34 CFR §303.415

1. (a)Each participating agency must protect the confidentiality of personally identifiable information at the collection, maintenance, use, storage, disclosure, and destruction stages.
2. (b)One official at each participating agency must assume responsibility for ensuring the confidentiality of any personally identifiable information.
3. (c)All persons collecting or using personally identifiable information must receive training or instruction regarding the State's policies and procedures under §§ 303.401 through 303.417 and 34 CFR part 99.
4. (d)Each participating agency must maintain, for public inspection, a current listing of the names and positions of those employees within the agency who may have access to personally identifiable information.