Privacy Reform and Independent Schools.

Australia’s privacy landscape is undergoing its most significant transformation in decades. Although much public discussion has focused on large corporations and data breaches, independent schools should consider what the changes mean for their own operations.

Schools collect and retain sensitive information about children, families and staff, often across multiple systems and over long periods. Recent privacy reforms, including the statutory tort for serious invasions of privacy and automated decision-making transparency obligations due to commence on 10 December 2026, may reshape privacy risk in the education sector.

For school boards and leadership teams, privacy is increasingly a governance issue as well as a compliance exercise.

From 10 June 2025, amendments to the Privacy Act introduced a statutory tort for serious invasions of privacy.

The tort allows an individual to bring a claim directly against a person or organisation for an intrusion upon their seclusion or misuse of information relating to them, where they had a reasonable expectation of privacy and the other legal elements are established.

This provides an avenue for individuals to seek redress through the courts independently of the Office of the Australian Information Commissioner. A court may award remedies including damages, injunctions and orders requiring apologies.

The threshold for a successful claim is deliberately high. Even so, the reforms create a category of risk that schools should not overlook.

Independent schools operate in an environment where privacy expectations can be particularly strong. They routinely hold information including:

• student welfare records
• counselling and wellbeing information
• disability and learning support information
• behavioural records
• child protection information
• medical information
• parent financial information
• employment records
• photographs and recordings of children.

A privacy incident involving sensitive student information may be viewed differently from a similar incident involving ordinary commercial information. Courts may be particularly sensitive to privacy expectations where children, vulnerable students or family circumstances are involved. This can place schools in a high-risk privacy environment.

Over the past decade, schools have expanded wellbeing and pastoral care programmes. Student wellbeing platforms, mental health screening tools, behavioural tracking systems and incident management platforms are now common. These systems can provide important support for students, while also increasing the volume of highly sensitive information collected, stored and shared.

The risk is not limited to external cyber incidents. School leaders should consider inappropriate staff access to student records, unnecessary internal sharing of sensitive information, disclosure of counselling information, circulation of behavioural reports beyond those with a legitimate need to know, and inconsistent practices across campuses or departments.

Some of these issues may previously have been managed as governance or employment matters. They may also carry legal and reputational consequences.

Many schools use monitoring technologies for educational, safety or operational purposes. These may include CCTV, student device monitoring, internet filtering and monitoring platforms, classroom recording technologies, AI-based monitoring systems, attendance tracking systems, and transport or location-based applications.

The statutory tort raises questions about proportionality, transparency and community expectations. School leaders should consider whether each monitoring practice is clearly communicated, genuinely necessary, proportionate to the identified risk and consistent with the privacy expectations of students, parents and staff.

The closer monitoring moves towards personal communications, behavioural profiling or location tracking, the greater the potential scrutiny.

Over the past decade, schools have expanded wellbeing and pastoral care programmes. Student wellbeing platforms, mental health screening tools, behavioural tracking systems and incident management platforms are now common. These systems can provide important support for students, while also increasing the volume of highly sensitive information collected, stored and shared.

The risk is not limited to external cyber incidents. School leaders should consider inappropriate staff access to student records, unnecessary internal sharing of sensitive information, disclosure of counselling information, circulation of behavioural reports beyond those with a legitimate need to know, and inconsistent practices across campuses or departments.

Some of these issues may previously have been managed as governance or employment matters. They may also carry legal and reputational consequences.

Many schools use monitoring technologies for educational, safety or operational purposes. These may include CCTV, student device monitoring, internet filtering and monitoring platforms, classroom recording technologies, AI-based monitoring systems, attendance tracking systems, and transport or location-based applications.

The statutory tort raises questions about proportionality, transparency and community expectations. School leaders should consider whether each monitoring practice is clearly communicated, genuinely necessary, proportionate to the identified risk and consistent with the privacy expectations of students, parents and staff.

The closer monitoring moves towards personal communications, behavioural profiling or location tracking, the greater the potential scrutiny.

Boards are increasingly familiar with cyber security risks, including operational disruption, regulatory reporting obligations, remediation costs and reputational damage. The statutory tort adds another dimension.

Where a cyber incident affects large numbers of students, families or staff, a school may face the prospect of direct legal claims in addition to regulatory scrutiny. This is relevant given the quantities of personal and sensitive information maintained by schools and the increasing sophistication of cyber threats targeting educational institutions.

Cyber security should therefore be considered through both a technical and legal risk lens.

The next stage of privacy reform arrives on 10 December 2026, when new transparency obligations relating to automated decision making are expected to commence. Organisations that use algorithms, AI or automated systems to make decisions that significantly affect an individual’s rights or interests will be required to disclose that use in their privacy policies.

For schools, this may be more relevant than it first appears. Educational institutions are increasingly using technology to support decisions about enrolments, scholarships, learning support allocation, student interventions, behavioural risk identification, workforce recruitment and resource prioritisation.

Many schools may not yet have a complete understanding of where automated decision making exists within their technology ecosystems. Boards and executive teams should consider auditing existing systems to identify where AI, algorithms or automated processes influence decisions about students, parents or staff.

A significant challenge is the complexity of the modern educational technology environment. A typical independent school may use a student information system, learning management system, wellbeing platforms, assessment tools, parent communication systems, cloud storage services and emerging AI-based educational tools.

Student and family information can flow between numerous providers, creating a complex web of data collection, storage and sharing arrangements. Even where a privacy incident originates with a third-party provider, a school may still face legal, reputational and community consequences.

Vendor governance, contractual protections, due diligence and ongoing security reviews are important components of privacy risk management.

Privacy risk requires appropriate board and executive oversight. Schools can consider the following practical steps:

• Map where student, parent and staff information is collected and stored.
• Review retention and destruction practices to minimise unnecessary data holdings.
• Strengthen access controls for sensitive wellbeing, medical and behavioural information.
• Review surveillance, monitoring and workplace privacy practices.
• Assess the privacy and cyber security posture of key technology vendors.
• Identify where AI and automated decision-making tools are being used.
• Ensure privacy risk receives appropriate board and executive oversight.

This work can be supported by privacy risk registers, regular board reporting on privacy incidents, privacy impact assessments for new technologies, data retention and destruction programmes, cyber security oversight and third-party technology governance.

The schools best positioned to manage future risks are likely to be those that understand what information they hold, why they hold it, who can access it and how long it should be retained.

The statutory tort and broader privacy reforms point to changing expectations. For independent schools, the task is to maintain the trust placed in them by students, parents and staff through appropriate governance frameworks, culture and systems.

This article provides general information only and is not legal advice. Privacy obligations and risk will depend on a school’s particular operations, systems and circumstances.