U.S. FERPA Student Education Record ID

Detects student identifiers that appear in education records protected under the Family Educational Rights and Privacy Act (FERPA). Student ID formats are institution-specific, so this pattern anchors on an explicit student/enrolment/SIS context label immediately preceding a 6-12 character alphanumeric ID, and relies on education-record keywords (transcript, GPA, enrollment, registrar) for corroboration.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: the ID must be immediately preceded by an explicit student/enrolment label, so generic alphanumeric strings will not match. Corroborative education-record keywords distinguish protected records from unrelated ID labels.
Jurisdictions: us
Regulations: FERPA, State Breach Laws (US), CCPA/CPRA
Frameworks: ISO 27001, ISO 27701, SOC 2
Data categories: pii, education
Scope: narrow
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b(?:student\s+(?:id|number)|SIS\s+id|enrollment\s+id)[\s:#]{0,8}[A-Z0-9]{6,12}\b

Corroborative evidence keywords

transcript, GPA, grade point average, enrollment, registrar, academic record, course, semester, degree, student, university, college, school district, education record

Proximity: 300 characters

Should match

Student ID: A1234567 — Labelled student ID with alphanumeric body
SIS id 90817263 — SIS id label with 8-digit body
Enrollment ID: STU00412 — Enrollment ID label with mixed alphanumeric body

Should not match

Employee ID: A1234567 — "Employee" label is not a student/enrolment context
Student number: AB12 — Body too short (4 chars, below the 6-char minimum)
The student council will meet to discuss enrollment trends — Prose about students and enrollment with no ID value

Known false positives

Generic ticket, ticketing, or membership numbers labelled "student" in non-academic contexts (e.g. a museum student-discount ticket). Mitigation: Require corroborative education-record keywords (transcript, GPA, registrar, academic record) within the proximity window to confirm a FERPA education-record context.
Course-catalogue or syllabus templates using placeholder student IDs. Mitigation: Check for placeholder markers (example, xxxx, 000000) and require co-occurring grade or enrolment data.