School-led review · SA
Privacy Compliance for South Australian Schools
South Australian government schools follow the Information Privacy Principles Instruction (PC012), the South Australian Cyber Security Framework and the Department for Education's AI guidance. Descant provides the privacy, security and data-handling evidence a school needs for its review, and can be used with AI switched off.
Key Details
- Enacted
- 2020
- Privacy Principles
- 10 Information Privacy Principles (IPPs)
- Regulator
- Privacy Committee of South Australia (PCSA)
Legislation Overview
Premier and Cabinet Circular PC012 (Information Privacy Principles Instruction)
Regulated by the Privacy Committee of South Australia (PCSA)
Key Provisions
- 10 Information Privacy Principles set by the Information Privacy Principles Instruction, Premier and Cabinet Circular PC012 — administrative rather than legislative
- Contracts with service providers must include conditions so the principles are complied with, and provisions that allow audit
- SACSF: the Department must risk-assess any cloud computing service before it is used (Guideline 18.0, Policy Statement 2.11)
- SACSF: cyber security requirements in all supplier agreements, and written approval before agency information goes to any sub-contractor
- EdChat is the Department's own AI tool; its public advice is not to enter personal information into public generative AI tools
- The Department's AI guidance for staff sits on its intranet (staff login)
Data Breach Notification
Not currently mandatory — South Australia has no breach-notification law, but agencies and contracted service providers should notify the Privacy Committee of South Australia of breaches of personal information as soon as possible (guidance updated 12 June 2025). Cyber incidents are reported under circular PC042.
AI Governance Framework
Department for Education AI guidance for staff (staff login) and EdChat — The Department publishes AI guidance for staff on its intranet and provides EdChat, its own AI tool, where data is secured by the Department and stored in Australia. Its public advice is that schools and students don't enter personal information into public generative AI tools. The detailed staff guidance needs a staff login, so check it directly.
South Australian government schools: the Department's AI guidance
The Department for Education provides its own AI tool, EdChat, and publishes AI guidance for staff behind a staff login. Descant's recording, note drafting and report drafting use AI on information about named students, so check that guidance before using these features.
What the Department says
- The Department recommends that "schools and students don't enter personal information into generative AI tools" (parents page, updated 17 October 2025), and "Every school determines how their teachers and students can use AI."
- EdChat: "All data entered and used is secured by the department and stored in Australia." "EdChat is designed to support teaching and learning, not to provide support with wellbeing."
- For preschools and early childhood programs, not schools, the Department's policy says educators "must not enter any personal or identifying information about children" into any AI tool other than EdChat.
- Detailed staff guidance, "Artificial intelligence in schools – use and considerations", needs a staff login.
What Descant does
- AI features are an optional paid add-on, off unless a school adds them, and a school can switch AI off at any time. With AI off, nothing is sent to an AI model, and case management, referrals, digital consent and notes staff write themselves keep working.
- A school can require recorded parent or carer consent before AI processes a student's information.
- AI drafts stay with the staff member. They are labelled as AI-assisted, reviewed before saving, and never sent to families automatically.
- Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
What your school does
- Ask the Department (Office of the CIO) whether Descant's AI may process identified student information and audio. Until it confirms, use Descant with AI off.
- If the Department allows AI use, decide on parent consent; Descant's consent setting can require recorded consent before AI runs.
- Raise the purchase through the Department's ICT process so it can do its SACSF cloud and supplier risk assessments.
- Get written approval for any sub-processor that touches Department information.
Sources
- Artificial intelligence (AI) in schools: information for parents and carers (updated 17 October 2025)
- EdChat (updated 24 August 2026)
- Safe use of digital technologies and online environments in early childhood education and care policy (PDF) (v1.4, approved 30 April 2026)
- SACSF Guideline 18.0: Cloud Security (read 18 October 2026)
- Privacy Committee of South Australia: privacy breach notification (updated 12 June 2025)
- Information Privacy Principles Instruction (PC012) (version effective May 2020)
This is general information, not legal advice, and policies change. Check the current pages, and confirm your approach with the Department ([email protected]), before you decide.
Using AI with student information in South Australian schools →
Vendor Assessment Pathway
Here's the process your school follows to adopt a new platform in South Australia. We'll support you at every step.
- Step 1
Department Cloud Risk Assessment
Raise the purchase through the Department's ICT process. Under the SACSF, the Department must risk-assess any cloud computing service before it is used. We provide evidence covering hosting, encryption, access control, logging and incident response.
- Step 2
Supplier Assessment and Contract
The Department assesses the supplier's risks and includes cyber security and privacy conditions in the contract, including audit provisions and written approval for sub-contractors.
- Step 3
Check the AI Guidance
Before using AI features, check the Department's staff AI guidance and ask whether Descant's AI is permitted. Until then, use Descant with AI off.
- Step 4
Deployment
Once approved, schools deploy the platform with their wellbeing teams. The school reviews its use regularly as SACSF and departmental guidance are updated.
South Australia School Privacy Requirements: What Descant Provides
What Descant does for each privacy and security requirement your South Australia review will check, and the evidence we provide.
