In accordance with the Privacy Act 1988 (Cth), a policy and procedures are required to be in place.
Yes – under the provisions of Australian privacy legislation.
Schools must comply with the Privacy Act 1988 (Cth).
Schools need to have systems and procedures in place to handle personal information in accordance with the Australian Privacy Principles as outlined in the legislation. Victorian Government legislation also regulates student and other records. The Privacy and Data Protection Act 2014 (Vic) covers the Victorian public sector, except in relation to health information. The Health Records Act 2001 (Vic) covers health information and applies to the public and private sectors in Victoria.
Guidance for observing the Australian Government privacy laws can be found in the Independent Schools’ Privacy Compliance Manual (see ‘Links, resources and downloads’, below). Schools may also wish to seek specific professional advice on how to comply with the Privacy Act.
You may be in breach of the Privacy Act 1988 (Cth).