; or (2) may utilize technology other than secure multiparty computation technologies if the other technology— (A) fully complies with subparagraphs (A) through (C) of subsection (b)(1); and (B) delivers greater student privacy and security than secure multiparty computation. (d) Rules and guidance (1) In general By not later than 1 year after the date of enactment of this Act, the Secretary, acting through the Commissioner, shall issue rules regarding how reporting entities, and other entities performing the reporting duties in accordance with section 4(a)(2)(B), shall comply with the requirements established under this Act and the amendments made to the Higher Education Act of 1965 ( 20 U.S.C. 1001 et seq.) by this Act. Such rules shall— (A) establish common definitions for reporting entities to follow in submitting the data components required under section 4; and (B) establish the collection and submission requirements for the higher education data system. (2) Protection of data The Secretary shall promulgate and periodically review rules or guidance relating to security under this Act, which shall govern the access, use, and disclosure of data collected in connection with the activities authorized in this Act. The rules or guidance described in this paragraph shall— (A) be consistent with the need to protect data from unauthorized access, use, and disclosure; and (B) include— (i) an audit capability and requirements for routine audits; (ii) access controls; and (iii) requirements to ensure sufficient data security, quality, validity, and reliability. (3) Review Every 5 years, the Secretary shall review, and update as appropriate, the rules and guidance issued under paragraphs (1) and (2). (e) Notice The Secretary shall provide a clear, prominent, comprehensible, and non-misleading notice of the requirements of this section that shall— (1) describe how the requirements of this section are to be implemented, and how personal information is to be collected, used, analyzed, or retained pursuant to this Act