School-led review · NT
Privacy Compliance for Northern Territory Schools
The Northern Territory's Information Act 2002 sets 10 Information Privacy Principles, and the Department of Education and Training's generative AI policy applies to staff in government schools. Descant provides the privacy, security and data-handling evidence a school needs for its review, and can be used with AI switched off.
Key Details
- Enacted
- 2002
- Privacy Principles
- 10 Information Privacy Principles (IPPs)
- Regulator
- Office of the Information Commissioner Northern Territory (OIC NT)
Legislation Overview
Information Act 2002
Regulated by the Office of the Information Commissioner Northern Territory (OIC NT)
Key Provisions
- 10 Information Privacy Principles governing collection, use, storage, and disclosure of personal information
- IPP 9: personal information may be transferred outside the Territory, including interstate, only on listed grounds, such as consent or a recipient bound by substantially similar principles
- IPP 10: sensitive information is collected only with consent or another listed exception
- The Department's consent advice (May 2023): consent when student information is transferred out of the NT to cloud providers, and express consent for sensitive information
- The Department's generative AI policy (October 2025): no personal or sensitive information in generative AI tools
- Apps that capture private or sensitive information need formal assessment and approval by the Department, which prepares the privacy impact assessment and Privacy Information Statement
- NT AI Assurance Framework (current edition November 2025): extra assurance steps for medium and high-risk AI
Data Breach Notification
Not currently mandatory — The Information Act 2002 (as in force on 1 June 2026) has no mandatory data breach notification scheme. Department staff follow the Department's internal data breach response plan.
AI Governance Framework
DET Generative artificial intelligence policy (October 2025) and NT AI Assurance Framework — The Department's policy says staff "must not upload personal and sensitive information into generative AI tools" and must "only input information marked PUBLIC or UNCLASSIFIED". It aligns with the NT Government's AI Assurance Framework (current edition dated November 2025), which applies when agencies use AI-enabled systems, including AI built into a product.
Northern Territory government schools: the Department's generative AI policy
The Department of Education and Training's Generative AI policy and guidelines (approved 23 October 2025) apply to staff in NT government schools. Descant's recording, note drafting and report drafting use AI with identified student information, so under the policy as written schools use Descant with AI off unless the Department approves otherwise.
What the policy says
- Staff "must not upload personal and sensitive information into generative AI tools" and must "only input information marked PUBLIC or UNCLASSIFIED".
- Guidelines: "ensure you do not enter any personal or identifiable information, including student work or details into generative AI tools, any personal information should be de-identified".
- AI should not "replace the expertise and professional judgement of teachers" or "undermine genuine communications with students and families", and staff are open about AI use.
- Approved tools are in the Digital applications catalogue; new AI features mean a request "to get it reassessed".
What Descant does
- AI features are an optional paid add-on, off unless a school adds them, and a school can switch AI off at any time. With AI off, nothing is sent to an AI model, and case management, referrals, digital consent and notes staff write themselves keep working.
- A school can require recorded parent or carer consent before AI processes a student's information.
- AI drafts stay with the staff member. They are labelled as AI-assisted, reviewed before saving, and never sent to families automatically.
- Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
What your school does
- Use Descant with AI off. Parent consent does not lift the policy's ban on uploading personal and sensitive information.
- The principal submits an Online and Cloud System Request; the Department completes the security risk assessment, privacy impact assessment and Privacy Information Statement.
- Get express parent consent using the Privacy Information Statement. Records are stored in Sydney, which is outside the Territory, so IPP 9 applies to core hosting.
- Using AI features would need written Department approval despite the upload ban, plus an AI assurance assessment and reassessment when AI features change.
Sources
- Generative artificial intelligence policy (PDF) (v1, approved 23 October 2025)
- Generative artificial intelligence guidelines (v1, approved 23 October 2025)
- Digital applications policy (PDF) (approved 12 October 2022)
- NT AI Assurance Framework (edition dated November 2025)
- Information Act 2002 (as in force 1 June 2026)
This is general information, not legal advice, and policies change. Check the current pages, and confirm your approach with the Department ([email protected]), before you decide.
Using AI with student information in Northern Territory schools →
Vendor Assessment Pathway
Here's the process your school follows to adopt a new platform in Northern Territory. We'll support you at every step.
- Step 1
Online and Cloud System Request
The principal submits a request for a new digital application. Apps that capture private or sensitive information must not be used without formal assessment and approval by the Department.
- Step 2
Department Assessment
The Department arranges a security risk assessment and completes the privacy impact assessment and Privacy Information Statement. We provide the privacy, security and data-handling evidence it needs.
- Step 3
Approval by Risk Level
Low and medium-risk apps are approved within the Department; high-risk apps are endorsed by its Information Management Committee and approved by the Chief Executive. Health and wellbeing records are likely to be treated as high risk.
- Step 4
Consent and Deployment
Families give express consent using the Privacy Information Statement. Staff use Descant with AI off unless the Department approves AI use, and any new AI feature is reassessed.
Northern Territory School Privacy Requirements: What Descant Provides
What Descant does for each privacy and security requirement your Northern Territory review will check, and the evidence we provide.
IPP 4 — Information security
Encrypted in transit and at rest. Role-based access controls. New passwords of at least 14 characters with upper and lower case, a number and a symbol, plus optional two-step sign-in (a one-time code) that a school can make compulsory. Views of student records and sensitive notes, and every change, are logged.
