School-led review · ACT

Privacy Compliance for ACT Schools

ACT public schools follow the Information Privacy Act 2014 and the Territory Privacy Principles, and the Education Directorate's position on AI says no student's personal information may be entered into generative AI. Descant provides the privacy, security and data-handling evidence your school needs for its review, and can be used with AI switched off.

Request a Compliance Pack ← All States

Key Details

Enacted: 2014
Privacy Principles: 13 Territory Privacy Principles (TPPs)
Regulator: Office of the Australian Information Commissioner (under an arrangement with the ACT) (OAIC)

Legislation Overview

Information Privacy Act 2014

Regulated by the Office of the Australian Information Commissioner (under an arrangement with the ACT) (OAIC)

Key Provisions

13 Territory Privacy Principles (TPPs), closely aligned with the federal Australian Privacy Principles (APPs)
The OAIC performs some ACT Information Privacy Commissioner functions under an arrangement with the ACT
The Health Records (Privacy and Access) Act 1997 governs health records
The Directorate's AI position: generative AI for low to medium risk tasks only, and no student personal information entered into generative AI
Only AI tools that meet Directorate and whole-of-government privacy, security and safety assessments are endorsed (Minister's answer, December 2025)
Any software application that requires sign-in also requires third-party permission forms from families
ACT Government AI Policy (May 2025): directorates self-assess AI initiatives, including generative AI built into commercial products, and submit them to the AI Advisory Group

Data Breach Notification

Not currently mandatory — The Commonwealth Notifiable Data Breaches scheme does not generally apply to ACT government agencies, except for tax file number information (OAIC, 2023). ACT Government policy is to report significant privacy breaches to the OAIC voluntarily. Non-government schools covered by the federal Privacy Act are under the scheme.

AI Governance Framework

Education Directorate position on the use of AI in ACT public schools — The position applies to "all generative AI tools used in ACT public schools and by all directorate staff". Staff may use generative AI for low to medium risk tasks, and it says: "No student's personal information, including but not limited to, their name, age, location, assessment work, behaviour and learning capacity, may be entered into generative AI."

ACT public schools: the Education Directorate's position on AI

The Directorate's position on the use of AI in ACT public schools applies to all generative AI tools and all Directorate staff. Descant's recording, note drafting, report drafting and evidence summaries work with identified student information, so they fall outside what the position allows unless the Directorate says otherwise.

What the position says

Generative AI "is available for staff to use for low to medium risk use cases", and staff "should refrain from using generative AI for high-risk use cases, such as personally identifiable data".
"No student's personal information, including but not limited to, their name, age, location, assessment work, behaviour and learning capacity, may be entered into generative AI."
"Any software application that requires sign-in also requires third-party permission forms."
The Minister's answer (December 2025): "Only AI tools that meet Directorate and whole-of-government privacy, security and safety assessments are endorsed", and teachers use AI "under a human-in-the-loop model".

What Descant does

AI features are an optional paid add-on, off unless a school adds them, and a school can switch AI off at any time. With AI off, nothing is sent to an AI model, and case management, referrals, digital consent and notes staff write themselves keep working.
A school can require recorded parent or carer consent before AI processes a student's information.
AI drafts stay with the staff member. They are labelled as AI-assisted, reviewed before saving, and never sent to families automatically.
Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.

What your school does

Use Descant with AI off. Case management, referrals, digital consent, support plans and manually written notes do not use AI.
Parent consent does not unlock AI here: the position bars student personal information in generative AI, whatever consent is in place.
Using AI features would need the Directorate to assess and endorse them, including the ACT Government AI Policy self-assessment. Contact [email protected].
Get third-party permission forms from families for software that needs sign-in.

Sources

Position on the use of AI in ACT public schools (PDF) (undated PDF; announced February 2025)
Technology in ACT public schools (updated 8 October 2026)
ACT Legislative Assembly, answer to question on notice 111 (answer due 5 December 2025)
ACT Government Artificial Intelligence Policy (policy May 2025; page updated 17 March 2026)
OAIC: summary of 7 ACT directorates' data breach response plans (6 September 2023)

This is general information, not legal advice, and policies change. Check the current pages, and confirm your approach with the Directorate, before you decide.

Using AI with student information in ACT schools →

Vendor Assessment Pathway

Here's the process your school follows to adopt a new platform in Australian Capital Territory. We'll support you at every step.

Step 1
Directorate Assessment and Endorsement

The Education Directorate endorses tools after Directorate and whole-of-government privacy, security and safety assessments. The school does not classify the tool itself. We provide the privacy, security and data-handling evidence for that assessment.
Step 2
Third-Party Permission Forms

Software that needs sign-in also needs third-party permission forms from families. We provide plain-language information about what Descant holds and where.
Step 3
AI Features Stay Off

Under the Directorate's position, student personal information may not be entered into generative AI, so schools use Descant with AI off. AI use would need the Directorate to change or waive the rule and to complete its ACT Government AI Policy self-assessment.
Step 4
Deployment

Wellbeing staff are onboarded to the platform. The school reviews its use regularly against the Information Privacy Act and the Directorate's position.

Australian Capital Territory School Privacy Requirements: What Descant Provides

What Descant does for each privacy and security requirement your Australian Capital Territory review will check, and the evidence we provide.

