25 CFR § 43.14 - Consent.
Educational institutions shall not permit access to or the release of student records or personally identifiable information contained in them, other than directory information of students, without the written consent of the parents or of an eligible student, to any party other than the following:
(a) Local school officials, including teachers within the educational institution, who have been determined by the institution to have legitimate educational interests in the records.
(b) Officials of other schools or school systems at which a student is interested in enrolling. The student or parent must be notified of such release except in cases involving Bureau of Indian Affairs schools. All Bureau of Indian Affairs schools are considered to be components of one school system whether operated under contract or otherwise.
(c) Persons having official involvement with a student's application for or grant of financial aid.
(e) Accreditation agencies in order to carry out their accrediting functions.
(f) U.S. Office of Education officials and other governmental education officials when deemed necessary by the institution to carry out their official functions.
(g) An education testing center or similar institution as a part of its validation research which has been authorized by the school.
(h) In an emergency, any person to whom the information is necessary in the discretion of the school's administration in order to protect the student's health and safety, subject to § 43.17.
(i) Indian groups, contractors, grantees, professional social service organizations and personnel performing professional services, when necessary to carry out an official function authorized by the Bureau of Indian Affairs.
(j) Pursuant to the order of a court of competent jurisdiction; however, the parent or eligible student must be notified of such order in advance of compliance therewith by the educational institution.