IPP 2 — Use and disclosure limitations
Data is used solely for documentation purposes within your school. No data shared with third parties for marketing or other purposes.
IPP 9 — Transfers outside the Territory
Student records are stored and processed in Australia (Sydney), which is outside the Territory, so IPP 9 applies to core hosting. Speech-to-text and AI drafting also run in Australia, and audio is deleted once transcribed. Some supporting services, such as email delivery and payments, are overseas; our Privacy Policy lists them.
Privacy Information Statement
The Department prepares the Privacy Information Statement for parents. We provide the evidence it needs: what is collected, why, how it is used and stored, and who it may be disclosed to.
Audio data handling
Audio is deleted once it's transcribed. Only text documentation is retained.
The Department's generative AI policy
AI is an optional paid add-on, off unless the school adds it, so by default no student information goes to AI. Where AI is used, drafts are labelled as AI-assisted, reviewed by staff before saving, and never sent to families automatically. No AI training on school data.
Audit trail and accountability
Views of student records and sensitive notes, and every change, are logged. Audit logs are kept for at least 7 years and are available for compliance reporting and incident investigation.
Who uses the platform
Staff use the platform. Students only use secure links, for a short check-in or a questionnaire their school sends, with no AI. Parents and carers use secure links for consent and questionnaires, and educators sign in to add evidence. Students do not use AI in Descant.
Guidance by School Sector
Different school sectors in Northern Territory have different procurement processes. Select your sector for specific guidance.
Government Schools
Key body: Department of Education and Training Northern Territory (DET)
Apps that handle personal or sensitive information need the Department's assessment and approval. Its generative AI policy bars personal and sensitive information in AI tools, so government schools use Descant with AI off.
- Information Act 2002 and 10 IPPs govern all personal information handling
- Online and Cloud System Request, then Department security, privacy and AI assurance assessment
- The Department prepares the Privacy Information Statement for parents
- Express consent for sensitive information, and consent for data transferred outside the NT
- Approved apps are listed in the Digital applications catalogue with conditions of use
Catholic Schools
Key body: Catholic Education Northern Territory
Catholic Education NT runs the Catholic schools in the Territory. Check with it about technology procurement and any rules on AI tools.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- The Department's generative AI policy does not cover non-government schools, except when they use the NTSchools network
- The ISA/NCEC Privacy Compliance Manual (April 2025) suggests a privacy impact assessment for each AI system
- Check whether your system expects an ST4S assessment
- Individual schools work within Catholic education procurement frameworks
Independent Schools
Key body: Association of Independent Schools of the Northern Territory (AISNT)
Independent schools in the Territory make their own procurement decisions and set their own rules on AI, with AISNT providing guidance and support.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- Individual school board or principal makes procurement decisions
- AISNT provides guidance and professional development resources
- PIA recommended — we provide privacy, security and data-handling evidence for your privacy impact assessment
- The Notifiable Data Breaches scheme applies
Frequently Asked Questions
Something we haven't answered? Ask us and a person from the team will reply.
Ask a questionWhat is the NT AI Assurance Framework and how does it affect our school?
The NT Government's AI Assurance Framework (current edition dated November 2025) applies when agencies design, build or use AI-enabled systems, including AI built into a product. A quick risk assessment sets the risk level; medium and high-risk uses need extra assurance. The Department's Generative AI policy (October 2025) applies it to government schools and adds a ban on uploading personal and sensitive information into generative AI tools.
Do we need consent to transfer data outside the NT?
Under IPP 9 of the Information Act 2002, personal information may be transferred outside the Territory, including interstate, only on listed grounds. Consent is one; a recipient bound by substantially similar principles by law or contract is another. The Department's practice is that consent must be provided when student information goes to cloud providers outside the NT. Descant stores student records in Sydney, which is outside the Territory, so this applies to its core hosting, not only to overseas services.
How does Descant handle student data mentioned in wellbeing notes?
Wellbeing staff use the platform to document support sessions. With AI off, staff write notes themselves and nothing is sent to AI. Where AI is on, the audio and transcript sent for drafting contain identified student information, and the staff member reviews the draft before saving. Audio recordings are deleted once transcribed — only the text documentation is retained.
What is a Privacy Information Statement and do we need one?
Where an app captures personal or sensitive information, a Privacy Information Statement is prepared to inform parents and carers when they give consent. For government schools, the Department prepares it after an application request, alongside its privacy impact assessment. We provide the evidence it needs.
Can parent consent unlock AI features in NT government schools?
No. The Department's policy says staff must not upload personal and sensitive information into generative AI tools, and it states no consent exception. Government schools use Descant with AI off unless the Department approves AI use in writing.
What happens to our data if we stop using the platform?
When your agreement ends, we export your records on request, then delete them within 90 days and confirm in writing.
Need Help With Your School's Vendor Assessment?
We'll provide the documentation your school needs to complete the assessment process in Northern Territory. Request a compliance pack and we'll be in touch.
See Descant with your school in mind
Tell us a little about your school and we'll show you how it would work for your team.
- A made-up school like yours to explore for 14 days
- We check each request by hand and reply within two school days
- Made-up students only: no real student information needed
Prefer email? Write to [email protected].
(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.