial need. While some of this information (e.g., Pell Grant receipt and amount) is reported to Department systems (e.g., Common Origination and Disbursement, National Student Loan Data System), it is not considered FAFSA data as it originates from IHEs, states, or other entities rather than from the ISIR. For further clarity, Pell Grant eligibility is considered FAFSA data as it is derived from information that is entered into the FAFSA and part of the ISIR. Pell Grant receipt and amount are reported to the Department, but originate from IHEs, and are therefore not considered FAFSA data for the purposes of this guidance.

This guidance discusses multiple laws including the HEA, FERPA, and the Privacy Act, with the most restrictive provisions of each law applying to the access, disclosure, and use of FAFSA data.

In December 2019, the Fostering Undergraduate Talent by Unlocking Resources for Education Act (FUTURE Act) (P.L. 116-91) amended the HEA. The Consolidated Appropriations Act of 2021 (P.L. 116-260) also amended the HEA under the provisions of the FAFSA Simplification Act in December 2020, which was further amended by the Consolidated Appropriations Act of 2022 (P.L. 117-103).

One of the key purposes of the FUTURE Act was to simplify the process for students to apply for federal student aid by using income- and tax-related information pulled directly from the Internal Revenue Service (IRS) to automatically populate the FAFSA. The FAFSA Simplification Act also restructured the underlying formula used to calculate a student’s eligibility for aid and specified what information the Department was allowed to collect through the FAFSA form.

The HEA governs the Department’s ability to share FAFSA data with IHEs, state higher education agencies, and their respective contractors. A state grant agency is considered a state higher education agency under the HEA. With the above legislative updates, the HEA makes clear that FAFSA data can be used by IHEs and state grant agencies for the application, award, and administration of aid and redisclosed by these entities under certain conditions discussed more below. Under the HEA, state grant agencies may share FAFSA data with other state agencies so long as the purpose is for the application, award, and administration of aid (see definition below).

FERPA is a federal law and implementing regulations that the Department’s Student Privacy Policy Office (SPPO) administers. FERPA protects the privacy of student education records. The law and implementing regulations apply to all educational institutions and educational agencies that receive funds under an applicable program of the Department. An education record is generally defined as a record that is directly related to a student and maintained by an educational agency or institution or by a party acting for the agency or institution (e.g., a third-party servicer). (20 U.S.C. 1232g(a)(4); 34 CFR § 99.3). This definition includes FAFSA data that is maintained by an IHE or a party acting on its behalf, as well as the institution’s own financial aid records on a student, so long as the records directly relate to the student.

A student, except as otherwise specifically provided in the FERPA regulations, is defined to mean “any individual who is or has been in attendance at an educational agency or institution and regarding whom the agency or institution maintains education records.” (34 CFR § 99.3). Thus, FERPA does not protect the records of FAFSA applicants who only apply to – but are not nor have been in attendance at – the IHE. When a student reaches 18 years of age or attends an IHE at any age, the student becomes an “eligible student,” and all rights accorded to, and consent required of, parents under FERPA, transfer from the parent to the student. (34 CFR §§ 99.3, 99.5(a)(1)). More information on the rights of eligible students under FERPA can be found in the Department’s eligible student guide to FERPA.

As outlined in the Department’s eligible student guide to FERPA, in general, an IHE may not disclose an eligible student’s education records, or PII contained therein, without the eligible student’s prior written consent, unless an exception to FERPA’s general consent requirement is met. FERPA statute and section 99.31 of the FERPA regulations describe the exceptions to general consent, such as disclosures to school officials who the IHE has determined to have legitimate educational interests in the education records; disclosures in connection with an eligible student’s application for, or receipt of, financial aid; and disclosures to organizations conducting certain types of studies for, or on behalf of, the IHE. These and other FERPA exceptions are discussed in more detail below. Please note that this guidance does not provide comprehensive details of all the requirements necessary to implement a FERPA exception (e.g., both the studies and audit or evaluation exceptions under FERPA have requirements for what must be included in a written agreement). More information on these requirements can be found through SPPO’s Privacy Technical Assistance Center at https://studentprivacy.ed.gov/.

