I would be careful with this. You should not just start a process unless it has absolutely been determined that your school has to do this, that you have figured out what you are going to charge the person or entity for this service and then you want to make really sure you stay within privacy boundaries, especially with students information. I would have the school's lawyer involved in the process and making sure everything is in order.
Maybe all of this has already happened and it's really just to the point where you absolutely have to do the search. But, if it's just someone being a pest (yes, that can happen) or who knows what, sometimes when you let them know that they do need to pay for the resources needed to complete the request the nuscience requests go away. You want to make very sure you are not just doing something and have a clear direction from bosses and lawyers that it is Ok to do this search and give up the information.