School-led review · NSW
Privacy Compliance for New South Wales Schools
NSW government schools follow the PPIP Act, the HRIP Act for health information, and the Department of Education's guidelines on generative AI. Descant provides the privacy, security and data-handling evidence a school needs for its review, and can be used with AI switched off.
Key Details
- Enacted
- 1998
- Privacy Principles
- 12 Information Protection Principles (IPPs)
- Regulator
- Information and Privacy Commission NSW (IPC)
Legislation Overview
Privacy and Personal Information Protection Act 1998
Regulated by the Information and Privacy Commission NSW (IPC)
Key Provisions
- 12 Information Protection Principles governing the collection, storage, use, and disclosure of personal information
- The Health Records and Information Privacy Act 2002 protects health information, which includes mental health and disability
- The Department's generative AI guidelines (updated 13 October 2026): no personal, sensitive or confidential information in AI tools the Department has not reviewed
- NSW AI Assessment Framework: applied by agencies, including the Department, to AI they procure or use; new AI use cases are registered on the AIAF Platform from 30 September 2026
- From Term 3 2025, schools buy online learning tools from the Online Learning Tools Marketplace; student administration products are outside it and sit with the Administration Marketplace for Schools
- For a product bought outside the marketplaces, the Department expects an Assessed IT check and product-specific parental consent on its templates (Audit Office NSW, June 2026)
- Privacy impact assessments are recommended by the IPC; the Audit Office notes they are not mandatory under legislation
- Mandatory data breach notification to the IPC since 28 November 2023
Data Breach Notification
Mandatory — The Mandatory Notification of Data Breach scheme has applied since 28 November 2023. NSW public sector agencies, including government schools, must notify the IPC and affected individuals of eligible data breaches likely to result in serious harm.
AI Governance Framework
NSW Department of Education generative AI guidelines; NSW AI Assessment Framework (Department level) — The Department's guidelines (updated 13 October 2026) tell staff not to enter student work or personal, sensitive or confidential information into AI tools the Department has not reviewed. Separately, NSW Government agencies must apply the NSW AI Assessment Framework when required and register AI use cases. That duty sits with the Department, not with individual schools.
NSW government schools: the Department's generative AI guidelines
The NSW Department of Education's guidelines on generative AI apply to staff in NSW government schools. Descant's recording, note drafting and report drafting use generative AI with identified student information, so the guidelines apply to those features.
What the guidelines say
- Staff using AI tools the Department has not reviewed must use professional judgement, "including not inputting student work or personal, sensitive or confidential information".
- "Ensure no private or sensitive information about individuals or the department is entered into AI tools."
- "Other tools may be approved for use once the department has assessed cyber security, safety and ethical risks." For NSWEduChat "and certain approved tools, some personal identifying information may be entered".
- More detailed AI guidance for staff sits on the Department's intranet.
What Descant does
- AI features are an optional paid add-on, off unless a school adds them, and a school can switch AI off at any time. With AI off, nothing is sent to an AI model, and case management, referrals, digital consent and notes staff write themselves keep working.
- A school can require recorded parent or carer consent before AI processes a student's information.
- AI drafts stay with the staff member. They are labelled as AI-assisted, reviewed before saving, and never sent to families automatically.
- Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
What your school does
- Use Descant with AI off unless the Department has assessed and approved its AI features. Descant is not currently a Department-approved AI tool.
- Recorded parent consent does not, on its own, lift this rule: the guidelines limit the information entered into AI tools, whatever consent is in place.
- If you buy outside the Department's marketplaces, check Assessed IT and get product-specific parent consent on the Department's template.
- Recording students generally needs consent, and health information is also protected by the Health Records and Information Privacy Act 2002.
Sources
- Guidelines regarding the use of generative AI (updated 13 October 2026)
- Audit Office NSW: Security and privacy of student information (tabled 29 June 2026)
- Technology 4 Learning news, issue 122 (Online Learning Tools Marketplace) (page updated 11 June 2026)
- NSW AI Assessment Framework (read 18 October 2026)
- Privacy and the use of third-party web and cloud-based services (page dated February 2023)
This is general information, not legal advice, and policies change. Check the current pages, and confirm your approach with the Department, before you decide.
Vendor Assessment Pathway
Here's the process your school follows to adopt a new platform in New South Wales. We'll support you at every step.
- Step 1
Marketplace or Assessed IT Check
The Department expects schools to use its marketplaces first. The Online Learning Tools Marketplace covers learning tools, not student administration products, which sit with the Administration Marketplace for Schools. Descant is not currently listed on either, so confirm the pathway with the Department and check Assessed IT.
- Step 2
Parent Consent and Due Diligence
For a product outside the marketplaces, the Department expects product-specific parental consent on its templates. The Department also provides a due diligence vendor checklist, and the IPC recommends a privacy impact assessment. We provide the privacy, security and data-handling evidence for both.
- Step 3
Decide on AI Features
AI features stay off unless the Department has assessed and approved them. The Department, not the school, applies the NSW AI Assessment Framework and registers AI use cases. We provide the evidence it needs.
- Step 4
School Deployment
The principal approves the platform, staff are onboarded with your chosen AI setting, and the school reviews its use regularly.
New South Wales School Privacy Requirements: What Descant Provides
What Descant does for each privacy and security requirement your New South Wales review will check, and the evidence we provide.
IPP 5 — Information security (data storage)
Encrypted in transit and at rest. Role-based access controls. New passwords of at least 14 characters with upper and lower case, a number and a symbol, plus optional two-step sign-in (a one-time code) that a school can make compulsory. Records stored in Australia (Sydney).
IPP 2 — Collection directly from individual
Data is collected by authorised staff during support sessions. Students only use secure links, for a short check-in or a questionnaire their school sends, with no AI.