The Privacy Act applies to federal agencies and generally governs information about individuals that is in a “record” that is contained in a “system of records.” (5 U.S.C. 552a(a)(1), (4), and (5), (b), and (e)). The term “system of records” is defined as a group of records under the control of an agency from which information is retrieved by an individual’s name or other individual identifier, such as a Social Security number. (5 U.S.C. 552a(a)(5)). The Department must protect FAFSA data that it maintains, including by disclosing it to IHEs and state grant agencies, consistent with the Privacy Act.

Information that is protected by the Privacy Act cannot be disclosed by federal agencies without prior written consent, unless the disclosure is pursuant to one of the exceptions to consent in subsection (b) of the Act. Under one such exception, a federal agency may publish in the Federal Register a “routine use” for the information in a system of records notice (SORN) that outlines how the agency may disclose the information without prior written consent, so long as the routine use is compatible with the purpose for which the agency collected the information. (5 U.S.C. 552a(a)(7), (b)(3), (e)(4) and (11)). The Department’s routine uses for FAFSA data are primarily outlined in the Aid Awareness and Application Processing (AAAP) (18-11-21) SORN. When signing the FAFSA, applicants are provided a link to the AAAP SORN and a sample of routine uses that explain, among other things, the categories of users and the purposes for which the FAFSA data may be used.

IHEs and state grant agencies, and their respective contractors, may receive and use FAFSA data for the application, award, and administration of financial aid, consistent with HEA, FERPA, and the Privacy Act, and as outlined in their respective SAIG agreements.

The Department interprets “the application, award, and administration of aid” as used in HEA section 483 as the administrative and business functions necessary to deliver federal, state, and institutional financial aid efficiently and effectively to students, which may include, but are not limited to:

The SAIG agreements signed by IHEs and state grant agencies clarify who can access and use FAFSA data. The state grant agency SAIG agreement uses the term “authorized personnel” to describe these individuals, and it defines the term to include both paid and non-paid staff and authorized agents, such as contractors to whom the state grant agency has outsourced any of its services or functions. While this term is not used specifically in the institutional SAIG agreement, the same concept applies and is discussed in more detail under the section outlining the responsibilities of the destination point administrators (DPAs), including that the DPAs “must ensure that all Federal Student Aid applicant information (including FTI) is protected from access by or disclosure to unauthorized personnel.” Authorized personnel must be under the direct control of or bound by written agreement to the IHE or state grant agency. The SAIG agreements detail the responsibilities of authorized personnel and DPAs, and any penalties that might apply for failure to execute on those responsibilities.

A variety of offices within an IHE or state grant agency may have duties related to the application, award, or administration of aid. This includes, but is not limited to, offices within an IHE responsible for the overall administration and delivery of federal, state, institutional aid, or other scholarship awards, including those administered by athletics divisions; alumni associations or institutional foundations, so long as they are under the control of the IHE; or offices that provide support for completing aid applications such as admissions, housing, or other support programs (e.g., TRIO programs if they are providing grant aid or financial aid application support). This also includes offices responsible for mandatory reporting related to aid administration (e.g., Campus-Based Program Fiscal Operation Report and Application to Participate (FISAP) Reporting, IPEDS, SAP).

There are numerous FERPA exceptions that may apply to disclosure of FAFSA data needed to carry out the variety of activities that fall under the application, award, and administration of aid. For example, under the school official exception, personnel of the institution are able to access the FAFSA data if they meet the criteria listed for being “school officials” in the institution’s annual notification of FERPA rights and are determined to have a “legitimate educational interest” under the criteria listed for such interests in the institution’s annual notification of FERPA rights. (34 CFR 99.31(a)(1)(i)(A) and 99.7(a)(3)(iii)). Under the financial aid exception, the FAFSA data can be disclosed in connection with financial aid for which the student has applied or which the student has received, if the information is necessary for determining eligibility for, amount of, and conditions for the aid, or to enforce the terms and conditions of the aid. (34 CFR 99.31(a)(4)(i)).

