NDPA v2: Key changes from NDPA v1

Key points to note for NDPA v2:

• NDPA examples of usage:
  • In the Standard NDPA, Exhibit E is no longer optional.  
  • If a Vendor does not want to sign an Exhibit E, then a Vendor-Specific or District-Modified NDPA version should be used.
  • The Exhibit H checkbox has been removed from NDPA v2, and is only available on the Vendor-Specific or District-Modified NDPA version.  If the Parties desire to change any terms, use the ‘Vendor-Specific’ Agreement or ‘District-Modified’ Agreement.

• For version 2, additional space has been created for all fillable fields (based on feedback received during Community Review).  

• It was agreed that as much white space within the document be removed to ensure that the length of the NDPA document is as condensed as possible, whilst allowing for sufficient space for fillable content to be inserted. 

• Exhibit A & B:  An ‘Addendum’ has been introduced for Vendors to provide changes to the NDPA, ONLY when adding or deleting products or services.
  • This will remove the need for a ‘new’ NDPA to be signed for Originators or Subscribers.
  • The process is outlined in the Usage Guidance document:
    • Vendor non-members: Please request a copy of the Addendum by emailing ndpa_requests@A4L.org.  On completing the Addendum, Vendors will have to ensure that ALL Originating and Subscribing LEAs are notified.
    • Vendor Members: Will complete the Addendum online (in the SDPC Resource Registry), and upon submission all Originating and Subscribing LEAs will be notified electronically.

• Exhibit D:  Included the following at the top of the page:
  • After this DPA takes effect, if the LEA has special requirements for the disposition of Student Data that are not expressed in 4.6 Disposition of Data, the LEA may fill in this form and deliver it to the Provider. The Provider and the LEA must not fill in this form at the initiation of the DPA.

• Exhibit F:  A list of ‘adequate cybersecurity frameworks’ has been included in the NDPA
  • All references to EdSpex have been removed.

• Exhibit G:  Updated so that (taken from Usage Guidance document):
  • The scope of these State Supplements will be to address the requirements of any state specific data privacy statutes and their requirements to the extent that they require terms in addition to, or different from, the National Standard Clauses.  Exhibit “G” terms should be limited to those mandated by specific laws or regulations.

• Exhibit H can be used to display simple copies of minimum changes or an entire redline of the DPA.

• Vendor Signatory Badges:
  • Will be made available for the Standard NDPA (‘Standard’) and the Vendor-Specific NDPA (‘Modified’), but will not be available for the District-Modified NDPA.

Additional guidance can be found in the NDPA v2 Usage Guidance document. Any questions, please contact us.

PLEASE NOTE:  Any Vendor wishing to sign a NDPA v2 should reach out to a participating school district or Alliance to request a copy of the STATE-SPECIFIC Agreement (which may have additions in Exhibit G).