School-led review · QLD
Privacy Compliance for Queensland Schools
Queensland state schools follow the Information Privacy Act 2009, the Department of Education's procedure for non-departmental services, and Queensland Government guidance on generative AI. Descant provides the privacy, security and data-handling evidence a school needs for its review.
Key Details
- Enacted
- 2009
- Privacy Principles
- Queensland Privacy Principles (QPPs)
- Regulator
- Office of the Information Commissioner Queensland (OIC)
Legislation Overview
Information Privacy Act 2009
Regulated by the Office of the Information Commissioner Queensland (OIC)
Key Provisions
- Queensland Privacy Principles (QPPs) governing the handling of personal information by government agencies
- Mandatory data breach notification for departments since 1 July 2025
- Contracted service providers are bound to the QPPs through their contracts
- QGEA AI governance policy (August 2026): departments evaluating AI solutions prepare a FAIRA or an agreed equivalent; FAIRA LITE suits low-risk trials
- Queensland Government guideline: personal information should not be entered into generative AI tools "not approved for use by your department"
- From 25 October 2026, approved online services can be used without individual consent, but services that need sensitive information still need valid consent
- Non-departmental ICT services need an information security assessment, and SENSITIVE or PROTECTED information must not be stored or transmitted offshore
Data Breach Notification
Mandatory — The mandatory notification of data breach scheme has applied to Queensland Government departments since 1 July 2025. A breach at a contracted service provider may be a data breach of the agency, so contracts include prompt breach reporting and cooperation.
AI Governance Framework
QGEA Artificial intelligence governance policy and FAIRA (Foundational AI Risk Assessment) — Under the mandated QGEA AI governance policy (v2.0.0, August 2026), departments must govern AI "with regard to" ISO/IEC 38507 and, when evaluating AI solutions, prepare a Foundational AI Risk Assessment (FAIRA) "or an agreed equivalent". The FAIRA framework itself is non-mandated, and the policy binds departments rather than naming schools. Whether a school's purchase needs a FAIRA is for the Department to say.
Queensland state schools: rules for generative AI
No public Department of Education generative AI policy for staff was found. The rules come from Queensland Government guidance, the Department's procedure for non-departmental services and its consent rules. Descant's recording and drafting use generative AI with identified student information, so these rules apply to those features.
What the rules say
- Queensland Government guideline (non-mandated): personal information "should not be shared with, input, or uploaded to generative AI products and services not approved for use by your department".
- The Department's own AI tool, Corella: users "should not enter any personal information into the Corella application".
- Non-departmental services need an information security assessment; SENSITIVE or PROTECTED information "must not be stored or transmitted offshore"; principals ensure "informed consent is gained".
- From 25 October 2026: "Where an online service requires the disclosure of sensitive information, valid consent will still be required."
What Descant does
- AI features are an optional paid add-on, off unless a school adds them, and a school can switch AI off at any time. With AI off, nothing is sent to an AI model, and case management, referrals, digital consent and notes staff write themselves keep working.
- A school can require recorded parent or carer consent before AI processes a student's information.
- AI drafts stay with the staff member. They are labelled as AI-assisted, reviewed before saving, and never sent to families automatically.
- Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
What your school does
- Complete the Online Service Risk Review (information security assessment) and review the service each year.
- Ask the Department whether Descant's AI can be treated as approved for personal information, and whether a FAIRA or an agreed equivalent is needed.
- Get express parent or carer consent covering sensitive information and AI use. Descant's consent setting can require it before AI runs; consent works alongside the Department's approval, not instead of it.
- Or use Descant with AI off while you check.
Sources
- QGEA guideline: Use of generative AI in Queensland Government (updated 7 August 2025)
- QGEA Artificial intelligence governance policy (v2.0.0, updated 26 August 2026)
- FAIRA framework (v2.0.0, updated 29 September 2026)
- Non-departmental ICT service providers procedure (PDF) (v1.5, effective 24 February 2026)
- Digital services used in schools (updated 8 September 2026)
- Corella privacy statement (24 August 2026)
This is general information, not legal advice, and policies change. Check the current pages, and confirm your approach with the Department, before you decide.
Vendor Assessment Pathway
Here's the process your school follows to adopt a new platform in Queensland. We'll support you at every step.
- Step 1
Information Security Assessment
Before using a non-departmental service, the school completes an information security assessment through the Online Service Risk Review and records a risk assessment. We provide the privacy, security and data-handling evidence it needs.
- Step 2
Parent or Carer Consent
Descant holds sensitive information, such as health, disability and wellbeing details, so it cannot be an approved online service under the 25 October 2026 scheme. Valid consent is still required, following the Department's consent procedure.
- Step 3
Decide on AI Features
Ask the Department whether Descant's AI counts as approved for personal information and whether a FAIRA or an agreed equivalent is needed. Until then, use Descant with AI off.
- Step 4
Contract, Deployment and Annual Review
The contract binds Descant to the QPPs, with prompt breach reporting. Wellbeing staff are onboarded, and the school reviews the service each year.
Queensland School Privacy Requirements: What Descant Provides
What Descant does for each privacy and security requirement your Queensland review will check, and the evidence we provide.
