Schools’ privacy policy: information for parents

The Schools’ Privacy Policy informs the school community that information about students can be shared to fulfil the schools’ core functions of educating and supporting our students.

The Schools' Privacy Policy establishes a clarified ‘need to know’ framework, where school staff share information about students with other staff who need to know as part of their role. This is consistent with Victorian privacy law.

Who this policy applies to

The policy applies to all central, region and school staff including principals, teachers, visiting teachers, social workers, wellbeing staff, youth workers, nurses, Student Support Service officers (SSSOs) and all other allied health practitioners. This means the ‘need to know’ framework below also applies to all school staff, whether employees, service providers (contractors) and agents (whether paid or unpaid) of the Department.

Need to know

All school staff can, and must, share information about a student with other staff who ‘need to know’ that information to enable the school to:

  1. educate the student (including to plan for individual needs or address barriers to learning)
  2. support the student’s social and emotional wellbeing and health
  3. fulfil legal obligations, including to:
    • take reasonable steps to reduce the risk of reasonably foreseeable harm to the student, other students, staff or visitors (duty of care)
    • make reasonable adjustments for a student’s disability (anti-discrimination law)
    • provide a safe and secure workplace (occupational health and safety law).

Please note: the Child and Family Violence Information Sharing Schemes allow prescribed organisations to share confidential information with each other to promote the wellbeing or safety of children, or to assess or manage family violence risk. Victorian schools and a range of other Victorian services fall under these schemes. For more information, refer to: Information sharing and MARAM reforms webpage.

Deciding who ‘needs to know’

Subject to the principal’s direction, each staff member decides who needs to know specific, relevant information about a student, based on the ‘need to know’ framework.

Sharing relevant information with other staff who ‘need to know’ is very different from idle conversation or gossip.

School staff are entrusted with a large amount of important information about students. Staff must treat all such personal and health information sensitively and respectfully, and not share it other than on this ‘need to know’ basis.

What information and records can be transferred to a student’s next school?

When a student has been accepted at, and is transferring to or from, another school (Victorian government, non-government and/or interstate), the current school transfers information about the student to the new school. This information may include copies of the student’s school records, including any health, wellbeing or safety related information.

Parental consent is not required to transfer this information between Victorian government schools but must be obtained when the student is transferring to or from Victorian non-government schools, including Catholic schools or interstate schools.

Principals (or authorised representatives) determine what information to provide to the next school based on the ‘need to know’ framework:

What information does the next school ‘need to know’ to properly educate or support the student, and fulfil the school’s legal obligations?

‘NEED TO KNOW’ framework

Duty of care

A school’s duty of care to students means that a principal or other member of the leadership team needs to know about any reasonably foreseeable risk of harm to anyone because of the student’s behaviour, disability, family circumstances or any other relevant circumstances related to the student.

So, for example, if there is a reasonably foreseeable risk to anyone because the student:

  • displays violent behaviours
  • is a victim or perpetrator of bullying, assault or age-inappropriate sexualised behaviours
  • has emotional, wellbeing or self-harm issues

then staff must tell the principal (or other member of the school leadership team).

The principal will then share relevant information with any other staff member that needs to know because they work with, or supervise, the student. Staff must provide the principal with enough relevant information required to adequately fulfil their own duty of care – so that the principal can fulfil their duty of care too.

Importantly, when there is a reasonably foreseeable risk of harm, staff should act on that information and share the information with other staff who ‘need to know’, even if the student or parent asks that information not be shared.

Anti-discrimination law

A school’s obligation to provide reasonable adjustments for students with disabilities (regardless of whether they are eligible under the Program for Students with Disabilities) means that relevant information about a student’s disability and their needs must be shared with all staff who work with or supervise that student.

This is required to enable the school to make properly informed decisions about what adjustments are reasonable, and then to implement those adjustments.

This may also be required to meet the duty of care to that student (for example, a student with a medical condition who may require treatment).

This means that relevant information must be shared with staff who work with or supervise that student, to enable them to:

  • understand the student’s disability and how it affects their learning and social or emotional wellbeing
  • implement reasonable adjustments at school, including understanding all recommendations made by the student’s treating practitioners.

The relevant school policies are followed by school staff when engaging with parents, such as wellbeing and behaviour polices. Go to your school’s website for relevant polices.

School staff are available to provide further information about school policies and handling of personal information or contact the DET Privacy Officer at


Schools' Privacy Policy for parents—translations