EdLaw
New South Wales — Department of Education Privacy standards (PD-2024-0485-07)
The NSW Department of Education's standards on managing personal and health information under the Privacy and Personal Information Protection Act 1998 (NSW) and the Health Records and Information Privacy Act 2002 (NSW). They sit under the department's Our culture policy (PD-2024-0485). The audience is "All staff, contractors, visitors to the department’s schools and workplaces, students, their parents and people applying for employment" (audience). The standards cover what the department commits to when it collects, stores, uses and discloses information, how people get access to and amend their information, how data breaches are reported, and how privacy complaints are reviewed. Implementation date 5 September 2024; the current version is V01.1.3 of 13 July 2026.
Applicability to EdTech
- Contractors are in the audience (audience): the standards address contractors as well as staff, so a supplier's personnel working with department data are expected to follow them.
- The department's commitments set the frame for a supplier's handling (roles and responsibilities): the department collects only information "directly relevant to its functions and activities", takes reasonable steps to protect it "from loss, unauthorised access, modification, use and disclosure", does not keep it longer than necessary, disposes of it under the State Records Act 1998, and "does not disclose personal or health information about an individual to a third party without that individual’s consent". It also complies with the Workplace Surveillance Act 2005 and the Surveillance Devices Act 2007. A service that holds department data has to let the department meet each of these.
- Storage practice (1. Collect and store information): electronic files are password protected with access limited to staff who need them, back-ups are stored securely, and "Where practicable, personal information in an electronic form should be encrypted before it is stored or shared". Collection is usually accompanied by a collection notice (1).
- Data breaches (4. Navigate privacy breaches): a data breach is unauthorised access to or disclosure of personal information, or its loss where that is likely to follow (definition). "All staff must report all suspected data breaches (as mandated under privacy legislation)" using the Data Breach Incident Notification Form, under the separate Data breach procedure (PD-2024-0485-12). A supplier's incident notice is what lets the department meet this duty.
- Access and amendment (2; 3): people may ask for their information informally or formally and ask for it to be amended, so a system holding student records has to be able to produce and correct them on request.
Contents
| Document | Covers |
|---|---|
| PRIVACY-STANDARDS.md | The standards as published: description, audience and change history; About the policy (policy requirements, definitions, roles and responsibilities); Standards (personal and health information, IPPs and HPPs; 1. Collect and store information; 2. Respond to access requests; 3. Request an amendment; 4. Navigate privacy breaches; 5. Privacy review and complaints processes); Mandatory tools and templates |
Scope note: the "Supporting tools, resources and related information" and "Policy contact" sections are not extracted. The Data breach procedure (PD-2024-0485-12) and the department's Privacy Code of Practice, which the standards refer to, are separate documents and are not collected. The NSW privacy statutes themselves are not yet in the corpus.
Enforcement
Internal to the department, with external review: privacy internal reviews (5.1), external review of an internal review (5.2), complaints to the Privacy Commissioner (5.3) and misconduct investigation for employees (5.5).
Licence
The NSW Department of Education's copyright statement (education.nsw.gov.au/about-us/rights-and-accountability/copyright, read 2026-10-08 for the Cyber security procedures; linked as "Copyright" from the standards' page) says: "Copyright material available on this website is licensed under a Creative Commons Attribution 4.0 International (CC BY 4.0) licence." and "Attribution should be given to: © State of New South Wales (Department of Education), 2023." The licence excludes logos, trademark-protected material and third-party material, none of which the corpus reproduces.
Conditions and how the corpus meets them: attribution: © State of New South Wales (Department of Education), 2023, given here and in the fact document's source line. Indicate changes: the fact document's Meta section describes the only change, a reformatting of the page into Markdown with the words unchanged.
rights: open-licence.
Related
- NSW DoE Cyber security procedures — the department's gate for online applications (assessment and parental consent) and its ICT contract requirements
- AU Privacy Act — Commonwealth privacy law. NSW public schools are bound by NSW privacy law, which is not yet in the corpus.
- Vic Schools' privacy policy — Victoria's counterpart
- Qld DoE Student consent procedure — Queensland's consent rules for online services
Sources
- NSW Department of Education — Privacy standards (PD-2024-0485-07)
- NSW Department of Education — Privacy, the department's privacy page that links the standards