34 C.F.R. § 99.66
(c) If the Office finds that an educational agency or institution or other recipient has not complied with a provision of the Act or this part, it may also find that the failure to comply was based on a policy or practice of the agency or institution or other recipient. A notice of findings issued under paragraph (b) of this section to an educational agency or institution, or other recipient that has not complied with a provision of the Act or this part—
(d) If the Office finds that a third party outside of an educational agency or institution has not complied with the provisions of § 99.31(a)(6)(iii)(B) or has improperly redisclosed personally identifiable information from education records in violation of § 99.33, the Office's notice of findings issued under paragraph (b) of this section—
(2) Provides a reasonable period of time, given all of the circumstances of the case, during which the third party may comply voluntarily.
(Authority: 20 U.S.C. 1232g(b)(4)(B), (f), and (g))
[76 FR 75643, Dec. 2, 2011]