Education-agency and school staff are legally and ethically responsible for safeguarding student information. In addition to federal and state laws and regulations, education agencies need policies and procedures to guide their everyday information-maintenance operations. This document provides examples of policies and procedures as well as guidelines for deciding what is needed to ensure the privacy of student information. Section 1 provides an overview of the issues and discusses important concepts and terminology used throughout the document. Section 2 describes federal laws protecting the privacy of students that have implications for the maintenance and release of student data by state and local education agencies. The third section describes appropriate procedures for collecting individual information about students. Section 4 explains the management controls and policies needed to maintain and use data within the agency or school. It also addresses the issue of assessing who in an agency or school has a "legitimate educational interest" in specific information about an individual student. The fifth section describes procedures for providing access to a student's education record by the eligible student or the parent. The final section suggests procedures for handling external requests to release information from individual school records. The appendices contain the text of key federal rules and regulations. A topical index, section summary, an index of commonly asked questions, and 22 exhibits are included. Each section includes references, an overview, commonly asked questions, and guidelines. (LMI)