What’s happening with NDPA v2.3
Last week, we opened the second round of Community Review for an eventual version 2.3 of the National Data Privacy Agreement (NDPA). The Community Review is open to A4L members to provide feedback on the proposed changes and will remain open until September 15, 2026. After this date, the NDPA Project Team will review the feedback received and address each item. Once this review is complete, there may be a few minor updates, but ultimately, we anticipate finalizing NDPA v2.3 sometime in October at which point it will be available for states around the country to adopt.
This has been a long process, which on the one hand means we’ve been thorough, but on the other is frustrating because there are critical topics our Community has requested that the NDPA address (e.g., AI) that are not going to be a part of this release. Something I have asked myself throughout is what could have been done differently to have made the process faster so that we can more quickly respond to the needs of our Community.
How do we expect this to go in the future?
At least part of the issue has been how we have structured getting input and feedback from the Community. As of right now, the process has been that members of the SDPC identify issues that need to be addressed in the NDPA. These are sent to the NDPA Project Team, which is a small group of experts representing our vendors and school members. They review the requests and draft language to address it. This language is then sent to Community Review for feedback, which is also reviewed by the project team, and if changes are made, a second round of Community Review follows.
An issue with this is that particularly on the vendor side, the edtech ecosystem has a lot of variety, not just in terms of products offered, but in business models and data processing practices. For some topics, our current system of getting feedback at the end has led to a lot of these varied perspectives being captured too late. If they were captured earlier, we could have avoided a lot of the repetition and resolved issues sooner.
Because of this, moving forward, we plan to flip our process to start with getting feedback from our broader Community instead of waiting till the very end for it. We are informally calling this change NDPA v3.0, though I’ll note that many of the changes we hope to see from it should become available before an actual full version 3.0. For instance, we have already started an internal group, which is open to all of our members, to discuss Artificial Intelligence tools and what they mean for the NDPA. We anticipate that this group’s input will help us draft an AI addendum to the NDPA, which would be available before the full v3.0. We have already started to identify other complex topics where we will have a similar approach.
How you can get involved
What this all means is that if you have thought about becoming a member of the A4L Community / SDPC in the past, now is a great time to get involved. You would still have until September 15 to provide feedback on the current NDPA v2.3 review, and after that we are actively looking for a variety of voices and adding opportunities for them to participate. To learn more about the broader benefits of membership and to apply to be a member, you can find that information here or reach out to me, David Sallay, Director of Data Privacy.