By NASFAA Policy & Federal Relations Staff

The Department of Education (ED) published a Dear Colleague Letter (DCL) on Tuesday detailing their current guidance on the permitted access, disclosure, and use of Federal Tax Information (FTI), FAFSA data, and non-FAFSA data by institutions of higher education, state higher education agencies that administer state-based financial aid, and contractors. This DCL now supersedes previous guidance published in the November 7, 2024 Electronic Announcement, and provides long awaited guidance related to FTI data use and disclosure.

According to the department, Tuesday’s guidance “does not have the force and effect of law and are not meant to bind the public,” instead, the document is meant to provide clarity to the public regarding existing law or agency policies.

The DCL explains the difference between FTI, FAFSA data, and “non-FAFSA, institutional, or school data,” as well as the different laws that govern the data’s usage and disclosure of the following: Internal Revenue Code (IRC), the Higher Education Act (HEA), the Privacy Act, and the Family Educational Rights and Privacy Act (FERPA).

ED goes on to list the situations in which FTI and FAFSA data may be used or shared without student consent. This includes using FTI and FAFSA data for the application, award, and administration of financial aid, specifying that state agencies are to use this data only for the “application, award, and administration of state-based financial aid for which the applicant is eligible.” As stated in prior guidance, ED interprets the application, award, and administration of aid to be “the administrative and business functions necessary to deliver federal, state, and institutional financial aid efficiently and effectively to students,” and the DCL includes a list of functions that fall under this interpretation. Notably, the DCL confirms previous verbal guidance from ED that says “Offices like institutional research that hold responsibility for required reporting such as IPEDS are permitted to access FTI,” but goes on to clarify the staff must be fully trained to safeguard FTI.

The United Negro College Fund and Hispanic Scholarship Fund, which are considered designated scholarship organizations, can also receive ISIR data, including FTI, without additional prior written consent of the applicant for the application, award, and administration of their specific aid programs.

One noteworthy announcement in the DCL is that schools, state agencies, and these designated scholarship organizations all will need to adhere to the National Institute of Standards and Technology (NIST) Special Publication 800.171, Rev. 3 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations) CUI security standards. Schools and state agencies will also be required to ensure any outside entities that receive FTI from them comply with the NIST standards. While at the time of the DCL, there are no current compliance requirements related to this, ED said more detailed information will be provided in the future.

Schools and state agencies may use FAFSA data to determine an applicant’s possible eligibility for means tested benefits, and also state agencies (in collaboration with local education agencies or secondary schools) may use only students' identifying information from the FAFSA to check if a graduating student has submitted an application. This is consistent with a state agency’s SAIG agreement.

Regarding the use of FAFSA data for research purposes, the DCL confirms some previous guidance and also offers new information. First, as previously stated by ED, state agencies and schools can use FAFSA data, but not FTI, to perform research without student consent as long as the research activities pertain to college attendance, persistence, and completion, and the research cannot release any individually identifiable information. Contractors and third-party servicers may also perform this research on behalf of the school or state agency, but ED now clarifies this is only if the contractors or third-party servicers “otherwise already have access to student FAFSA data due to their role in aid application, award, and administration.”

The DCL also details situations in which data can be used or shared with written student consent, including how state agencies may share FAFSA data (excluding FTI) with federal, state, local government agencies, or tribal organizations to help students receive assistance for any component of their cost of attendance (COA), including financial or non-monetary assistance. While this is not new information, the DCL points out that public institutions may fall under this redisclosure of data by state agencies if the school qualifies as a government agency (meaning its staff are government employees). This is important because TRIO programs that do not provide monetary support and do not participate in the application, award, or administration of aid could still get access to FAFSA data with written consent in this situation. This is noteworthy because the DCL later explicitly states “FAFSA data and FTI cannot be used to determine eligibility for TRIO programs that do not offer aid.”

Schools may share both FAFSA data and FTI with the same organizations as state agencies in order to help students receive financial assistance for any component of the COA, but not for non-monetary assistance. Unlike state agencies, schools may also share FAFSA data and FTI with external scholarship-granting organizations, including tribal organizations, with written student consent.

ED also reminds schools of other situations when they (not state agencies) may share data with student consent. This includes when a student requests an unredacted copy of their Institutional Student Information Record (ISIR) and when students who choose to have an advisor or other individual participate in a discussion of their FAFSA data (including FTI) with the school. Notably, the DCL states this individual may be a TRIO staff member.

While much of the DCL offers written confirmation of previously shared verbal guidance or reminders of previous written guidance, one change in guidance relates to the use of FERPA exceptions for FAFSA data.

In a reversal from guidance in the November 7, 2024 Electronic Announcement, ED states: “Because the HEA and IRC are more restrictive than FERPA regarding the use of FAFSA data and FTI, it was not necessary in that discussion to explain how that use satisfies the FERPA statutes and regulations. However, when determining the uses of institutional data, on which the IRC and HEA are silent, it is necessary to discuss the FERPA rules.” This essentially means that FERPA exceptions do not apply if the data use and sharing would fail the HEA or the IRC rules.

For example, if the use or sharing of FAFSA data fails the HEA, there is no ability to bypass required written consent under a FERPA exception. Instead, ED suggests using non-FAFSA data, in order to only be bound by FERPA rules, not the HEA. The DCL offers two examples of this: using Pell receipt (non-FAFSA data) instead of Pell eligibility status (FAFSA data) to share data with researchers under the FERPA studies exception, and using non-FAFSA data to determine eligibility for non-monetary TRIO benefits under FERPA’s school official exception, since FAFSA data may only be shared if it is for TRIO programs that provide monetary assistance.

The DCL also provides reminders on how FTI can be changed on a FAFSA only via professional judgement adjustments, which then makes the new tax information FAFSA-data rather than FTI, and how certain NSLDS data use provisions remain unchanged. And finally, ED reminds schools and state agencies of the requirements related to both types of student consent: one for the disclosure of information under FERPA and one for HEA disclosures.

Publication Date: 10/1/2025

Comments Disclaimer: NASFAA welcomes and encourages readers to comment and engage in respectful conversation about the content posted here. We value thoughtful, polite, and concise comments that reflect a variety of views. Comments are not moderated by NASFAA but are reviewed periodically by staff. Users should not expect real-time responses from NASFAA. To learn more, please view NASFAA’s complete Comments Policy.