School-led review · Catholic
Privacy Compliance for Catholic Schools
Catholic systemic schools are governed by the federal Privacy Act and Australian Privacy Principles, and each diocese or system sets its own rules for technology and AI. Descant provides the privacy, security and data-handling evidence your diocese or school needs for its review.
Key Details
- Enacted
- 1988
- Privacy Principles
- 13 Australian Privacy Principles (APPs)
- Regulator
- Office of the Australian Information Commissioner (OAIC)
Legislation Overview
Privacy Act 1988 (Cth)
Regulated by the Office of the Australian Information Commissioner (OAIC)
Key Provisions
- 13 Australian Privacy Principles (APPs) governing collection, use, storage, and disclosure of personal information
- Notifiable Data Breaches scheme — mandatory notification for eligible data breaches
- APP 8 — Cross-border disclosure restrictions (student records are stored and processed in Australia)
- APP 11 — Security of personal information (encryption, access controls, audit logging)
- ISA/NCEC Privacy Compliance Manual (April 2025), section 18 — artificial intelligence
- From 10 December 2026, privacy policies must describe computer programs that make, or substantially help make, decisions that significantly affect individuals
- Australia's Children's Online Privacy Code is due to be registered by 10 December 2026
Data Breach Notification
Mandatory — The Notifiable Data Breaches (NDB) scheme requires organisations to notify the OAIC and affected individuals when a data breach is likely to result in serious harm. Catholic schools must have breach response procedures in place.
AI Governance Framework
ISA/NCEC Privacy Compliance Manual (April 2025), section 18; diocesan AI rules — The Privacy Compliance Manual (April 2025) has a section on AI that suggests a privacy impact assessment for each AI system, specific collection notices, human oversight and labelling of AI content. CEnet published a Framework for the Use of Generative AI in Catholic Education in 2024, and a national Catholic AI Governance Framework is in draft (2026). Dioceses and systems set their own rules on top.
Catholic schools: rules for using AI with student information
There is no single Catholic rule on generative AI. The ISA/NCEC Privacy Compliance Manual applies across the sector, and dioceses and systems set their own rules on top. Descant's recording, note drafting and report drafting use AI with identified student information, so check your diocese's rules before using them.
What the rules say
- Privacy Compliance Manual 18.1: "Use of personal information in connection with an AI system may pose serious privacy risks and schools may wish to consider seeking specific advice and implementing appropriate AI governance measures before an AI system is adopted."
- Its tips include a privacy impact assessment "for each AI system", contracts that prevent the provider using personal information "for other purposes, such as training other products", human oversight, and labelling AI content.
- MACS Code of Conduct for staff (2025): "We must not enter personally identifiable information or corporate data into such tools", alongside using "MACS-issued artificial intelligence (AI) tools appropriately".
- OAIC guidance (January 2025): "Consent cannot be implied merely because an individual was notified of a proposed collection of personal information."
What Descant does
- AI features are an optional paid add-on, off unless a school adds them, and a school can switch AI off at any time. With AI off, nothing is sent to an AI model, and case management, referrals, digital consent and notes staff write themselves keep working.
- A school can require recorded parent or carer consent before AI processes a student's information.
- AI drafts stay with the staff member. They are labelled as AI-assisted, reviewed before saving, and never sent to families automatically.
- Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
What your school does
- Check your diocese's or system's AI rules first. MACS schools need MACS approval before staff enter identifiable information into an AI tool.
- Complete a privacy impact assessment for the AI features, and update your collection notice to cover AI drafting and recordings.
- Where consent is needed, make it specific and recorded; Descant's consent setting can require it before AI runs.
- Or use Descant with AI off while you check.
Sources
- ISA/NCEC Privacy Compliance Manual (PDF) (April 2025)
- MACS Code of Conduct for MACS Staff (PDF) (v2.0, 2025)
- CEnet AI Congress 2026 (read 18 October 2026)
- OAIC: privacy and the use of commercially available AI products (updated 17 January 2025)
This is general information, not legal advice, and policies change. Check the current documents, and confirm your approach with your diocese or system, before you decide.
Vendor Assessment Pathway
Here's the process your school follows to adopt a new platform in Catholic Schools. We'll support you at every step.
- Step 1
Diocese or System Review
Technology procurement in Catholic systemic schools is typically coordinated at the diocese or system level. The diocesan IT team reviews new platforms for privacy, security, AI use and educational suitability.
- Step 2
Privacy Assessment (APPs)
The vendor is assessed against Australian Privacy Principles. We provide privacy, security and data-handling evidence for your privacy impact assessment, covering data handling, security controls, AI use, and where data is stored.
- Step 3
Diocese Procurement Approval
The diocese education office or school principal (depending on governance structure) approves the platform, and decides whether AI features are on. Some dioceses may require school council endorsement.
- Step 4
School Deployment
Wellbeing teams are onboarded with training and support. The school reviews its use regularly against the ISA/NCEC Privacy Compliance Manual.
Catholic Schools School Privacy Requirements: What Descant Provides
What Descant does for each privacy and security requirement your Catholic Schools review will check, and the evidence we provide.
