School-led review · TAS
Privacy Compliance for Tasmanian Schools
Tasmania's Personal Information Protection Act 2004 sets 10 Personal Information Protection Principles, and DECYP's generative AI policy and procedure apply to staff in government schools. Descant provides the privacy, security and data-handling evidence a school needs for its review, and can be used with AI switched off.
Key Details
- Enacted
- 2004
- Privacy Principles
- 10 Personal Information Protection Principles (PIPPs)
- Regulator
- Ombudsman Tasmania (Ombudsman)
Legislation Overview
Personal Information Protection Act 2004
Regulated by the Ombudsman Tasmania (Ombudsman)
Key Provisions
- 10 Personal Information Protection Principles governing the full lifecycle of personal information
- Principle 9 allows disclosure outside Tasmania only in limited cases, such as a recipient bound by substantially similar principles, the individual's consent, or reasonable steps
- Custodians include any body or person that has entered into a personal information contract
- DECYP procedure: no sensitive or personally identifiable information as an input to any generative AI tool
- DECYP's endorsed tools list (staff only); tools are assessed by ITS Cyber Security through the ITS Application Risk Assessment Form
- Ombudsman Tasmania handles privacy complaints and provides guidance on PIPA compliance
Data Breach Notification
Not currently mandatory — Tasmania has no mandatory data breach notification under state legislation. The Tasmania Law Reform Institute recommended a breach-notification scheme in May 2024; no bill had been introduced as at October 2026.
AI Governance Framework
Use of Generative AI in DECYP Schools Policy and Procedure (2023, under review) — The procedure says "Sensitive or personally identifiable information must not be used as an input for any generative AI tool", and that tools not on DECYP's endorsed list "are hence not endorsed for use in DECYP schools". The policy is under review; staff follow the current version in the meantime.
Tasmanian government schools: DECYP's generative AI policy
DECYP's Use of Generative AI in DECYP Schools Policy and Procedure (2023, currently under review) apply to staff in government schools and colleges. Descant's recording and drafting use AI on information about named students, so under the current procedure government schools use Descant with AI off.
What the policy says
- "Sensitive or personally identifiable information must not be used as an input for any generative AI tool."
- Staff "Ensure that input prompts used to create outputs in generative AI do not contain any personally identifiable or confidential information."
- Tools not on DECYP's endorsed list "may not meet the standards required for use and are hence not endorsed for use in DECYP schools". Assessments are requested through the ITS Application Risk Assessment Form.
- "During the review period, staff must continue to follow the current policy and procedure as their primary guidance."
What Descant does
- AI features are an optional paid add-on, off unless a school adds them, and a school can switch AI off at any time. With AI off, nothing is sent to an AI model, and case management, referrals, digital consent and notes staff write themselves keep working.
- A school can require recorded parent or carer consent before AI processes a student's information.
- AI drafts stay with the staff member. They are labelled as AI-assisted, reviewed before saving, and never sent to families automatically.
- Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
What your school does
- Use Descant with AI off. Case management, referrals, digital consent and manually written notes do not use AI.
- Parent consent does not lift the procedure's ban on identifiable inputs to generative AI.
- Submit the ITS Application Risk Assessment Form so ITS Cyber Security can assess Descant.
- Records are stored in Sydney, outside Tasmania, so check that your agreement addresses Principle 9.
Sources
- Use of Generative AI in DECYP Schools Policy (PDF) (v0.11, 10 November 2023; under review)
- Use of Generative AI in DECYP Schools Procedure (PDF) (v0.11, 12 December 2023; under review)
- Personal Information Protection Act 2004 (authorised version 5 September 2024)
- Tasmania Law Reform Institute, Report No 33 (privacy) (May 2024)
This is general information, not legal advice, and policies change. Check the current pages, and confirm your approach with DECYP ([email protected]), before you decide.
Vendor Assessment Pathway
Here's the process your school follows to adopt a new platform in Tasmania. We'll support you at every step.
- Step 1
ITS Application Risk Assessment
The school submits the ITS Application Risk Assessment Form, and DECYP's ITS Cyber Security team assesses the platform for information privacy and security risks. We provide the evidence it needs.
- Step 2
Endorsed Tools List
Assessed and endorsed tools are listed on the staff-only ITS intranet. Tools not on the list are not endorsed for use in DECYP schools.
- Step 3
Agreement and Principle 9
Student records are stored in Sydney, outside Tasmania. The school's agreement with us sets out how personal information is protected, which supports its Principle 9 assessment.
- Step 4
Deployment with AI Off
Wellbeing staff are onboarded with AI switched off, as the current procedure bars identifiable inputs to generative AI. The school reviews its use as DECYP updates its policy.
Tasmania School Privacy Requirements: What Descant Provides
What Descant does for each privacy and security requirement your Tasmania review will check, and the evidence we provide.
