School-led review · WA
Privacy Compliance for Western Australian Schools
The privacy rules of the Privacy and Responsible Information Sharing Act 2024 began applying to agencies, including public schools, on 1 July 2026. Descant provides the privacy, security and data-handling evidence a school needs for its review — student records stored and processed in Australia, encrypted in transit and at rest, with audit logging and audio deleted once transcribed.
Key Details
- Enacted
- 2024
- Privacy Principles
- 11 Information Privacy Principles (IPPs)
- Regulator
- Office of the Information Commissioner (OIC)
PRIS Act in Effect from 1 July 2026
Most privacy provisions of the Privacy and Responsible Information Sharing Act 2024 commenced on 1 July 2026. Its notifiable information breach scheme starts later, on 1 January 2027.
Legislation Overview
Privacy and Responsible Information Sharing Act 2024
Regulated by the Office of the Information Commissioner (OIC)
Key Provisions
- 11 Information Privacy Principles, with most privacy provisions in effect from 1 July 2026
- Notifiable information breach scheme from 1 January 2027, with notification within 30 days of a reasonable suspicion
- A privacy impact assessment is required where an activity is likely to have a significant impact on privacy
- IPP 10: safeguards for automated significant decisions, and individuals can seek human intervention
- The Act extends to contracted service providers operating in and outside Australia
- Schools check the Department's Third Party Services Catalogue (staff only) or request an online service risk assessment
- The Department's ClassmAIte lesson-planning AI pilot runs in 60 schools in 2026 (May 2026)
Data Breach Notification
Mandatory — The notifiable information breach scheme starts on 1 January 2027. From then, agencies must notify the Information Commissioner and affected people of notifiable breaches as soon as reasonably practicable, and within 30 days of forming a reasonable suspicion.
AI Governance Framework
WA Government AI Policy and Assurance Framework — WA Government entities "must use the self-assessment for any system or project that is driven by AI or automated decision making", whether it is procured, built or adapted (page updated 25 August 2026). The Department of Education has no public generative AI policy for staff; its staff guidance is on its intranet.
Western Australian government schools: AI and the PRIS Act
The Department of Education has no public generative AI policy for staff; its staff guidance sits on the intranet. The public rules that apply come from the PRIS Act, the Students Online in Public Schools procedures and the WA Government AI Policy and Assurance Framework. Descant's recording and drafting use AI on information about named students, so check with the Department before using them.
What the rules say
- Students Online procedures: if a service is not in the Third Party Services Catalogue, "request an online service risk assessment", then give consent or notification "as specified in the Third Party Service Risk Report", with "provisions to opt-out". The procedures do not mention AI.
- WA Government AI framework: "Entities must use the self-assessment for any system or project that is driven by AI or automated decision making".
- PRIS Act: a privacy impact assessment is required for activities likely to have a significant impact on privacy, and IPP 10 requires safeguards so "individuals can seek human intervention" in automated decisions.
What Descant does
- AI features are an optional paid add-on, off unless a school adds them, and a school can switch AI off at any time. With AI off, nothing is sent to an AI model, and case management, referrals, digital consent and notes staff write themselves keep working.
- A school can require recorded parent or carer consent before AI processes a student's information.
- AI drafts stay with the staff member. They are labelled as AI-assisted, reviewed before saving, and never sent to families automatically.
- Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
What your school does
- Check the Catalogue or request a risk assessment, then follow its consent or notification advice.
- Ask the Department whether staff may use AI with student information, and whether the AI assurance self-assessment is needed and who submits it.
- Complete a privacy impact assessment; wellbeing information and session audio are likely to count as significant.
- Where parent consent is required, use Descant's consent setting, or use Descant with AI off.
Sources
- OIC WA: privacy laws article (PDF) (April 2026)
- Students Online in Public Schools Procedures (v3.5, last updated 3 March 2023)
- WA Government AI Policy and Assurance Framework (updated 25 August 2026)
- ClassmAIte media statement (9 May 2026)
This is general information, not legal advice, and policies change. Check the current pages, and confirm your approach with the Department, before you decide.
Using AI with student information in Western Australian schools →
Vendor Assessment Pathway
Here's the process your school follows to adopt a new platform in Western Australia. We'll support you at every step.
- Step 1
Catalogue Check or Risk Assessment
Site managers check the Department's Third Party Services Catalogue (staff only). If the service is not listed, they request an online service risk assessment. We provide the privacy, security and data-handling evidence it needs.
- Step 2
Consent or Notification
The school follows the consent or notification level set in the Third Party Service Risk Report, with an annual parent process and an option to opt out.
- Step 3
Privacy Impact and AI Assessment
A privacy impact assessment where the use is likely to have a significant privacy impact, and, for AI features, the WA Government AI assurance self-assessment. Until the Department confirms AI use, use Descant with AI off.
- Step 4
School Deployment
After approval, wellbeing staff are onboarded to the platform. The school reviews its use regularly against the PRIS Act.
Western Australia School Privacy Requirements: What Descant Provides
What Descant does for each privacy and security requirement your Western Australia review will check, and the evidence we provide.
PRIS Act — Data security obligations
Encrypted in transit and at rest. Role-based access controls. New passwords of at least 14 characters with upper and lower case, a number and a symbol, plus optional two-step sign-in (a one-time code) that a school can make compulsory. Views of student records and sensitive notes, and every change, are logged.
