Privacy concerns how personal information is collected, held, used, disclosed, accessed, corrected and destroyed. Confidentiality is the duty to protect information received through a professional role from unauthorised access or disclosure.

Information in early childhood settings may include

• names, addresses, dates of birth, contact and enrolment information
• health, disability, cultural, religious, family violence and child protection information
• photographs, video, audio, voice recordings and online identifiers
• observations, assessments, learning records and family communications
• complaints, allegations, investigations and incident records
• staff employment, qualification, screening, performance and medical information
• opinions about an identifiable person, whether or not the opinion is accurate

Sensitive information receives greater protection. Children cannot be expected to manage risks created by adults. Staff must use information only for legitimate work purposes and within their authorised role.

Privacy is not one decision at the end of a process. It applies across the whole information lifecycle.

1. Plan: identify the lawful purpose, the minimum information needed and the authorised system.
2. Collect: collect fairly and lawfully, usually from the person concerned where appropriate, and provide the required privacy information.
3. Use: use information for the purpose for which it was collected or another lawful, authorised purpose.
4. Share: confirm the recipient, authority, purpose and minimum necessary content before disclosure.
5. Store: protect paper and digital information with approved access, physical security, passwords and system controls.
6. Maintain: keep information accurate, complete, current and relevant.
7. Retain or destroy: follow legal and NERPSA retention requirements and authorised secure destruction processes.

Do not collect information “just in case,” copy records into personal notes, keep duplicate files indefinitely or move information to a convenient personal account. More copies create more access points and greater risk.

A record may later be read by a family, manager, regulator, investigator, court or the person it concerns. Write as though the record may need to explain what occurred without your memory or additional commentary.

Professional records are

• factual, specific, dated and attributable to the author
• clear about what was directly observed, what was reported and by whom
• free from labels, ridicule, gossip and unnecessary judgement
• limited to information relevant to the record’s purpose
• completed promptly in the approved form or system
• corrected transparently without deleting or disguising the original record

Curriculum documentation must also protect dignity. A photograph, learning story or behaviour record should not embarrass, stereotype or expose a child. Ask whether the record is necessary, respectful and appropriate for its intended audience.

Access is based on role and purpose, not familiarity, seniority or curiosity. Before sending, speaking or showing a record, confirm who needs it, why they need it, what authority applies and how it should be transferred.

Everyday safeguards

• use only approved NERPSA accounts, forms, platforms and storage locations
• use a unique account and strong passphrase; never share credentials
• lock screens and secure paper records whenever unattended
• check recipients, attachments, names and permissions before sending
• use blind copy only where the approved communication process requires it
• avoid identifiable discussions in entrances, car parks, cafés, social media and public transport
• do not photograph a screen or forward information to make work more convenient
• report incorrect access, unexpected sharing permissions or suspicious messages immediately

Family and community enquiries must be answered within your role. Confirm identity where needed. Do not reveal enrolment, attendance, family circumstances, staffing matters or incidents merely because a caller knows a child’s name.

From 27 February 2026, the National Law and Regulations restrict personal digital devices and how images of children are captured, stored and transmitted.

Centre based service rule

A personal device is one not owned or supplied by the Approved Provider that can capture, store or transmit images, including a phone, camera, tablet, smart watch or hard drive. Staff, volunteers and students generally must not use or have a personal device in their possession while working directly with children. Limited legal exceptions and written authorisations may apply. Staff must not create their own exception.

Working directly with children means being physically present with a child or children while providing education and care. A short break away from children is treated differently under the national guidance, but NERPSA’s current local procedure and storage arrangements must still be followed.

Service supplied devices

Only service supplied devices used exclusively for education and care may be used to capture, store or transmit images of children. Use them only for authorised purposes, keep them secured, follow access and upload processes and report loss, damage or unusual activity immediately.

Children’s use of technology

• select age appropriate, purposeful and child safe content
• supervise actively rather than using a device as a substitute for engagement
• use privacy protective settings and approved accounts
• avoid advertising, tracking, chat, open sharing and unnecessary data collection
• teach children about consent, help seeking, respectful use and safe boundaries
• respond to concerning content, contact or behaviour through child safety procedures

Since 1 September 2025, required service policies and procedures for digital technologies and online environments must address taking, using, storing and destroying children’s images and videos; parent authorisation; optical surveillance such as CCTV; service issued devices; and children’s use of digital devices.

Before capturing or using an image

• confirm there is a legitimate educational or operational purpose
• use an approved service supplied device and authorised platform
• check the current parent authorisation and any limits on use
• consider the child’s views, assent, dignity, culture and safety
• check the background for other children, names, attendance lists or sensitive information
• capture only what is necessary and avoid private, vulnerable or undignified situations
• store, share, retain and destroy the image only through approved processes

Parent authorisation does not require an educator to take or publish an image, and it does not override child safety or dignity. A child’s refusal, distress or withdrawal should be respected. Children should understand, in a way appropriate to their age and communication, what is happening and who may see the image.

Never post or comment about NERPSA children, families, incidents or workplace information on personal social media. Privacy settings, closed groups, disappearing messages and deleted posts do not remove the risk.

Privacy rules permit or require information sharing in particular circumstances, including where authorised by law. Child protection reporting, emergency response, the Child Information Sharing Scheme, Family Violence Information Sharing Scheme, regulator notifications and lawful investigation processes may apply. Follow the specific current procedure and share only through authorised channels.

Possible breaches include

• an email or attachment sent to the wrong recipient
• a lost device, USB, file, notebook or printed record
• unauthorised access, shared passwords or an account left open
• a child’s image captured, stored or shared outside approved systems
• malware, phishing, suspicious login or unexpected system activity
• records discussed where unauthorised people can hear
• information retained, copied or destroyed contrary to requirements

If a breach or near miss occurs

1. take safe immediate steps to contain it without deleting evidence
2. notify the responsible person and the designated NERPSA contact immediately
3. follow child safety, incident, privacy and technology escalation requirements
4. record facts: what happened, information involved, people affected, time, systems and containment
5. do not contact recipients, families, media or external authorities unless authorised or personally required by law
6. cooperate with assessment, notification, recovery and prevention actions