guide · AI and student information · last reviewed 18 October 2026
Using AI with student information in Victorian schools
Victorian government schools follow the Department of Education's Generative Artificial Intelligence policy, which covers software with generative AI built in. This guide sets out what it says about student information, what the law adds, and how a school can work within it.
At a glance
- The policy asks schools to direct staff not to load personal information about students onto generative AI tools, and not to upload audio or photos of students.
- Opt-in parent consent is needed before using a generative AI tool that needs personal information, but consent does not lift the rule on loading personal information.
- Staff must not use generative AI to write student reports for parents or carers, or to judge achievement or progress.
- Catholic and independent schools set their own rules.
General information, not legal advice. Last reviewed 18 October 2026; rules change, so check the sources below and confirm with your department.
What the department says (government schools)
The Generative Artificial Intelligence policy (policy last updated 18 June 2024; page updated 28 September 2026) applies "when using generative AI in all contexts", including "software that integrates generative AI tools". It binds government schools.
Schools "must direct staff and students to not load any personal information about students or staff onto the tool (for example, student names, reports, personal histories and contact details)". Staff must not "upload media including depictions of students, staff or parents (for example, photos, audio, video)".
The guidance on protecting privacy asks staff to "de-identify data before uploading it", to avoid tools that "save or store this data for future use by the provider", and notes that "content generated by generative AI about a person can constitute a new collection of personal information".
No exemption for vendor-assessed or Department-assessed tools was found in the policy or its guidance as at 18 October 2026.
What the law says
- Privacy and Data Protection Act 2014: 10 Information Privacy Principles, regulated by the Office of the Victorian Information Commissioner (OVIC). Government schools also apply the Victorian Protective Data Security Standards.
- Health Records Act 2001 (Vic): health information, including wellbeing and disability details, has its own principles.
- Data breaches: government schools follow the Department's breach procedures. Non-government schools are covered by the federal Notifiable Data Breaches scheme.
Parent consent
Schools "obtain opt-in consent from parents and carers before using any generative AI tool" that needs personal information beyond a school email and password.
The consent guidance (updated 9 July 2025) says "Opt-in consent must be used when the activity or software collects" health or wellbeing information, and that "Parents should have the option to opt-out of their child from using or having their information stored in AI tools."
The same guidance repeats: "Personal information must not be uploaded to generative AI tools." Consent and the personal-information rule sit side by side, so consent alone does not make it acceptable to enter identifiable information.
What staff can and can't put into AI
Staff can
- Use generative AI with de-identified information, for the task at hand
- Use AI for planning and drafting that contains no personal information
- Review AI output before any decision is made
- Write notes and reports themselves in software with AI switched off
Staff can't
- Load student or staff personal information, such as names, reports or personal histories
- Upload photos, audio or video of students, staff or parents
- Use generative AI to write student reports for parents or carers
- Use generative AI to make judgements about achievement or progress
Reports and family communication
Staff must not use generative AI tools to directly communicate with parents or students, make judgements about achievement or progress, or "write student reports for parents or carers".
The appropriate-use guidance (updated 25 November 2025) says "the professional judgement of teachers remains central" and that "outputs from a generative AI tool face human review prior to decisions being made".
It also says "Schools can build trust by disclosing the use of generative AI tools, especially when use may have an impact on others." Whether "student reports" covers meeting minutes or support summaries shared with families is not stated, so ask the Department.
Approvals and assessments
| Step | What it involves |
|---|---|
| Privacy impact assessment | Recommended for software the Department does not provide that is not on Arc, stores personal, sensitive or health information, or is high risk (updated 10 July 2025). "Vendors must not complete the PIA on the school's behalf." |
| ST4S check | Schools "must not implement digital tools that have been assessed as non-compliant, non-participating or high risk". |
| Department-provided tools first | "schools must not implement digital tools where a department-provided technology provides the same service or function." |
| School Software Panel | The Department's "approved procurement and assurance pathway" (Software and Administration Systems policy, 16 October 2026). Panel products need an active ST4S assessment. Where no assessed or panel product is suitable, schools "must complete a Privacy Impact Assessment (PIA)" and "submit a security impact assessment request". |
Timelines. School Software Panel: released October 2027, with a 12-month grace period for schools. ST4S reports expire after 2 years. No published timeline for PIA or security impact assessment reviews.
Catholic and independent schools
The Department's policy binds government schools only. Catholic and independent schools follow the federal Privacy Act and their own rules.
The Melbourne Archdiocese Catholic Schools (MACS) Code of Conduct for staff (2025) says "We must not enter personally identifiable information or corporate data into such tools", alongside using "MACS-issued artificial intelligence (AI) tools appropriately". MACS schools should get MACS approval first.
No public Independent Schools Victoria rule on generative AI was found. The ISA/NCEC Privacy Compliance Manual (April 2025) suggests a privacy impact assessment for each AI system.
Using Descant within these rules
For Victorian government schools, the clear path today is Descant with AI off, plus any approach to AI features the Department confirms in writing.
AI is off unless your school adds it
Recording, AI drafting and AI summaries are an optional paid add-on, off unless your school adds them. A school can switch AI off at any time. With AI off, nothing about a student is sent to an AI model, and case management, referrals, support plans, consent records and notes staff write themselves keep working.
Require recorded parent consent before AI runs
With this setting on, AI processes a student's information only when the school has recorded consent from a parent or carer. In Victorian government schools consent alone does not lift the department's position on identifiable information, so use it only once the department has approved AI use.
Documents families sign online (coming)
Families will be able to read and sign other school documents online. Parents and carers can already give consent through a secure link. No AI is involved in signing.
Staff review every AI draft
Drafts are labelled as AI-assisted, stay with the staff member, and are never sent to families automatically. Transcription and drafting run in Australia, audio is deleted once transcribed, and school data is not used to train AI models.
See the Victorian privacy compliance page for the privacy principles and assessment steps, how Descant keeps student data safe, our privacy policy, and note templates staff can write from with AI off.
Questions to ask your department
- Does the rule against loading student personal information apply to a contracted, Australian-hosted tool used only by staff, which does not train on or keep data?
- With opt-in parent consent and a completed PIA, may staff use AI to transcribe and draft notes from recorded support sessions, given the rule on uploading audio?
- Does "write student reports for parents or carers" cover progress summaries, meeting minutes or support group minutes shared with families?
- Is a student wellbeing tool with built-in AI in scope for the School Software Panel, and how does a vendor apply?
- With AI switched off for the whole school, is the tool treated as ordinary software under the software policy?
Contact: [email protected] (privacy and consent); [email protected] (panel).
Sources
Each source was read on 18 October 2026. Dates are those shown on the page or document.
- Generative Artificial Intelligence policy (page updated 28 September 2026; policy last updated 18 June 2024)
- Guidance: protecting privacy and personal data (18 June 2024)
- Guidance: appropriate use of generative AI tools (updated 25 November 2025)
- Privacy and information sharing: consent (updated 9 July 2025)
- Privacy impact assessments (updated 10 July 2025)
- Software and Administration Systems policy (updated 16 October 2026)
- MACS Code of Conduct for MACS Staff (PDF) (v2.0, 2025)
This guide is general information, not legal advice. It describes public rules as at 18 October 2026, and makes no claim that Descant is approved by any department.
Other states and territories
The national picture: frameworks, ST4S and the Privacy Act. Other guides in the series: NSW schools, Queensland schools, South Australian schools, Western Australian schools, Tasmanian schools, Northern Territory schools, ACT schools.