PRIS Act — Use and disclosure limitations
Data is used solely for documentation purposes within your school. No data shared with third parties for marketing or other purposes.
Data residency in Australia
Student records are stored and processed in Australia (Sydney). Speech-to-text and AI drafting also run in Australia, and audio is deleted once transcribed. Some supporting services, such as email delivery and payments, are overseas.
Audio data handling
Audio is deleted once it's transcribed. Only text documentation is retained.
Audit trail and accountability
Views of student records and sensitive notes, and every change, are logged. Audit logs are kept for at least 7 years and are available for compliance reporting and incident investigation.
IPP 10 — Automated decisions and human oversight
AI drafts for staff and makes no decisions about students. Staff review every draft before it is saved, drafts are never sent to families automatically, and AI is an optional paid add-on that a school can switch off at any time. No AI training on school data.
Who uses the platform
Staff use the platform. Students only use secure links, for a short check-in or a questionnaire their school sends, with no AI. Parents and carers use secure links for consent and questionnaires, and educators sign in to add evidence. Students do not use AI in Descant.
Notifiable information breaches (from 1 January 2027)
Incident response plan and breach notification procedures in place. We notify affected schools within 72 hours of becoming aware of a data breach likely to result in serious harm and support them with notification to the Information Commissioner once the scheme starts on 1 January 2027.
Guidance by School Sector
Different school sectors in Western Australia have different procurement processes. Select your sector for specific guidance.
Government Schools
Key body: Department of Education Western Australia (DoE WA)
Since 1 July 2026, government schools follow the PRIS Act. Before using an online service that holds student information, schools check the staff-only Third Party Services Catalogue or request a risk assessment, then follow its consent or notification advice.
- PRIS Act privacy rules from 1 July 2026; breach notification from 1 January 2027
- Third Party Services Catalogue (staff only) or an online service risk assessment
- Consent or notification as the Third Party Service Risk Report specifies, with opt-out
- WA Government AI assurance self-assessment for systems driven by AI
- The Department's ClassmAIte pilot (lesson planning) runs in 60 schools in 2026
Catholic Schools
Key body: Catholic Education Western Australia (CEWA)
Catholic Education Western Australia's AI Framework (v1.1, December 2024) says AI tools must be on its Approved Technology list, after review by CEWA.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- AI tools must be on the CEWA Approved Technology list
- The ISA/NCEC Privacy Compliance Manual (April 2025) suggests a privacy impact assessment for each AI system
- Check whether CEWA expects an ST4S assessment
Independent Schools
Key body: Association of Independent Schools of Western Australia (AISWA)
AISWA's AI Guidelines for Schools 2024 page points schools to the Australian Framework for Generative AI in Schools. Individual schools retain procurement autonomy.
- Governed by the federal Privacy Act and Australian Privacy Principles (APPs)
- AISWA points schools to the national framework for generative AI
- Individual school board or principal makes technology procurement decisions
- PIA recommended — we provide privacy, security and data-handling evidence for your privacy impact assessment
Frequently Asked Questions
Something we haven't answered? Ask us and a person from the team will reply.
Ask a questionHow does the new PRIS Act affect our school's use of technology platforms?
Most privacy provisions of the Privacy and Responsible Information Sharing Act 2024 have applied to WA government agencies, including public schools, since 1 July 2026. The notifiable information breach scheme starts on 1 January 2027. The Act sets 11 Information Privacy Principles, requires a privacy impact assessment for activities likely to have a significant privacy impact, and covers contracted service providers. We provide the privacy, security and data-handling evidence your school needs for that review.
Is Descant on the Third Party Services Catalogue?
The Catalogue is on the Department's staff intranet, so check its current list. If a service is not listed, the procedures say to request an online service risk assessment. We provide privacy, security and data-handling evidence for that assessment, including how AI is used.
How does Descant handle student data mentioned in wellbeing notes?
Wellbeing staff use the platform to document support sessions. With AI off, staff write notes themselves. Where AI is on, the audio and transcript sent for drafting contain identified student information, and the staff member reviews the draft before saving. Audio recordings are deleted once transcribed — only the text documentation is retained.
Where is our school's data stored?
Student records are stored and processed in Australia (Sydney). Speech-to-text and AI drafting also run in Australia, and audio is deleted once transcribed. Some supporting services, such as email delivery and payments, are overseas. Your school decides whether this meets its PRIS Act and departmental data residency expectations.
Can we use AI features now that the PRIS Act has commenced?
The Department has no public generative AI policy for staff, so ask it first whether staff may use AI with student information and whether the WA Government AI assurance self-assessment applies. Complete a privacy impact assessment covering AI and audio. Until then, your school can use Descant with AI off.
What happens to our data if we stop using the platform?
When your agreement ends, we export your records on request, then delete them within 90 days and confirm in writing.
Need Help With Your School's Vendor Assessment?
We'll provide the documentation your school needs to complete the assessment process in Western Australia. Request a compliance pack and we'll be in touch.
See Descant with your school in mind
Tell us a little about your school and we'll show you how it would work for your team.
- A made-up school like yours to explore for 14 days
- We check each request by hand and reply within two school days
- Made-up students only: no real student information needed
Prefer email? Write to [email protected].
(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.