PIPP 4 — Information security
Encrypted in transit and at rest. Role-based access controls. New passwords of at least 14 characters with upper and lower case, a number and a symbol, plus optional two-step sign-in (a one-time code) that a school can make compulsory. Views of student records and sensitive notes, and every change, are logged.
PIPP 2 — Use and disclosure
Data is used solely for documentation purposes within your school. No data shared with third parties for marketing or other purposes.
Principle 9 — Disclosure outside Tasmania
Student records are stored and processed in Australia (Sydney), which is outside Tasmania. Speech-to-text and AI drafting also run in Australia, and audio is deleted once transcribed. Some supporting services, such as email delivery and payments, are overseas; our Privacy Policy lists them.
Audio data handling
Audio is deleted once it's transcribed. Only text documentation is retained.
Audit trail and compliance reporting
Views of student records and sensitive notes, and every change, are logged. Audit logs are kept for at least 7 years and are available for compliance reporting and incident investigation.
DECYP's generative AI procedure
AI is an optional paid add-on, off unless the school adds it, so by default no identifiable information goes to AI. Where AI is used, drafts are labelled as AI-assisted, reviewed by staff before saving, and never sent to families automatically. No AI training on school data.
Who uses the platform
Staff use the platform. Students only use secure links, for a short check-in or a questionnaire their school sends, with no AI. Parents and carers use secure links for consent and questionnaires, and educators sign in to add evidence. Students do not use AI in Descant.
Guidance by School Sector
Different school sectors in Tasmania have different procurement processes. Select your sector for specific guidance.
Government Schools
Key body: Department for Education, Children and Young People (DECYP)
Government schools use tools on DECYP's endorsed list, assessed by ITS Cyber Security. DECYP's generative AI procedure bars sensitive or personally identifiable information as an input to any generative AI tool.
- ITS Application Risk Assessment Form, then an ITS Cyber Security assessment
- Endorsed tools list on the staff-only ITS intranet
- No sensitive or personally identifiable information in generative AI tools
- Principle 9 applies to records stored outside Tasmania
- Principal approval required for new technology platforms
Catholic Schools
Key body: Catholic Education Tasmania
Catholic Education Tasmania coordinates the Catholic schools in Tasmania. Check with it about technology procurement and any rules on AI tools.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- Check Catholic Education Tasmania's rules on AI tools
- The ISA/NCEC Privacy Compliance Manual (April 2025) suggests a privacy impact assessment for each AI system
- Check whether your system expects an ST4S assessment
Independent Schools
Key body: Independent Schools Tasmania
Independent schools in Tasmania have procurement autonomy and set their own rules on AI. Individual schools make their own technology decisions.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- Individual school board or principal makes procurement decisions
- PIA recommended — we provide privacy, security and data-handling evidence for your privacy impact assessment
- Independent Schools Tasmania provides guidance and professional development resources
Frequently Asked Questions
Something we haven't answered? Ask us and a person from the team will reply.
Ask a questionWhat is Principle 9 and how does Descant address it?
Principle 9 of the Personal Information Protection Act 2004 covers disclosure of personal information outside Tasmania. It is allowed only in limited cases, for example when the recipient is bound by substantially similar principles, the individual consents, or reasonable steps are taken. Descant stores and processes student records in Sydney, which is outside Tasmania; speech-to-text and AI drafting also run in Australia, and audio is deleted once transcribed. Some supporting services, such as email delivery and payments, are overseas.
Is Descant on the endorsed tools list?
The endorsed list is on DECYP's staff-only ITS intranet, so check its current entries. A school can request an assessment through the ITS Application Risk Assessment Form, and we provide privacy, security and data-handling evidence for it, including how AI is used.
How does Descant handle student data mentioned in wellbeing notes?
Wellbeing staff use the platform to document support sessions. With AI off, staff write notes themselves and nothing is sent to AI. Where AI is on, the audio and transcript sent for drafting contain identified student information, and the staff member reviews the draft before saving. Audio recordings are deleted once transcribed — only the text documentation is retained.
Do we need parental consent to use this platform?
Follow your school's consent framework for wellbeing record-keeping. For AI, consent does not change the position in government schools: DECYP's procedure says sensitive or personally identifiable information must not be used as an input for any generative AI tool, so AI features stay off unless DECYP endorses otherwise.
What happens to our data if we stop using the platform?
When your agreement ends, we export your records on request, then delete them within 90 days and confirm in writing.
Need Help With Your School's Vendor Assessment?
We'll provide the documentation your school needs to complete the assessment process in Tasmania. Request a compliance pack and we'll be in touch.
See Descant with your school in mind
Tell us a little about your school and we'll show you how it would work for your team.
- A made-up school like yours to explore for 14 days
- We check each request by hand and reply within two school days
- Made-up students only: no real student information needed
Prefer email? Write to [email protected].
(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.