When they are completing the FAFSA form, the Department notifies applicants that their FAFSA data are used by the Department and disclosed to IHEs and state grant agencies by the Department for the application, award, and administration of financial aid. The IHE or state grant agency may need to obtain consent for the disclosure of FAFSA data for other purposes.

Under Section 494 of the HEA, prior written consent requires a separate, written document, signed (electronic signatures are permitted) and dated by the FAFSA applicant, that specifies the FAFSA data being disclosed, the purpose for the disclosure, and states that the information may only be used for the specified purpose. The HEA requires prior written consent to be maintained for a period of at least three years from the student’s last date of attendance at the institution and made available to the Department upon request.

Prior written consent may also be required if there is no applicable exception to FERPA’s general consent requirement for a particular disclosure of FAFSA data. As noted above, FERPA does not apply to FAFSA applicants who are not, or have not been, in attendance at the IHE. In other words, the HEA requirements for who must provide prior written consent (FAFSA applicant) is different from who must provide consent under FERPA (eligible student, as described above). However, IHEs and state grant agencies may use the same process to obtain prior written consent from applicants who are eligible students under the HEA and FERPA (where applicable).

Under FERPA, prior written consent from an eligible student to disclose FAFSA data must be signed and dated and specify the records that may be disclosed and the purpose of the disclosure and must also identify the party or class of parties to whom the disclosure may be made. (34 CFR § 99.30 (a) and (b)). FERPA requires that an IHE provide to the eligible student, upon their request, a copy of the records disclosed pursuant to the student’s prior written consent. (34 CFR § 99.30(c)(1)).

The sections below provide more details on when prior written consent may be required under the HEA because a disclosure of FAFSA data falls outside the definition of application, award, and administration of aid. The sections also discuss examples of FERPA exceptions that may apply to a particular situation. The FERPA exceptions provided as examples are not exhaustive; however, if no FERPA exception can be determined to apply to the disclosure of FAFSA data from an eligible student’s education record, prior written consent must be obtained.

The HEA and prior Department guidance allow IHEs and state grant agencies to use an applicant’s own FAFSA data to inform them that they might be eligible for means-tested benefits (e.g., emailing applicants with an SAI of zero or below to let them know they may be eligible for Supplemental Nutrition Assistance Program (SNAP) benefits). Under the HEA, IHEs and state grant agencies cannot disclose or redisclose FAFSA data to other entities for the purpose of administering and determining eligibility for other means-tested benefit programs without the applicant’s prior written consent to further disclose and use their FAFSA data for such efforts.

IHEs and state grant agencies may develop a process for FAFSA applicants to provide prior written consent to further redisclose FAFSA data from the ISIR to other federal, state, or local government agencies or tribal organizations to assist applicants in applying for and receiving government or tribal assistance for any component of their cost of attendance consistent with Sections 483 and 494 respectively of the HEA. Given the limitation of FAFSA data redisclosure under Section 494(c), prior written consent may only be provided for disclosure of FAFSA data for financial assistance that is a component of the student’s cost of attendance. This financial assistance may be both but monetary, including means-tested benefits, and non-monetary so long as it is a component of the student’s cost of attendance. IHEs and state grant agencies may not collect prior written consent to redisclose FAFSA data for monetary or non-monetary assistance that is not a component of a student’s cost of attendance.

Scholarship organizations or other aid programs within an IHE or state grant agency that award federal, state, or institutional financial aid may receive access to and use FAFSA data for the application, award, and administration of that aid without additional prior written consent by the applicant. As noted above, this aid could be administered by the IHE’s financial aid office or other offices within an institution, such as athletics. Philanthropy-funded scholarships, where the funds are donated to and administered by the IHE or state, are considered institutional or state aid as the respective entity is responsible for the application, award, and administration of such scholarship aid.