APP 1 — Open and transparent management of personal information
Clear privacy policy, transparent data handling practices, and published information about how student data is processed and protected, including how AI is used.
APP 6 — Use or disclosure of personal information
Student information is used solely for wellbeing documentation within the school. No data shared with third parties for marketing or unrelated purposes.
APP 8 — Cross-border disclosure
Student records are stored and processed in Australia (Sydney), and speech-to-text and AI drafting run in Australia. Some supporting services, such as email delivery and payments, run overseas; our Privacy Policy lists them.
APP 11 — Security of personal information
Encrypted in transit and at rest. Role-based access controls. New passwords of at least 14 characters with upper and lower case, a number and a symbol, plus optional two-step sign-in (a one-time code) that a school can make compulsory. Views of student records and sensitive notes, and every change, are logged. Audit logs are kept for at least 7 years.
Notifiable Data Breaches scheme
Documented incident response procedures. We notify affected schools within 72 hours of becoming aware of a data breach likely to result in serious harm and support them with OAIC notification.
ISA/NCEC Privacy Compliance Manual (section 18, AI)
We provide the evidence your school needs to review Descant against the April 2025 manual. AI is an optional paid add-on, off unless the school adds it. A school can switch AI off at any time, or require recorded parent or carer consent before AI runs. AI drafts are labelled, reviewed by staff before saving, and never sent to families automatically.
Data minimisation and audio handling
Audio is deleted once it's transcribed. Only text documentation is retained, which limits what is kept.
AI training data protection
No student or staff data is used to train AI models. Our AI providers do not keep school data or use it for training. Your school's data stays exclusively yours.
Governance Bodies by State
Key organisations that coordinate procurement and governance for catholic schools across Australia.
Catholic Education Network
Technology services for Catholic dioceses. Published a Framework for the Use of Generative AI in Catholic Education (2024); a national AI Governance Framework is in draft (2026)
Melbourne Archdiocese Catholic Schools
Runs Catholic schools in the Archdiocese of Melbourne. Its 2025 staff code limits identifiable information in AI tools
Victorian Catholic Education Authority
Coordinates Catholic education across the Victorian dioceses
Catholic Education Queensland Limited
Replaced QCEC on 1 January 2026 for Queensland Catholic education
Catholic Education South Australia
Catholic schools in the Archdiocese of Adelaide and the Diocese of Port Pirie
Catholic Education Western Australia
Its AI Framework (v1.1, December 2024) requires AI tools to be on its Approved Technology list
Catholic Education Canberra Goulburn
Catholic schools across the ACT and southern NSW
Catholic Education Tasmania
Coordinates the Catholic schools in Tasmania
Catholic Education Northern Territory
Runs the Catholic schools in the Northern Territory
Frequently Asked Questions
Something we haven't answered? Ask us and a person from the team will reply.
Ask a questionHow does procurement work for Catholic systemic schools?
Catholic systemic schools typically procure technology through their diocese or system education office. Dioceses (like MACS in Victoria or CEWA in Western Australia) set procurement and AI rules for their schools. We work with both diocesan IT teams and individual school leaders to support the assessment process.
Does Descant align with the ISA/NCEC Privacy Compliance Manual?
The ISA/NCEC Privacy Compliance Manual (April 2025) has a section on artificial intelligence. Your school or diocese makes that assessment, and we provide the privacy, security and data-handling evidence it needs. Staff review every AI draft before it is saved, drafts are labelled, students do not use AI in Descant, no student data is used for AI training, and student records are stored and processed in Australia.
Do we need parental consent to use AI features?
It depends on your diocese's rules and how you use AI. The OAIC says consent "cannot be implied merely because an individual was notified", and the manual suggests a specific collection notice for AI. Descant can require recorded parent or carer consent before AI processes a student's information. Where a system bars identifiable information in AI tools, as the MACS staff code does, consent alone does not lift that rule; use Descant with AI off until the system approves it.
How does the Rome Call for AI Ethics relate to using AI in Catholic schools?
The Rome Call for AI Ethics promotes responsible, transparent AI use aligned with human dignity. Brisbane Catholic Education is an ambassador for this initiative. Descant is built around human oversight of all AI output, no AI decisions about students, and transparent data handling — principles the Rome Call also emphasises.
Can individual Catholic schools make their own procurement decisions?
This varies by diocese. In some dioceses, schools have significant autonomy for wellbeing-specific tools. In others, all technology procurement is centralised. We recommend checking with your diocesan IT team first, and we are happy to engage directly with them to support the assessment process.
What support do you provide during the assessment process?
We provide a compliance pack with privacy, security and data-handling evidence for your privacy impact assessment, including security specifications, data handling procedures, and how AI is used. We also make ourselves available for direct engagement with your diocesan IT or compliance team.
Need Help With Your School's Vendor Assessment?
We'll provide the documentation your school needs to complete the assessment process in Catholic Schools. Request a compliance pack and we'll be in touch.
See Descant with your school in mind
Tell us a little about your school and we'll show you how it would work for your team.
- A made-up school like yours to explore for 14 days
- We check each request by hand and reply within two school days
- Made-up students only: no real student information needed
Prefer email? Write to [email protected].
(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.