guide · AI and student information · last reviewed 18 October 2026
Using AI with student information in Tasmanian schools
Tasmanian government schools follow DECYP's Use of Generative AI in DECYP Schools Policy and Procedure, which are under review, and the Personal Information Protection Act 2004. This guide sets out what they say about student information.
At a glance
- Sensitive or personally identifiable information must not be used as an input for any generative AI tool.
- Only tools on DECYP's endorsed list, assessed by ITS Cyber Security, should be used.
- Parent consent does not lift the input ban.
- Catholic and independent schools set their own rules.
General information, not legal advice. Last reviewed 18 October 2026; rules change, so check the sources below and confirm with your department.
What the department says (government schools)
The policy (v0.11, November 2023; "currently under review") applies to DECYP staff in schools and colleges. "DECYP endorses the use of DECYP-approved Generative AI tools in government schools to enhance teaching, learning and administration."
The procedure (v0.11, December 2023) says: "Sensitive or personally identifiable information must not be used as an input for any generative AI tool." Staff "Ensure that input prompts used to create outputs in generative AI do not contain any personally identifiable or confidential information."
Tools not on the endorsed list "may not meet the standards required for use and are hence not endorsed for use in DECYP schools". "During the review period, staff must continue to follow the current policy and procedure as their primary guidance."
What the law says
- Personal Information Protection Act 2004: 10 Personal Information Protection Principles. Principle 9 covers disclosure outside Tasmania; Principle 5 is openness.
- Under Principle 9, personal information may go outside Tasmania only in limited cases, for example when the recipient is bound by substantially similar principles, the individual consents, or reasonable steps are taken. Records stored in Sydney are outside Tasmania.
- Data breaches: there is no breach-notification duty in the Act. The Tasmania Law Reform Institute recommended a scheme in May 2024; no bill had been introduced as at October 2026.
- The Ombudsman handles privacy complaints. The Child and Youth Safe Organisations Act 2023 applies in general; no AI-specific rule was found under it.
Parent consent
The AI policy and procedure have no consent rule.
Consent does not lift the procedure's ban on identifiable inputs to generative AI.
Follow your school's consent framework for wellbeing records in general.
What staff can and can't put into AI
Staff can
- Use DECYP-approved generative AI tools from the endorsed list
- Use AI with prompts that contain no personally identifiable or confidential information
- Request a risk assessment of a new tool through ITS
- Write notes and reports themselves in software with AI switched off
Staff can't
- Use sensitive or personally identifiable information as an input to any generative AI tool
- Use tools that are not on the endorsed list
- Put confidential information into prompts
- Treat consent as an exception to the input ban
Reports and family communication
No specific rule on AI drafting reports or communicating with families was found. Outputs must be "factual, accurate and appropriate".
Because inputs cannot identify a student, AI drafting of student-specific documents does not fit the current procedure.
Approvals and assessments
| Step | What it involves |
|---|---|
| Risk assessment request | "Applications for Risk Assessment of tools can be made through the ITS Application Risk Assessment Form." |
| ITS Cyber Security | Endorsed tools "have been assessed for information privacy and security risks by the ITS Cyber Security team". |
| Endorsed list | ITS keeps "an accessible list of DECYP-approved generative AI technologies" on the staff intranet. |
| Principle 9 | Check that your agreement with the provider addresses disclosure outside Tasmania. |
Timelines. The policy's review was due 31 January 2025 and is still under way; a revised policy is pending, date unknown. No published timeline for ITS risk assessments.
Catholic and independent schools
The DECYP policy binds government schools and colleges. Catholic Education Tasmania and independent schools follow the federal Privacy Act and their own rules.
The ISA/NCEC Privacy Compliance Manual (April 2025) suggests a privacy impact assessment for each AI system.
Check Catholic Education Tasmania's or your school board's rules on AI tools.
Using Descant within these rules
Under the current procedure, Tasmanian government schools use Descant with AI off unless DECYP endorses its AI in writing or the revised policy changes the rule.
AI is off unless your school adds it
Recording, AI drafting and AI summaries are an optional paid add-on, off unless your school adds them. A school can switch AI off at any time. With AI off, nothing about a student is sent to an AI model, and case management, referrals, support plans, consent records and notes staff write themselves keep working.
Require recorded parent consent before AI runs
With this setting on, AI processes a student's information only when the school has recorded consent from a parent or carer. In Tasmanian government schools consent alone does not lift the department's position on identifiable information, so use it only once the department has approved AI use.
Documents families sign online (coming)
Families will be able to read and sign other school documents online. Parents and carers can already give consent through a secure link. No AI is involved in signing.
Staff review every AI draft
Drafts are labelled as AI-assisted, stay with the staff member, and are never sent to families automatically. Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
See the Tasmanian privacy compliance page for the privacy principles and assessment steps, how Descant keeps student data safe, our privacy policy, and note templates staff can write from with AI off.
Questions to ask your department
- When will the revised AI policy and procedure be published, and will they keep the ban on identifiable inputs for endorsed, Australian-hosted, contracted tools?
- Can an ITS-assessed tool be endorsed for identifiable student information, or does the input ban override endorsement?
- Does "The use of Generative AI by an organisation/business supplying a service" (out of scope) cover a vendor's built-in AI used by staff?
- How long does an ITS Application Risk Assessment take, and can a vendor apply directly?
- Does DECYP treat Sydney hosting under contract as meeting Principle 9?
Contact: [email protected], or DECYP Information Technology Services.
Sources
Each source was read on 18 October 2026. Dates are those shown on the page or document.
- Use of Generative AI in DECYP Schools Policy (PDF) (v0.11, 10 November 2023; under review)
- Use of Generative AI in DECYP Schools Procedure (PDF) (v0.11, 12 December 2023; under review)
- DECYP 9-12: generative AI tools (updated 18 June 2024)
- Personal Information Protection Act 2004 (authorised version 5 September 2024)
- Tasmania Law Reform Institute, Report No 33 (PDF) (May 2024)
This guide is general information, not legal advice. It describes public rules as at 18 October 2026, and makes no claim that Descant is approved by any department.
Other states and territories
The national picture: frameworks, ST4S and the Privacy Act. Other guides in the series: Victorian schools, NSW schools, Queensland schools, South Australian schools, Western Australian schools, Northern Territory schools, ACT schools.