Under the HEA, IHEs and state grant agencies must obtain the prior written consent of the applicant to disclose FAFSA data to an external scholarship-granting organization. Consistent with past Department guidance and the HEA, IHEs and state grant agencies may not disclose FAFSA data, without the applicant’s prior written consent, to scholarship organizations that are external to the IHEs or state grant agencies, including tribal organizations (as defined in Section 5304 of Title 25), for the purpose of assisting the applicant in applying for and receiving financial assistance for any component of the applicant's cost of attendance.

There are two scholarship organizations that are exempted due to previously receiving a designation from the Secretary – the designations have been codified into the FAFSA Simplification Act (Section 483(a)(2)(D)(i)) – the United Negro College Fund (UNCF) and the Hispanic College Fund (HCF). Under HEA, both UNCF and HCF are authorized to receive FAFSA data directly from the Department, as well as from IHEs and state grant agencies, without additional prior written consent and with proper agreements in place, though they are not allowed to further disclose the data for other purposes consistent with Section 483 of the HEA.

In practice, the Department encourages external scholarship organizations to work with IHEs and state grant agencies to consider collecting prior written consent under Section 494 of the HEA from applicants through the external organization’s scholarship application process in order to obtain the necessary FAFSA data from applicable IHEs or state grant agencies.

FERPA contains exceptions to the prior written consent requirement, which may permit the non-consensual disclosure or redisclosure of these data to an external scholarship organization under certain conditions. For instance, FERPA includes a financial aid exception (CFR § 99.31(a)(4)(i)) that permits the disclosure of an education record without the prior written consent of an eligible student if the disclosure is in connection with financial aid for which the student has applied or which the student has received, if the information is necessary for such purposes as:

If the eligible student has applied for or received a scholarship that is conditioned on the student’s attendance at the institution and the scholarship would thus be considered “financial aid” under FERPA’s financial aid exception, an IHE may non-consensually disclose or state grant agency may non-consensually redisclose, on behalf of the IHE, data from a student’s education record to the external scholarship organization if such information is necessary for an aforementioned purpose. This would include both FAFSA data, as well as non-FAFSA data as defined above (e.g., Pell grant receipt, unmet financial need).

There are use cases in which FAFSA data can be used without prior written consent by an IHE or state grant agency for purposes of providing advising or other support to students, so long as it is for the purposes of application, award, and administration of aid under the HEA and the disclosure is allowable under a FERPA exception, as applicable. For example, FAFSA data could be leveraged by academic advisors and other student support staff at IHEs to assist students in completing the FAFSA or other financial aid forms, filing a financial aid appeal, or maintaining SAP as these activities are related to the application, award, and administration of aid.

For purposes beyond financial aid, such as support for other college completion efforts (e.g., academic advising), IHEs must obtain prior written consent from students to use or disclose FAFSA data under HEA. To illustrate further, an IHE would need to obtain prior written consent consistent with Section 494 of the HEA in order to grant the financial aid office permission to disclose Pell Grant eligibility status to the academic advising office for purposes of enrollment and retention efforts.

Under FERPA, an IHE could disclose FAFSA data and non-FAFSA data without prior written consent provided that the requirements of a FERPA exception is met (e.g., the disclosure is to school officials who have been determined by such IHE to have legitimate educational interests in such data).

