language: en · status: in-force · last checked: 2026-10-08

Queensland — Department of Education Non-departmental ICT service providers procedure

A department-wide procedure in the Queensland Department of Education's Policy and Procedure Register (PPR). It applies when a school or business unit evaluates or procures an ICT service the department does not provide: a cloud or offshore service, or one delivered to students, parents or staff on the school's behalf. Version 1.5, effective 24 February 2026; in_force_from records that version's effective date.

Applicability to EdTech

• Enterprise services first, then an assessment (Process): "Where available enterprise services must be used". Any non-departmental ICT service needs an information security assessment. Schools adopting online websites or applications follow the department's Online Service Risk Review (OSRR) process. The Overview gives examples of covered services: communication tools, printing, "online self-paced services for curriculum related purposes such as testing and recording students' achievement", and document management and storage (Overview).
• Offshore hosting (Process; Responsibilities): "Information with an information security classification of SENSITIVE or PROTECTED must not be stored or transmitted offshore". Data "stored or processed overseas with an information security classification of PROTECTED or below must be approved by the Director-General". Both requirements are quoted as printed, although they are hard to reconcile, since PROTECTED is above SENSITIVE.
• Privacy duties the school carries for the supplier (Process — Privacy Considerations): monitor the service "to prevent loss, unauthorised access, use, modification, disclosure or any other misuse of personal information"; name the provider (or describe the service) in privacy collection notices; where the provider "cannot be bound by a contract", tell users that it will hold and use the information on its own terms and conditions; and make sure "the personal information is removed when the service is ceased or decommissioned".
• What parents are told (Process — Requirements and Consultation): the purpose, what personal information the provider receives or collects, whether it is transferred out of Australia ("The department has no control when such information is transferred overseas"), consent requirements, and how to unsubscribe.
• Principal's liability if the process is skipped (Responsibilities): a principal who procures outside the departmental process must "accept full responsibility for the use of the service, including any associated risks, terms and conditions and legislative compliance (including responsibility for information involved in security breaches)".
• Paid services (Process — Procurement) follow the Purchasing and procurement procedure, with Legal Services advising on protection or privacy clauses. Enterprise services generally need no consent for disclosure of students' information (Definitions).

Contents

Scope note: the procedure refers to staff-only material (the OSRR knowledge-base article, the Online Services Consent Form, and the Information security classification and handling guideline), which is not reproduced. The two related public PPR instruments, the Obtaining and managing student and individual consent procedure and the Guideline for obtaining and managing consent for online services, are collected as Qld DoE Student consent procedure.

Enforcement

Internal to the department. The Director-General approves overseas storage, and principals carry the risk of services procured outside the process (Responsibilities).

Licence

The Department of Education's copyright statement (qed.qld.gov.au/copyright-statement, read 2026-10-08; linked as "Copyright" from the PPR page) says: "Unless otherwise noted, all copyright material available on this website is licensed under the Creative Commons Attribution 4.0 International licence (CC BY 4.0)." and "You must keep the copyright notice on the copyright material and attribute the State of Queensland as the source of the copyright material in the following manner: State of Queensland (Department of Education) [Year of publication]". The excluded categories (coat of arms, logos, trademarks, third-party material, personal information) are not reproduced.

Conditions and how the corpus meets them: attribution — State of Queensland (Department of Education) 2026, given here; keep the copyright notice — "© State of Queensland, (Department of Education)" is recorded here; indicate changes — the fact document's Meta section describes the reformatting into Markdown.

rights: open-licence.

Related

• AU Privacy Act — Commonwealth privacy law. Queensland state schools are bound by the Information Privacy Act 2009 (Qld), which is not yet in the corpus.
• Qld DoE Student consent procedure — the consent procedure and the Online Services consent guideline
• NSW DoE Cyber security procedures — NSW's equivalent gate
• Vic DE Software and Administration Systems — Victoria's ST4S gate

Sources

• PPR — Non-departmental ICT service providers procedure