University officials with a “legitimate educational interest” may have access to student information, if their responsibilities reasonably require access to that information for educational, administrative, or research purposes in the performance of their job duties. A University official also may include a volunteer or contractor outside of Alfaisal University who performs an institutional service or function for which the university would otherwise use its own employees and who is under the direct control of the university with respect to the use and maintenance of personally identifiable information (PII) from education records, such as an attorney, auditor, or collection agent or a student volunteering to assist another university official in performing his or her tasks. University employees who have access to student education records are obligated to carefully protect them and will be held accountable for safeguarding them. Policy or procedure violations may result in disciplinary action, including possible termination of employment, and applicable civil and criminal sanctions.