School-led review · Independent
Privacy Compliance for Independent Schools
Independent schools — including Anglican, Jewish, Muslim, and other faith-based schools — make their own technology decisions under the federal Privacy Act, and set their own rules for AI. Descant provides the privacy, security and data-handling evidence your school needs for its review.
Key Details
- Enacted
- 1988
- Privacy Principles
- 13 Australian Privacy Principles (APPs)
- Regulator
- Office of the Australian Information Commissioner (OAIC)
Legislation Overview
Privacy Act 1988 (Cth)
Regulated by the Office of the Australian Information Commissioner (OAIC)
Key Provisions
- 13 Australian Privacy Principles (APPs) governing collection, use, storage, and disclosure of personal information
- Notifiable Data Breaches scheme — mandatory notification for eligible data breaches
- APP 8 — Cross-border disclosure restrictions (student records are stored and processed in Australia)
- APP 11 — Security of personal information (encryption, access controls, audit logging)
- ISA/NCEC Privacy Compliance Manual (April 2025), section 18 — artificial intelligence
- From 10 December 2026, privacy policies must describe computer programs that make, or substantially help make, decisions that significantly affect individuals
- Individual school procurement autonomy — board or principal makes technology decisions
Data Breach Notification
Mandatory — The Notifiable Data Breaches (NDB) scheme requires organisations to notify the OAIC and affected individuals when a data breach is likely to result in serious harm. Independent schools must have breach response procedures in place.
AI Governance Framework
ISA/NCEC Privacy Compliance Manual (April 2025), section 18; school and association guidance — The Privacy Compliance Manual (April 2025) has a section on AI that suggests a privacy impact assessment for each AI system, specific collection notices, human oversight and labelling of AI content. Independent Schools NSW has an AI Implementation Framework and an AI Tools Endorsement Scale for members (members only). Each school sets its own AI rules.
Independent schools: rules for using AI with student information
There is no single independent-sector rule on generative AI. The ISA/NCEC Privacy Compliance Manual applies across the sector, and each school sets its own policy. Descant's recording, note drafting and report drafting use AI with identified student information, so your policy should cover them.
What the guidance says
- Privacy Compliance Manual 18.1: "Use of personal information in connection with an AI system may pose serious privacy risks and schools may wish to consider seeking specific advice and implementing appropriate AI governance measures before an AI system is adopted."
- Its tips include a privacy impact assessment "for each AI system", a specific collection notice where needed, human oversight, auditing staff use and labelling AI content.
- OAIC guidance (January 2025): "Consent cannot be implied merely because an individual was notified of a proposed collection of personal information."
- Australian Framework for Generative AI in Schools: school communities are informed about data use "and consent is sought where needed".
What Descant does
- AI features are an optional paid add-on, off unless a school adds them, and a school can switch AI off at any time. With AI off, nothing is sent to an AI model, and case management, referrals, digital consent and notes staff write themselves keep working.
- A school can require recorded parent or carer consent before AI processes a student's information.
- AI drafts stay with the staff member. They are labelled as AI-assisted, reviewed before saving, and never sent to families automatically.
- Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
What your school does
- Check that your AI policy covers staff tools that hold student information, and whether your association has guidance for members.
- Complete a privacy impact assessment for the AI features, and update your collection notice to cover AI drafting and recordings.
- Decide on parent consent; Descant's consent setting can require recorded consent before AI runs.
- Or use Descant with AI off.
Sources
- ISA/NCEC Privacy Compliance Manual (PDF) (April 2025)
- OAIC: privacy and the use of commercially available AI products (updated 17 January 2025)
- Australian Framework for Generative AI in Schools (page modified 17 June 2025)
- ST4S Excluded / High Risk list (marked as being updated, 31 August 2026)
This is general information, not legal advice, and policies change. Check the current documents before you decide.
Vendor Assessment Pathway
Here's the process your school follows to adopt a new platform in Independent Schools. We'll support you at every step.
- Step 1
School-Level Review
Independent schools have individual procurement autonomy. The principal, IT coordinator, or wellbeing lead identifies the need, reviews available platforms, and checks the school's own AI policy.
- Step 2
Privacy & Security Assessment
The school assesses the platform against Australian Privacy Principles. We provide a compliance pack with privacy, security and data-handling evidence for your privacy impact assessment — data handling, security controls, how AI is used, and where data is stored.
- Step 3
Board or Principal Approval
Depending on your school's governance structure, the school board, principal, or business manager approves the platform and decides whether AI features are on. Some schools may seek parent community input through normal governance channels.
- Step 4
Deployment & Training
Wellbeing teams are onboarded with dedicated training and ongoing support. We work directly with your school to ensure a smooth rollout.
