Victorian schools and early learning centres hold a lot of sensitive information about children and families, and the law expects you to protect it. Which rules apply depends on the type of school or service. Government schools follow Victorian privacy law. Independent schools and early learning centres often have obligations under the federal Privacy Act as well, along with Victorian health records rules. Whichever applies to you, the practical steps are much the same: know what you hold, limit who can see it, secure it, and know what to do if something goes wrong.

This is general information, not legal advice. We’re IT people, not lawyers, so check your own obligations with your peak body, insurer or a lawyer.

What you’re actually holding

Most centres and schools hold more than they realise:

• Names, addresses and birth dates for children and parents
• Family and custody arrangements
• Medical conditions, allergies and immunisation records
• Learning, development and behaviour notes
• Photos and videos of children
• Enrolment, payment and bank details
• Staff records, including identity and qualification documents

Health information is classed as sensitive information under privacy law, which carries a higher standard of care. Children’s personal information also deserves particular care, because the impact can be serious if it’s accessed, shared or exposed without permission.

Which rules apply

It depends on who you are.

• Victorian government schools follow the Privacy and Data Protection Act 2014 (Vic) and the Health Records Act 2001 (Vic).
• Independent schools and early learning centres can be covered by the federal Privacy Act and its Australian Privacy Principles, depending on their size and what they do. Small organisations are often exempt, but there are exceptions, so it isn’t something to assume either way. Health information can also fall under the Victorian Health Records Act.
• Early learning services also have record-keeping and privacy duties under the Education and Care Services National Law and Regulations.

The Notifiable Data Breaches scheme only applies to organisations covered by the federal Privacy Act. If that’s you, and personal information is exposed in a way that’s likely to cause serious harm, you may have to tell the people affected and the Office of the Australian Information Commissioner.

Where children’s information hides

The main student or enrolment system is usually the best protected part. The risk is in the places that are easy to forget:

• Enrolment forms scanned and saved to a shared drive
• Medical and allergy lists in a shared email inbox
• Photos sitting on personal phones
• Learning, booking and communication apps that hold child and family details
• Old laptops, tablets and USB drives
• Accounts belonging to staff who have left

A good test is to ask whether your director or principal could list every place a child’s record might be stored, and who can reach each one.

Practical steps that make a real difference

• Turn on multi-factor authentication for email and any system holding child or family records. Our guide to multi-factor authentication explains how it works.
• Give every staff member their own login, with access that matches their role. Educators, admin and finance don’t all need to see everything.
• Set a clear rule for photos. Use centre devices rather than personal phones, and decide where photos are stored and who can see them.
• Keep every computer and tablet updated and protected, with security software, regular patching and someone watching for problems. Lock and secure devices too, so a lost one doesn’t become a data breach.
• Secure your email, shared files and user accounts in Microsoft 365, because that’s where a lot of children’s information ends up in day-to-day work. See our guide to Microsoft 365 security best practices.
• Have backups that are checked, and a simple recovery plan, so one failed device or attack doesn’t wipe out your records.
• Check where your apps and software providers store data, and who can access it.
• Have a simple process for staff who start, change roles or leave, including casuals and relief staff, and remove access straight away when someone goes.
• Train staff to spot suspicious emails, because many breaches begin with a single click on a suspicious email.
• Keep a short written plan for what you’ll do if something goes wrong.

Our cybersecurity checklist for Australian businesses is a good place to see where you stand.

If something does go wrong

Stay calm and work through it in order. Contain the problem first, for example by disconnecting the affected device or locking an account, but avoid wiping or rebuilding anything before you’ve kept a record of what happened. Access logs that show which account opened what, and when, can be vital later. Then work out what information was involved and whose it was, and decide who needs to be told and when. Bring in your IT provider and get privacy or legal advice early. If you’re covered by the Privacy Act, there are rules and timeframes for assessing and reporting a serious breach.

How we help at Hyetech

We’ve supported Victorian businesses since 2007, including early learning centres and schools. We know you need more than someone to fix computers when they break. You need reliable systems, access that’s properly managed, security that’s monitored, and help when your staff need it. We look after networks, Microsoft 365, device security, backups, updates and day-to-day IT support, and our local team can come onsite when something needs hands-on attention. You can read more on our childcare IT support page, or in our overview of IT support for early learning centres and schools.

Questions to ask your IT provider

• Do you monitor our systems, and what happens when you spot a problem?
• Are security updates being applied to every device?
• Are our backups checked, and could we recover quickly if we needed to?
• How quickly is access removed when someone leaves, and can former staff still get to our information?
• Are our devices protected if one is lost or stolen?
• What would you do if we had a suspected data breach?

Frequently asked questions

Does the Privacy Act apply to an early learning centre?

Often, yes, but it depends on the size of the organisation and what it does. Victorian laws also apply to health information and to early learning services. Check with your peak body or a lawyer to confirm where you stand.

Are photos of children covered by privacy rules?

Yes. A photo of an identifiable child can be personal information, so how you store it and who can see it matters.

Do we have to tell parents if their child’s information is exposed?

It depends. If the Privacy Act applies and the breach is likely to cause serious harm, you may have to notify the people affected. Get advice early, because there are timeframes.

Can staff use their personal phones to take photos?

It’s safer not to. Personal phones are harder to secure and control, and photos can end up in personal cloud accounts. Centre-owned devices give you far more control.

What’s the first thing to fix?

Multi-factor authentication on email and your main systems, and one login per person. These two steps stop a lot of common problems.

Not sure where your information sits?

Talk to the Hyetech team for a free IT review. We’ll show you where children’s and families’ information is stored, who can reach it, and what we’d tighten first. Book a free review.