IHEs have numerous legal requirements they must adhere to in order to continue to participate in federal student aid programs under Title IV of the HEA. The Department considers use of FAFSA data for compliance with these mandatory requirements to be a part of the administration of aid and therefore an allowed use of FAFSA Data under the HEA. Examples of this include:

For data that is protected by FERPA, the FERPA exceptions that may apply include (list is not exhaustive and more than one may apply to a particular situation):

The HEA authorizes the use of FAFSA data, without consent, by IHEs and state higher education agencies, including state grant agencies, for research to promote college attendance, persistence, and completion. Efficient and effective student aid programs, whether funded and/or administered by the IHE or state or federal government, are critical to a student’s ability to attend and complete college. Other efforts that might fall under this provision in the HEA include evaluating the effectiveness of college completion programs, developing predictive analytics models to better target resources or interventions to ensure students complete college, or studying ways to improve instruction, such as improvements to developmental education models.

This research must not release individually identifiable information on an applicant to the public or anyone not authorized to receive such information. This research must be done by or on behalf of the IHE or state grant agency. An IHE or state grant agency may use contractors or other entities (including other state agencies) to conduct the research. However, for FERPA-protected data, an appropriate exception must apply.

There are several FERPA exceptions that could potentially permit an IHE to disclose FAFSA data without prior written consent, or a state grant agency to redisclose FAFSA data that originated from the education records of an IHE without prior written consent, for research purposes. For FAFSA data that originated from the education records of an IHE, either prior written consent of the eligible student or a FERPA exception is necessary for the state agency to conduct or contract out for the research. IHEs must also use a FERPA exception to conduct or contract out for the research with FAFSA data.

If the state grant agency is only using FAFSA data that was provided to the state grant agency directly by the Department, and not data that was provided by or originated with the IHE (e.g., whether a student received a Pell Grant), the data can be non-consensually disclosed to other entities (e.g., other state agencies, contractors) without requiring a FERPA exception because FERPA does not apply.

Under the HEA, IHEs and state grant agencies can also provide FAFSA data for law enforcement investigations or in response to a subpoena if the investigation is directly related to the application, administration, and award of financial aid (e.g., investigating suspected financial aid fraud).

If the FAFSA data being requested is also covered by FERPA, IHEs and state grant agencies generally may also comply with subpoenas but must make a reasonable effort to notify the eligible student in advance of complying in order to allow time to seek protective action. The FERPA regulations at 34 CFR § 99.31(a)(9)(ii) provide more details on these requirements and allowances.

The HEA requires that, upon request from an applicant, an IHE must provide them access to their own FAFSA data as reported on the ISIR, including data provided by any of their contributor(s) on the FAFSA form.

FAFSA applicants, at their discretion, may further redisclose their FAFSA data, including a contributor’s information, to other individuals or entities internal or external to the institution, such as external scholarship organizations and other support organizations, by obtaining a copy of the ISIR at their request.

Under FERPA, an eligible student’s prior written consent is required for an IHE to disclose FAFSA data to parent(s) and/or a spouse of that student. However, if a student is a “dependent student” as defined in Section 152 of the IRC (i.e., the student is claimed as a dependent on either parent’s most recent tax return), an IHE may disclose the student’s education record to either parent without the eligible student’s consent. (20 U.S.C. 1232g(b)(1)(H); 34 CFR § 99.31(a)(8)). The discretion granted to the IHE to make this disclosure allows IHEs to consider the circumstances of students. For example, if a student answered question seven on the FAFSA form (student unusual circumstances) affirmatively, the institution should consider the impact on the student of sharing their information with a parent, even if the student is still considered a dependent under Section 152 of the IRC.

The Department appreciates our stakeholders’ cooperation and continued role in safeguarding the integrity of the Title IV programs and protecting the sensitive information provided by students and their families. If you need additional information or have specific questions, visit FSA’s Partner Connect Help Center and select the Topic “Policy Guidance” on the Contact Customer Support form. Further discussion of all the key terms, definitions, and systems related to the FAFSA Simplification and FUTURE Acts is available in the electronic announcement (GENERAL-23-63).

For more information on FERPA and other student privacy issues, visit https://studentprivacy.ed.gov. FERPA questions can be submitted to https://studentprivacy.ed.gov/contact.