Descant evidence trail on a student record: collect source evidence, review and file, connect to annual adjustments, annual Student 360 record — Every source keeps a visible review trail. Illustrative students and details.

TPP 11 — Security of personal information

Encrypted in transit and at rest. Role-based access controls. New passwords of at least 14 characters with upper and lower case, a number and a symbol, plus optional two-step sign-in (a one-time code) that a school can make compulsory. Views of student records and sensitive notes, and every change, are logged.

TPP 6 — Use and disclosure limitations

Data is used solely for documentation purposes within your school. No data shared with third parties for marketing or other purposes.

Directorate AI position — student personal information

With AI on, the audio and text sent for drafting contain identified student information, which the Directorate's position does not allow. AI is an optional paid add-on, off unless the school adds it, and with AI off staff write notes themselves.

Data residency in Australia

Student records are stored and processed in Australia (Sydney). Speech-to-text and AI drafting also run in Australia, and audio is deleted once transcribed. Some supporting services, such as email delivery and payments, are overseas.

Audio data handling

Audio is deleted once it's transcribed. Only text documentation is retained.

Audit trail and compliance reporting

Views of student records and sensitive notes, and every change, are logged. Audit logs are kept for at least 7 years and are available for compliance reporting and incident investigation.

AI transparency and human oversight

Where AI is used, drafts are labelled as AI-assisted, reviewed by staff before saving, and never sent to families automatically. No AI training on school data.

Who uses the platform

Staff use the platform. Students only use secure links, for a short check-in or a questionnaire their school sends, with no AI. Parents and carers use secure links for consent and questionnaires, and educators sign in to add evidence. Students do not use AI in Descant.

Guidance by School Sector

Different school sectors in Australian Capital Territory have different procurement processes. Select your sector for specific guidance.

Government Schools

Key body: ACT Education Directorate

The Directorate's position bars student personal information in generative AI and endorses only tools that pass its assessments. Government schools can use Descant with AI off, after Directorate endorsement.

Information Privacy Act 2014 and Territory Privacy Principles govern personal information handling
No student personal information may be entered into generative AI
Tools are endorsed after Directorate and whole-of-government privacy, security and safety assessments
Third-party permission forms are needed for software that requires sign-in
A staff risk matrix is available to ACT public schools on the internal ConnectED Service Portal

Catholic Schools

Key body: Catholic Education Canberra-Goulburn (CECG)

Catholic Education Canberra-Goulburn runs Catholic schools across the Archdiocese of Canberra and Goulburn. Check with it about technology procurement and any rules on AI tools.

Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
The Notifiable Data Breaches scheme applies
The ISA/NCEC Privacy Compliance Manual (April 2025) suggests a privacy impact assessment for each AI system
Check whether CECG expects an ST4S assessment
Individual schools work within CECG procurement and technology frameworks

Independent Schools

Key body: Association of Independent Schools of the ACT (AISACT)

Independent schools in the ACT have procurement autonomy, and each school sets its own rules on AI. No public AISACT guidance on AI was found as at October 2026.

Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
Individual school board or principal makes procurement decisions
AISACT provides guidance and professional development resources
PIA recommended — we provide privacy, security and data-handling evidence for your privacy impact assessment
The Notifiable Data Breaches scheme applies

Frequently Asked Questions

Something we haven't answered? Ask us and a person from the team will reply.

Ask a question

What does the Directorate's AI position mean for our school?

The Education Directorate's position applies to all generative AI tools used in ACT public schools. Staff may use generative AI for low to medium risk tasks, but no student's personal information, including name, behaviour and learning capacity, may be entered into generative AI. Descant's AI features work with identified student information, so ACT public schools use Descant with AI off unless the Directorate says otherwise.

Are the Territory Privacy Principles different from the Australian Privacy Principles?

The 13 Territory Privacy Principles (TPPs) under the Information Privacy Act 2014 are closely aligned with the federal Australian Privacy Principles (APPs). The OAIC performs some ACT Information Privacy Commissioner functions under an arrangement with the ACT. We provide the privacy, security and data-handling evidence your school needs to review Descant against both.

How does Descant handle student data mentioned in wellbeing notes?

Wellbeing staff use the platform to document support sessions. With AI off, staff write notes themselves and nothing is sent to AI. Where AI is on, the audio and transcript sent for drafting contain identified student information, and the staff member reviews the draft before saving. Audio recordings are deleted once transcribed — only the text documentation is retained.

Is parental consent required for wellbeing staff to use this platform?

Any software application that requires sign-in also requires third-party permission forms, so families are asked first. Consent does not lift the Directorate's rule against entering student personal information into generative AI, so AI features stay off for ACT public schools.

What happens to our data if we stop using the platform?

When your agreement ends, we export your records on request, then delete them within 90 days and confirm in writing.

Does the Notifiable Data Breaches scheme apply to ACT public schools?

Not generally. The OAIC says it is not mandatory for ACT agencies to comply with the scheme, except for tax file number information, and ACT Government policy is to report significant privacy breaches to the OAIC voluntarily. The scheme does apply to non-government schools. Either way, we notify affected schools within 72 hours of becoming aware of a data breach likely to result in serious harm and support any report.

Need Help With Your School's Vendor Assessment?

We'll provide the documentation your school needs to complete the assessment process in Australian Capital Territory. Request a compliance pack and we'll be in touch.

Request a Compliance Pack ← Back to All States