IPP 4 — Storage and security (PC012)
Encrypted in transit and at rest. Role-based access controls. New passwords of at least 14 characters with upper and lower case, a number and a symbol, plus optional two-step sign-in (a one-time code) that a school can make compulsory. Records stored in Australia (Sydney).
IPP 2 — Use and disclosure limitations (PC012)
Data is used solely for wellbeing documentation purposes within your school. No data shared with third parties for marketing, research, or any purpose beyond service delivery.
SACSF cloud and supplier risk assessment
We provide the privacy, security and data-handling evidence the Department needs for its SACSF assessment, covering where data is stored, encryption, access management, logging, and incident response.
Data residency in Australia
Student records are stored and processed in Australia (Sydney). Speech-to-text and AI drafting also run in Australia, and audio is deleted once transcribed. Some supporting services, such as email delivery and payments, are overseas.
Audio data handling
Audio is deleted once it's transcribed. Only text documentation is retained.
AI transparency and human oversight
AI is an optional paid add-on, off unless the school adds it. Where AI is used, drafts are labelled as AI-assisted, reviewed by staff before saving, and never sent to families automatically. No AI training on school data.
Audit trail for compliance
Views of student records and sensitive notes, and every change, are logged. Audit logs are kept for at least 7 years and are available for compliance reporting and incident investigation.
Who uses the platform
Staff use the platform. Students only use secure links, for a short check-in or a questionnaire their school sends, with no AI. Parents and carers use secure links for consent and questionnaires, and educators sign in to add evidence. Students do not use AI in Descant.
Guidance by School Sector
Different school sectors in South Australia have different procurement processes. Select your sector for specific guidance.
Government Schools
Key body: Department for Education South Australia (DoE SA)
Under the SACSF, the Department must risk-assess any cloud service before it is used. EdChat is the Department's own AI tool; Descant is a separate tool, so check the Department's AI guidance before using its AI features.
- The Department risk-assesses cloud services and suppliers before use (SACSF)
- PC012 Information Privacy Principles apply to government agencies including schools
- Public advice: don't enter personal information into public generative AI tools
- The Department's AI guidance for staff is on its intranet (staff login)
- Principal approval, and any departmental sign-off for new AI tools
Catholic Schools
Key body: Catholic Education South Australia (CESA)
Catholic Education South Australia covers the Archdiocese of Adelaide and the Diocese of Port Pirie. Check with CESA whether new platforms and AI tools are approved centrally.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- Check with CESA about central approval of platforms and AI tools
- The ISA/NCEC Privacy Compliance Manual (April 2025) suggests a privacy impact assessment for each AI system
- Check whether CESA expects an ST4S assessment
Independent Schools
Key body: Association of Independent Schools of South Australia (AISSA)
Independent schools in South Australia have individual procurement autonomy and set their own rules on AI. No public AISSA guidance on AI was found as at October 2026.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- Individual school board or principal makes procurement decisions
- AISSA provides guidance and professional development for member schools
- PIA recommended (though not always mandatory) — we provide privacy, security and data-handling evidence for your privacy impact assessment
- Includes Lutheran, Anglican, and other faith-based and non-denominational schools in SA
Frequently Asked Questions
Something we haven't answered? Ask us and a person from the team will reply.
Ask a questionDoes South Australia have privacy legislation like other states?
South Australia's privacy framework for government agencies is administrative rather than legislative. The 10 Information Privacy Principles are set by the Information Privacy Principles Instruction, a Premier and Cabinet Circular known as PC012 (latest version found: May 2020). Agency chief executives must ensure it is implemented and observed. Catholic and independent schools are governed by the federal Privacy Act.
What does EdChat mean for other AI tools in SA schools?
EdChat is the Department's own AI tool: data entered is secured by the Department and stored in Australia, and it is not designed to support wellbeing. The Department's public advice is not to enter personal information into public generative AI tools. Descant is a separate tool, so check the Department's staff AI guidance before using its AI features, or use Descant with AI off.
What is the SACSF and does it apply to our school?
The South Australian Cyber Security Framework is a whole-of-government policy framework for SA public sector agencies. Its cloud security guideline says the agency must risk-assess any cloud computing service before it is used. For government schools, the Department does this, not each school. Non-government schools are not bound by it.
How does Descant handle student data mentioned in wellbeing notes?
Wellbeing staff use the platform to document support sessions. With AI off, staff write notes themselves. Where AI is on, the audio and transcript sent for drafting contain identified student information, and the staff member reviews the draft before saving. Audio recordings are deleted once transcribed — only the text documentation is retained.
Can our CESA school adopt this independently?
Check with Catholic Education SA first. It can tell you whether new platforms and AI tools are approved centrally or by each school. We are happy to work with CESA or your school leadership on the assessment.
What happens to our data if we stop using the platform?
When your agreement ends, we export your records on request, then delete them within 90 days and confirm in writing.
Need Help With Your School's Vendor Assessment?
We'll provide the documentation your school needs to complete the assessment process in South Australia. Request a compliance pack and we'll be in touch.
See Descant with your school in mind
Tell us a little about your school and we'll show you how it would work for your team.
- A made-up school like yours to explore for 14 days
- We check each request by hand and reply within two school days
- Made-up students only: no real student information needed
Prefer email? Write to [email protected].
(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.