48 C.F.R. § 3424.702
It is the Department's policy to designate as its authorized representative, for purposes of compliance with FERPA, any contractor that will collect or receive access to personally identifiable information (PII) from student education records in connection with the conduct of an audit, evaluation, study, compliance review, or other Federal law enforcement activity. The Department will notify such contractors, or prospective contractors, prior to award or during contract performance of their obligations to protect student privacy in compliance with FERPA. Further, the Department will incorporate into all relevant solicitations and contracts the provisions and clauses needed to implement FERPA requirements. The aforementioned policies do not apply to Federal Student Aid (FSA) contracts for the origination, servicing, or collection of student financial aid, provided such contracts do not include tasks relating to the conduct of an audit, evaluation, study, compliance review, or other enforcement activity.
48 C.F.R. §3424.702