School-led review · VIC
Privacy Compliance for Victorian Schools
Victoria has rigorous vendor assessment requirements. Descant provides privacy, security, and data-handling evidence to support each school or governing body through its applicable review and approval process.
Key Details
- Enacted
- 2014
- Privacy Principles
- 10 Information Privacy Principles (IPPs)
- Regulator
- Office of the Victorian Information Commissioner (OVIC)
Legislation Overview
Privacy and Data Protection Act 2014
Regulated by the Office of the Victorian Information Commissioner (OVIC)
Key Provisions
- 10 Information Privacy Principles governing collection, use, and disclosure of personal information
- Victorian Protective Data Security Standards (VPDSS) — mandatory security framework for government entities
- The Department recommends a Privacy Impact Assessment (PIA) for software it does not provide that stores personal, sensitive or health information (PIA guidance, updated 10 July 2025)
- Government schools follow the Department's Generative Artificial Intelligence policy when using software that integrates generative AI (page updated 28 September 2026)
- Government schools must confirm applicable departmental and Arc catalogue requirements before procurement
- The Department's School Software Panel is due for release in October 2027, and products on it need an active ST4S assessment (Software and Administration Systems policy, updated 16 October 2026)
- As at October 2026, the ST4S Excluded / High Risk list (marked as being updated, 31 August 2026) shows AI services that process health and wellbeing data as not assessed by ST4S
Data Breach Notification
Mandatory — The Privacy and Data Protection Act has no general breach-notification scheme. Under the Victorian Protective Data Security Standards (element E9.010), agencies notify OVIC of information security incidents at business impact level 2 or higher. Government schools follow the Department's breach procedures. Non-government schools are covered by the federal Notifiable Data Breaches scheme.
AI Governance Framework
Generative Artificial Intelligence policy (Department of Education, for government schools) — Victorian government schools follow the Department's Generative Artificial Intelligence policy (policy last updated 18 June 2024; page updated 28 September 2026). It covers software that integrates generative AI, requires opt-in consent from parents and carers for AI tools that need personal information, and limits what staff enter into AI tools. Catholic and independent schools set their own rules.
Victorian government schools: the Department's generative AI policy
The Department of Education's Generative Artificial Intelligence policy applies to Victorian government schools using generative AI, including software that integrates generative AI tools. Descant's recording, note drafting and report drafting use generative AI, so the policy is likely to apply to those features.
What the policy asks of schools
- Opt-in consent: schools "must obtain opt-in consent from parents and carers before using any generative AI tool" that needs personal information beyond a school email and password. The Department's consent guidance also says opt-in consent must be used when software collects health or wellbeing information.
- Personal information: schools "must direct staff and students to not load any personal information about students or staff onto the tool", for example names, reports and personal histories.
- Families and reports: staff must not use generative AI tools to directly communicate with parents or students, make judgements about achievement or progress, or "write student reports for parents or carers".
What Descant does
- AI features are an optional paid add-on, off unless a school adds them, and a school can switch AI off at any time. With AI off, nothing is sent to an AI model, and case management, referrals, digital consent and notes staff write themselves keep working.
- A school can require recorded parent or carer opt-in consent before AI processes a student's information.
- AI drafts stay with the staff member. They are labelled as AI-assisted, reviewed before saving, and never sent to families automatically.
- Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
What your school does
- Use Descant with AI off unless the Department confirms that AI use fits its policy, and record that advice. Opt-in consent alone does not lift the policy's rule against loading student personal information onto AI tools.
- Complete your own Privacy Impact Assessment. The Department's guidance says vendors must not complete it on the school's behalf.
- Note the Department's School Software Panel, due for release in October 2027. Products on the panel need an active ST4S assessment.
- Catholic and independent schools set their own rules for generative AI. Check with your diocese, system or school board.
Sources
- Generative Artificial Intelligence policy (page updated 28 September 2026; policy last updated 18 June 2024)
- Privacy and information sharing: consent (updated 9 July 2025)
- Privacy impact assessments (updated 10 July 2025)
- Software and Administration Systems policy (updated 16 October 2026)
- ST4S Excluded / High Risk list (marked as being updated, 31 August 2026)
This is general information, not legal advice, and policies change. Check the current pages before you decide.
Vendor Assessment Pathway
Here's the process your school follows to adopt a new platform in Victoria. We'll support you at every step.
- Step 1
Confirm Procurement Path
The school or governing body confirms which departmental, sector, and catalogue requirements apply, including the Department's generative AI policy for government schools. As at October 2026, the ST4S Excluded / High Risk list shows AI services that process health and wellbeing data as not assessed by ST4S.
- Step 2
School-Led Risk Assessment
The school assesses whether the proposed use is appropriate and safe. We provide evidence about data handling, security controls, AI use, retention, and human oversight.
- Step 3
Privacy & Security Review
The reviewing body examines data flows, access controls, overseas processing, retention, incident response, and the safeguards that apply to staff use.
- Step 4
PIA & Institutional Approval
The school or network completes its Privacy Impact Assessment and obtains any departmental, board, principal, or sector approval required for its use case.
- Step 5
Deployment & Review
After approval, the school deploys the platform with defined access, consent, and governance settings and reviews the arrangement as its use or requirements change.
Victoria School Privacy Requirements: What Descant Provides
What Descant does for each privacy and security requirement your Victoria review will check, and the evidence we provide.
IPP 4 — Data security
Encrypted in transit and at rest. Role-based access controls. New passwords of at least 14 characters with upper and lower case, a number and a symbol, plus optional two-step sign-in (a one-time code) that a school can make compulsory.
IPP 2 — Use and disclosure limitations
Data is used solely for documentation purposes within your school. No data shared with third parties for marketing or other purposes.
