Best practices for destroying confidential data

The Family Educational Rights and Privacy Act doesn’t require schools to destroy student records. To reduce technology costs and limit potential data breaches, many schools and districts establish their own retention policies, including timeframes for the eventual destruction of unnecessary records. But how can institutions know if their data destruction practices comply with their FERPA duty to protect personally identifiable information (PII) in a student record?