language: en · status: in-force · last checked: 2026-10-08

Queensland — Department of Education Obtaining and managing student and individual consent procedure, and Online Services consent guideline

The Queensland Department of Education's procedure, in its Policy and Procedure Register (PPR), on obtaining and managing consent to use students', staff and volunteers' copyright materials and to record, use or disclose their personal information "to a third party beyond what is already authorised or required by law" (Purpose). Its audience is department-wide. The procedure covers the State School Consent Form and the Project Consent Form, and for online services points to a separate Guideline for obtaining and managing Online Services Consent (Online Services consent), published as a PDF attachment to the PPR page. The guideline is the process every Queensland state school follows before students use a third-party online service. Procedure version 6.15, effective 28 November 2025, per the PPR page's "Version number" and "Version effective" fields (PPR procedure page, read 2026-10-08); the guideline PDF carries no date of its own.

Applicability to EdTech

• Three categories of online service (guideline, Online Services): Enterprise services (OneSchool, QLearn, Office 365 and the like) need no consent (Enterprise services); for services under a department supply arrangement consent "is usually required" (Supply arrangements); third-party services "should only be considered when there is not a viable service available as an Enterprise offering or under a Supply Arrangement", and consent for them "is usually required" (Third-party services).
• What the consent covers (Online Services Consent Form): the form collects consent to record, use, disclose and publish specified student information and "to transfer the information and works within Australia and outside of Australia (in the case of offshore services) to online service providers", for students to register accounts and to use each service "in accordance with each service’s Terms of Use/Service and Privacy Policy". Consent from a parent or carer is needed for a minor, and personal information includes "image, video, audio recording" (Consent requirements).
• What a school records about each service (Obtaining consent, step 1): service name and URL, data hosting (onshore/offshore), purpose, the Terms of Use and Privacy Policy URLs, the data assets disclosed, and any additional consent requirements, taken from the department's Online Service Risk Review where one exists. Principals keep a register of the services approved for use "and the personal information stored within each service" (Principals). A supplier whose terms and privacy policy are clear on hosting and data use makes this step straightforward.
• Consent is per phase and all-or-nothing per service (School staff; Limiting consent): the form is renewed for each phase of learning (P–3, 4–6, 7–9, 10–12) or when new services are added, and a request to limit consent for a specific service "will be treated as ‘do not consent’". A product needs to work for a class in which some students have no consent.
• Valid consent and the penalty for its absence (Overview; Unauthorised recording/collection, use or disclosure): consent must be voluntary, informed, specific and current. Recording, using or disclosing a state school student's personal information without valid consent "may breach the confidentiality provisions in the EGPA, which carries a maximum penalty of 50 penalty units", and may be misconduct or corrupt conduct.
• Photos and third parties (School staff): schools must notify parents when third parties wish to film or photograph students, must not identify students by full name on social media, and "must not use image hosting sites such as Vimeo, Pinterest, Flickr, Picasa, Image Shack, Snapchat, Tumblr or the like".

Contents

Scope note: the Online Services Consent Form, its paper form and information sheet, the Online Service Risk Reviews and the knowledge-base articles are staff-only and not reproduced. The consent forms the procedure links (State School, Project, Staff and Volunteer, HAT and LT) and the HAT and LT certification guideline are not extracted. The guideline PDF carries no version or date; it is pinned by its SHA-256.

Enforcement

Internal to the department, through the EGPA confidentiality provisions (50 penalty units), the Public Service Act 2008 (misconduct) and the Crime and Corruption Act 2001 (Unauthorised recording/collection, use or disclosure). Against a supplier, the consent rules work through the school's choice of service and its register.

Licence

The Department of Education's copyright statement (qed.qld.gov.au/copyright-statement, read 2026-10-08 for the Non-departmental ICT service providers procedure; linked as "Copyright" from this procedure's PPR page) says: "Unless otherwise noted, all copyright material available on this website is licensed under the Creative Commons Attribution 4.0 International licence (CC BY 4.0)." and "You must keep the copyright notice on the copyright material and attribute the State of Queensland as the source of the copyright material in the following manner: State of Queensland (Department of Education) [Year of publication]". The excluded categories (coat of arms, logos, trademarks, third-party material, personal information) are not reproduced. The guideline PDF is served from the same PPR site and carries no notice of its own.

Conditions and how the corpus meets them: attribution: State of Queensland (Department of Education) 2025, given here. Keep the copyright notice: "© State of Queensland, (Department of Education)" is recorded here. Indicate changes: each fact document's Meta section describes the reformatting into Markdown.

rights: open-licence.

Related

• Qld DoE Non-departmental ICT service providers — the procedure for engaging an outside ICT service, which points to the Online Services consent process
• AU Privacy Act — Commonwealth privacy law. Queensland state schools are bound by the Information Privacy Act 2009 (Qld), which is not yet in the corpus.
• NSW DoE Cyber security procedures — NSW's consent rule for online applications (Table 1)
• Vic DE Privacy and Information Sharing — Victoria's opt-in and opt-out consent guidance for software

Sources

• PPR — Obtaining and managing student and individual consent procedure
• PPR — Guideline for obtaining and managing consent for Online Services (PDF), archived copy sources/guideline-for-obtaining-and-managing-consent-for-online-services.pdf