Independent Schools School Privacy Requirements: What Descant Provides
What Descant does for each privacy and security requirement your Independent Schools review will check, and the evidence we provide.
APP 1 — Open and transparent management of personal information
Clear privacy policy, transparent data handling practices, and published information about how student data is processed and protected, including how AI is used.
APP 6 — Use or disclosure of personal information
Student information is used solely for wellbeing documentation within your school. No data shared with third parties for marketing or unrelated purposes.
APP 8 — Cross-border disclosure
Student records are stored and processed in Australia (Sydney), and speech-to-text and AI drafting run in Australia. Some supporting services, such as email delivery and payments, run overseas; our Privacy Policy lists them.
APP 11 — Security of personal information
Encrypted in transit and at rest. Role-based access controls. New passwords of at least 14 characters with upper and lower case, a number and a symbol, plus optional two-step sign-in (a one-time code) that a school can make compulsory. Views of student records and sensitive notes, and every change, are logged. Audit logs are kept for at least 7 years.
Notifiable Data Breaches scheme
Documented incident response procedures. We notify affected schools within 72 hours of becoming aware of a data breach likely to result in serious harm and support them with OAIC notification.
ISA/NCEC Privacy Compliance Manual (section 18, AI)
We provide the evidence your school needs to review Descant against the April 2025 manual. AI is an optional paid add-on, off unless the school adds it. A school can switch AI off at any time, or require recorded parent or carer consent before AI runs. School data is not used for AI training.
Data minimisation and audio handling
Audio is deleted once it's transcribed. Only text documentation is retained, which limits what is kept.
Human oversight of AI output
AI drafts are labelled as AI-assisted, reviewed and edited by staff before they are saved, and never sent to families automatically. AI drafts — your staff decide.
Governance Bodies by State
Key organisations that coordinate procurement and governance for independent schools across Australia.
Independent Schools Victoria
Technology guidance and professional development for Victorian independent schools
Independent Schools NSW
Formerly AISNSW. Has an AI Implementation Framework and an AI Tools Endorsement Scale for member schools (members only)
Independent Schools Queensland
AI resources, events and professional development for Queensland independent schools
Association of Independent Schools SA
Guidance and professional development for South Australian independent schools
Association of Independent Schools WA
Its AI Guidelines for Schools 2024 page points schools to the national framework for generative AI
Association of Independent Schools NT
Guidance and support for Northern Territory independent schools
Association of Independent Schools ACT
Guidance for ACT independent schools on technology and procurement
Frequently Asked Questions
Something we haven't answered? Ask us and a person from the team will reply.
Ask a questionDo independent schools need to complete ST4S assessment?
As at August 2026, the ST4S Excluded / High Risk list (marked as being updated, 31 August 2026) shows AI services that process health and wellbeing data, or personal or sensitive information, as not assessed by ST4S. This is a scope decision, not an assessment outcome. Independent schools considering Descant should follow their own governance and procurement processes and complete an internal risk assessment. We provide privacy, security, and data-handling evidence to support that review.
How does procurement differ for faith-based schools?
Anglican, Jewish, Muslim, and other faith-based independent schools follow the same Privacy Act and APPs as secular independent schools. The key difference is governance — some faith-based school networks coordinate procurement centrally (similar to Catholic dioceses), while others have individual school autonomy. We work with whatever governance structure your school uses.
Who approves a new platform in an independent school?
Usually the principal or school board, without state-level or systemic approval. The same people decide whether AI features are on. We provide privacy, security and data-handling evidence for that assessment.
Do we need parental consent to use AI features?
It depends on your school's policy and how you use AI. The OAIC says consent "cannot be implied merely because an individual was notified", and the ISA/NCEC manual suggests a specific collection notice for AI where needed. Descant can require recorded parent or carer consent before AI processes a student's information, or run with AI off.
Does the Independent Schools NSW AI framework apply to us?
Independent Schools NSW (formerly AISNSW) has an AI Implementation Framework and an AI Tools Endorsement Scale for its member schools. Both are members-only, so check them with your school. We provide the privacy, security and data-handling evidence a review against them needs, including human oversight, data minimisation and transparency.
What happens to our data if we stop using the platform?
When your agreement ends, we export your records on request, then delete them within 90 days and confirm in writing.
Need Help With Your School's Vendor Assessment?
We'll provide the documentation your school needs to complete the assessment process in Independent Schools. Request a compliance pack and we'll be in touch.
See Descant with your school in mind
Tell us a little about your school and we'll show you how it would work for your team.
- A made-up school like yours to explore for 14 days
- We check each request by hand and reply within two school days
- Made-up students only: no real student information needed
Prefer email? Write to [email protected].
(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.