QPP 11 — Security of personal information
Encrypted in transit and at rest. Role-based access controls. New passwords of at least 14 characters with upper and lower case, a number and a symbol, plus optional two-step sign-in (a one-time code) that a school can make compulsory. Records stored in Australia (Sydney).
FAIRA values assessment — human oversight
AI drafts notes and reports for staff; it makes no decisions about students. Staff review every draft before it is saved, and drafts are never sent to families automatically.
Consent for sensitive information
A school can require recorded parent or carer consent before AI processes a student's information, or keep AI off. AI is an optional paid add-on, off unless the school adds it.
Accountability and audit
Views of student records and sensitive notes, and every change, are logged. Wellbeing staff remain accountable for documentation content. Audit logs are kept for at least 7 years.
Personal information and approved AI tools
With AI on, the audio and text sent for drafting contain identified student information. Check the Department's approval position first; with AI off, nothing is sent to AI.
Data residency in Australia
Student records are stored and processed in Australia (Sydney). Speech-to-text and AI drafting also run in Australia, and audio is deleted once transcribed. Some supporting services, such as email delivery and payments, are overseas.
Audio data handling
Audio is deleted once it's transcribed. Only text documentation is retained.
Information security assessment
The Department's procedure asks for an information security assessment (Online Service Risk Review). We provide the privacy, security and data-handling evidence it needs.
Guidance by School Sector
Different school sectors in Queensland have different procurement processes. Select your sector for specific guidance.
Government Schools
Key body: Department of Education Queensland (DoE QLD)
State schools complete an information security assessment before using a non-departmental service, get consent where sensitive information is involved, and review the service each year. Queensland Government guidance says personal information should not go into generative AI tools the department has not approved.
- Online Service Risk Review (information security assessment) and a recorded risk assessment
- Valid consent for sensitive information, such as health, disability and wellbeing details
- SENSITIVE or PROTECTED information must not be stored or transmitted offshore
- Ask the Department about its approval position for AI tools and whether a FAIRA is needed
- Contracts bind the provider to the QPPs
- Annual review of each non-departmental service
Catholic Schools
Key body: Catholic Education Queensland Ltd (CEQL) and diocesan offices
Catholic Education Queensland Ltd replaced QCEC on 1 January 2026. Each of the five dioceses sets its own technology rules, including on AI.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- CEQL replaced QCEC on 1 January 2026
- Procurement and AI rules vary by diocese — Brisbane, Rockhampton, Townsville, Cairns, Toowoomba
- The ISA/NCEC Privacy Compliance Manual (April 2025) suggests a privacy impact assessment for each AI system
- Check with your diocese whether it expects an ST4S assessment
Independent Schools
Key body: Independent Schools Queensland (ISQ)
Independent schools have individual procurement autonomy, and each school sets its own rules on AI. Independent Schools Queensland offers AI resources and events for member schools.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- Individual school board or principal makes procurement decisions
- ISQ provides resources and professional development on AI in schools
- PIA recommended (though not always mandatory) — we provide privacy, security and data-handling evidence for your privacy impact assessment
- Check that your school's AI policy covers staff tools that hold student information
Frequently Asked Questions
Something we haven't answered? Ask us and a person from the team will reply.
Ask a questionIs FAIRA assessment mandatory for our school?
Not for every tool. FAIRA is the Foundational AI Risk Assessment, and the framework itself is non-mandated. The mandated QGEA AI governance policy asks departments evaluating AI solutions to prepare a FAIRA "or an agreed equivalent", or FAIRA LITE for low-risk trials. It binds the Department, not individual schools, so ask the Department whether your use needs one. Catholic and independent schools are not bound by it. We provide evidence for any assessment.
What is ISO 38507 and how does it apply?
ISO/IEC 38507 is an international standard on the governance implications of AI for organisations. The QGEA policy asks departments to establish their AI governance "with regard to" it. It is an obligation on the Department's own governance, not a review of a vendor or platform. We provide evidence about how AI is used in Descant and how staff review every draft.
What security assessment does our school need?
The Department's procedure for non-departmental ICT services asks for an information security assessment, done through the Online Service Risk Review, and an annual review. The procedure does not mention IRAP. We provide the privacy, security and data-handling evidence the review needs, and student records stay in Australia.
How does Descant handle student data mentioned in wellbeing notes?
Wellbeing staff use the platform to document support sessions. With AI on, the audio and transcript sent for drafting contain identified student information, and the staff member reviews the draft before saving. With AI off, staff write notes themselves. Audio recordings are deleted once transcribed — only the text documentation is retained.
Do we need parent consent to use Descant?
For state schools, likely yes. From 25 October 2026 some approved online services can be used without individual consent, but services that need sensitive information are not eligible, and "valid consent will still be required". Descant holds health, disability and wellbeing details, so the consent route applies. Its consent setting can require recorded consent before AI processes a student's information.
What happens to our data if we stop using the platform?
When your agreement ends, we export your records on request, then delete them within 90 days and confirm in writing.
Need Help With Your School's Vendor Assessment?
We'll provide the documentation your school needs to complete the assessment process in Queensland. Request a compliance pack and we'll be in touch.
See Descant with your school in mind
Tell us a little about your school and we'll show you how it would work for your team.
- A made-up school like yours to explore for 14 days
- We check each request by hand and reply within two school days
- Made-up students only: no real student information needed
Prefer email? Write to [email protected].
(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.