IPP 10 — Limits on use of personal information
Data is used solely for wellbeing documentation purposes within your school. No data shared with third parties for marketing, research, or any purpose beyond service delivery.
Data residency in Australia
Student records are stored and processed in Australia (Sydney). Speech-to-text and AI drafting also run in Australia, and audio is deleted once transcribed. Some supporting services, such as email delivery and payments, are overseas.
Audio data handling
Audio is deleted once it's transcribed. Only text documentation is retained.
Mandatory data breach notification
We have a documented incident response plan. We notify affected schools within 72 hours of becoming aware of a data breach likely to result in serious harm and support them with IPC notification.
AI features and the Department's guidelines
AI is an optional paid add-on, off unless the school adds it. With AI on, the audio and text sent for drafting contain identified student information, so the Department's approval comes first. Drafts are labelled as AI-assisted, reviewed by staff before saving, and never sent to families automatically. No AI training on school data.
Audit trail for IPC compliance
Views of student records and sensitive notes, and every change, are logged. Audit logs are kept for at least 7 years and are available for compliance reporting and incident investigation.
Guidance by School Sector
Different school sectors in New South Wales have different procurement processes. Select your sector for specific guidance.
Government Schools
Key body: Department of Education (DET NSW)
The Department expects schools to use its marketplaces first. Products bought outside them are checked in Assessed IT and need product-specific parental consent. The Department's generative AI guidelines limit what staff enter into AI tools it has not reviewed.
- The Online Learning Tools Marketplace (from Term 3 2025) is for learning tools; student administration products go through the Administration Marketplace for Schools
- Products outside the marketplaces: an Assessed IT check and product-specific parental consent on the Department's templates
- The Department's due diligence vendor checklist supports the review
- A privacy impact assessment is recommended by the IPC
- AI tools need Department assessment before staff enter personal information
- Mandatory data breach notification applies to government schools since 28 November 2023
Catholic Schools
Key body: Catholic Schools NSW and diocesan offices
NSW has 11 Catholic dioceses, each with its own procurement and technology rules, including rules on AI tools. Check with your diocese before using AI features.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- Each diocese sets its own technology and AI rules; some endorse specific AI tools for staff
- CEnet published a Framework for the Use of Generative AI in Catholic Education (2024); a national Catholic AI governance framework is in draft (2026)
- The ISA/NCEC Privacy Compliance Manual (April 2025) suggests a privacy impact assessment for each AI system
- Check whether your diocese expects an ST4S assessment
Independent Schools
Key body: Independent Schools NSW (ISNSW, formerly AISNSW)
Independent Schools NSW has an AI Implementation Framework and an AI Tools Endorsement Scale for member schools (members only). Individual schools make their own technology decisions.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- Independent Schools NSW member resources on AI are for members only; check them with your school
- Individual school board or principal makes procurement decisions, including the school's own AI rules
- PIA recommended (though not always mandatory) — we provide privacy, security and data-handling evidence for your privacy impact assessment
- Includes Anglican, Christian, Jewish, Muslim, and other faith-based schools in NSW
Frequently Asked Questions
Something we haven't answered? Ask us and a person from the team will reply.
Ask a questionDo we have to buy through a Department marketplace?
The Department expects government schools to use its marketplaces first. Since Term 3 2025, online learning tools are bought from the Online Learning Tools Marketplace; student administration products are not covered by it and sit with the Administration Marketplace for Schools. The Audit Office (June 2026) notes that schools can contract with vendors outside the marketplaces, with an Assessed IT check and product-specific parental consent. Catholic and independent schools set their own rules.
What is the NSW AI Assessment Framework and does it apply to us?
The NSW AI Assessment Framework (formerly the AI Assurance Framework) applies to NSW Government agencies that design, procure or use systems with AI components. Agencies apply it when required and register AI use cases on the AIAF Platform, mandatory for new registrations from 30 September 2026. The duty sits with the Department, not individual schools, and a vendor cannot be "compliant" with it on its own; we provide the evidence the Department needs. Catholic and independent schools are not bound by it.
Do we need to notify the IPC about data breaches?
Since 28 November 2023, NSW public sector agencies — including government schools — must notify the IPC and affected individuals of eligible data breaches. Catholic and independent schools follow the federal Notifiable Data Breaches scheme under the Privacy Act. In either case, we have a documented incident response plan and will support your school through any notification process.
How does Descant handle student data mentioned in wellbeing notes?
Wellbeing staff use the platform to document support sessions. If AI is on and a staff member records or dictates a session, the audio and transcript sent for AI drafting contain identified student information; the staff member reviews and edits the draft before saving. If your school switches AI off, staff write notes themselves. Audio recordings are deleted once transcribed — only the text documentation is retained.
Can NSW government schools use AI documentation tools?
Privacy law is only part of the answer. The Department's guidelines (updated 13 October 2026) tell staff not to enter personal, sensitive or confidential information into AI tools it has not reviewed, and say other tools may be approved once the Department has assessed them. Descant is not currently a Department-approved AI tool, and parent consent does not change this rule on its own. Government schools can use Descant with AI off, or ask the Department about an assessment first.
What happens to our data if we stop using the platform?
When your agreement ends, we export your records on request, then delete them within 90 days and confirm in writing.
Need Help With Your School's Vendor Assessment?
We'll provide the documentation your school needs to complete the assessment process in New South Wales. Request a compliance pack and we'll be in touch.
See Descant with your school in mind
Tell us a little about your school and we'll show you how it would work for your team.
- A made-up school like yours to explore for 14 days
- We check each request by hand and reply within two school days
- Made-up students only: no real student information needed
Prefer email? Write to [email protected].
(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.