VPDSS compliance
VPDSS sets information, ICT and physical security standards for Victorian government entities. We provide the privacy, security and data-handling evidence your school needs for its VPDSS review.
Data residency in Australia
Student records are stored and processed in Australia (Sydney). Speech-to-text and AI drafting also run in Australia, and audio is deleted once transcribed. Some supporting services, such as email delivery and payments, are overseas.
Audio data handling
Audio is deleted once it's transcribed. Only text documentation is retained.
Audit trail for OVIC compliance
Views of student records and sensitive notes, and every change, are logged. Audit logs are kept for at least 7 years and are available for compliance reporting and incident investigation.
AI transparency and oversight
AI drafts are labelled as AI-assisted and are reviewed by the staff member before they are saved. Drafts stay with staff and are never sent to families automatically. A school can switch AI features off for the whole school, or require recorded parent or carer opt-in consent before AI processes a student's information. School data is not used to train AI models.
Who uses the platform
Staff use the platform. Students only use secure links, for a short check-in or a questionnaire their school sends, with no AI. Parents and carers use secure links for consent and questionnaires, and educators sign in to add evidence. Students do not use AI in Descant.
Guidance by School Sector
Different school sectors in Victoria have different procurement processes. Select your sector for specific guidance.
Government Schools
Key body: Department of Education (DET Victoria)
Victorian government schools follow departmental procurement, Arc catalogue and Generative Artificial Intelligence policy requirements. As at October 2026, ST4S lists AI services that process health and wellbeing data as not assessed, so schools confirm which review and approval pathway applies before procurement.
- Schools must confirm applicable Arc catalogue and departmental approval requirements
- The school completes its own Privacy Impact Assessment; the Department's guidance says vendors must not complete it on the school's behalf
- Where no suitable assessed or panel product is available, the Department's software policy asks schools to complete a PIA and request a security impact assessment
- Schools may assess vendors against the Victorian Protective Data Security Standards (VPDSS); we provide the evidence they need
- Principal approval required — typically in consultation with the school council
- DET provides template PIAs and procurement checklists for schools
Catholic Schools
Key body: Melbourne Archdiocese Catholic Schools (MACS)
Catholic schools in Victoria follow diocesan procurement processes. MACS and VCEA provide IT governance guidance, and ST4S is widely referenced.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- Catholic schools set their own rules for generative AI; the MACS Code of Conduct for staff (2025) says staff must not enter personally identifiable information into AI tools, so check with MACS or your diocese first
- Victorian Catholic Education Authority (VCEA) coordinates across dioceses
- Check whether your diocese expects an ST4S assessment
- Individual dioceses may have additional procurement requirements
Independent Schools
Key body: Independent Schools Victoria (ISV)
Independent schools have individual procurement autonomy. ISV provides guidance and resources but each school makes its own technology decisions.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- Individual school board or principal makes procurement decisions, including the school's own rules for generative AI
- ISV provides technology guidance and professional development resources
- PIA recommended (though not always mandatory) — we provide privacy, security and data-handling evidence for your privacy impact assessment
- Includes Anglican, Jewish, Muslim, and other faith-based schools in Victoria
Frequently Asked Questions
Something we haven't answered? Ask us and a person from the team will reply.
Ask a questionCan our school use Descant if ST4S does not assess this category?
As at October 2026, the ST4S Excluded / High Risk list (marked as being updated, 31 August 2026) shows AI services that process health and wellbeing data as not assessed by ST4S. This is a category-level scope decision, not an assessment outcome for Descant. Government, Catholic, and independent schools should confirm their applicable procurement process and complete an internal risk assessment. We provide supporting privacy, security, and data-handling evidence.
Do we need to complete a Privacy Impact Assessment?
The Department recommends a PIA when a government school wants to use software it does not provide that stores personal, sensitive or health information (PIA guidance, updated 10 July 2025). The school completes the PIA itself; the guidance says vendors must not complete it on the school's behalf. We provide privacy, security and data-handling evidence for your privacy impact assessment, covering data handling, security controls, and how AI is used.
How does Descant handle student data mentioned in wellbeing notes?
Wellbeing staff use the platform to document support sessions. If a staff member records or dictates a session, the audio and what is said, which can include student names and wellbeing details, are transcribed and drafted into a note by AI in Australia. The staff member reviews and edits the draft before saving it. If your school switches AI off, staff write notes themselves. Audio recordings are deleted once transcribed — only the text documentation is retained.
Can Victorian government schools use AI documentation tools?
Privacy law is only part of the answer. Government schools also follow the Department's Generative Artificial Intelligence policy, which requires opt-in consent from parents and carers before using AI tools that need personal information, and directs staff not to load personal information about students or staff onto AI tools. Opt-in consent alone does not lift the rule against loading personal information, so confirm your approach with the Department before using AI features, or use Descant with AI off. Your school can switch Descant's AI features off, or require recorded parent or carer opt-in consent before AI processes a student's information. Catholic and independent schools should check their own rules.
What happens to our data if we stop using the platform?
When your agreement ends, we export your records on request, then delete them within 90 days and confirm in writing.
Does Descant meet VPDSS requirements?
Your school or department makes that assessment against the Victorian Protective Data Security Standards. We provide the privacy, security and data-handling evidence it needs, including encryption in transit and at rest, role-based access controls, audit logging, and student records stored and processed in Australia.
Need Help With Your School's Vendor Assessment?
We'll provide the documentation your school needs to complete the assessment process in Victoria. Request a compliance pack and we'll be in touch.
See Descant with your school in mind
Tell us a little about your school and we'll show you how it would work for your team.
- A made-up school like yours to explore for 14 days
- We check each request by hand and reply within two school days
- Made-up students only: no real student information needed
Prefer email? Write to [email protected].
(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.