Safe Use of Digital Technologies and Online Environments Policy

• Behaviour Guidance: Bullying Policy
• CCS Data Security Policy
• CCS Personnel Policy
• CCS Governance Policy
• Child Safe Environment Policy
• Child Protection Policy
• Code of Conduct Policy
• Dealing with Complaints Policy
• ECIP Management Policy
• Educational Program Policy
• Enrolment Policy
• Family Communication Policy
• Governance and Leadership Policy
• Fraud Prevention Policy
• Incident, Injury, Trauma, and Illness Policy
• Interactions with Children Families and Staff Policy
• Physical Activity Policy
• Privacy and Confidentiality Policy
• Programming Policy
• Protected Disclosure (Whistleblower) Policy
• Record Keeping and Retention Policy
• Social Media Policy
• Staffing Arrangements Policy
• Student, Volunteer and Visitor Policy
• Supervision Policy

• Safe Use of Digital Technologies and Online Environments Procedure
• CCS Compliance Checklist and Audit
• CCTV Monitoring Letter to Families
• Cyber Safety Agreement
• Cyber Safety Authorisation
• Data Breach Response Record
• Data Security Checklist
• Digital Technologies Risk Assessment
• ECIP Confidentiality Agreement
• Electronic Device Exemption Form
• Electronic Device Register
• Electronic Service-Supplied Device Form
• Media Authorisation Child
• Media Authorisation Staff
• Privacy Audit
• Privacy and Confidentiality Procedure

National Quality Standard

• QA2.2 Safety — Ensuring children are protected from harm and hazard in digital and online environments
• QA2.2.1 Supervision — Active supervision of children during use of digital technologies and online environments
• QA4.2 Professionalism — Staff conduct relating to responsible use of digital technologies and personal device restrictions
• QA5.1 Relationships between educators and children — Supporting children's understanding of safe and responsible digital interactions
• QA5.2 Relationships with children — Responding sensitively to children's disclosures about unsafe online experiences
• QA6.1 Supportive relationships with families — Engaging families in authorisations, communication about digital safety practices, and complaints processes
• QA7.1 Governance — Compliance with National Law Part 6A, device management, record keeping, and risk assessment
• QA7.1.2 Management systems — Effective systems for managing digital devices, documentation, and policy compliance

National Law

• Part 6A — Devices in education and care services — Primary legislative authority for this policy. Effective 27 February 2026. Sets requirements for the supply, authorisation and use of devices in education and care services.
• s.165 — Offence to inadequately supervise children — Adequate supervision of children when using digital technologies and online environments
• s.167 — Offence relating to protection of children from harm and hazards — Protection of children from risks associated with digital technologies, including online harm and inappropriate content
• s.174(2)(a) — Notification of serious incidents — Notification to the regulatory authority of serious incidents involving digital technologies or online environments

National Regulations

• r.168(2)(ha) — Requires the Service to have policies and procedures addressing: (i) taking, use, storage and destruction of images and videos; (ii) obtaining authorisation from parents for images and videos; (iii) use of optical surveillance devices; (iv) use of digital devices issued by the Service; (v) use of digital devices by children
• r.102 — Educators must be working directly with children to be included in ratios — supervision requirements when children are using digital technologies
• r.170 — Policies and procedures to be followed — all staff, educators, volunteers and students must be provided with and follow this policy
• r.172 — Notification of change to policies or procedures — families must be notified within 14 days of changes to this policy
• r.181 — Confidentiality of records kept by approved provider — confidentiality requirements for digital records, images and videos
• r.183 — Storage of records and other documents — secure storage requirements for digital records and documentation

Other Applicable Legislation

• Privacy Act 1988 (Cth) — Governs the collection, use, storage and disclosure of personal information, including digital data, images and videos. Services must comply with the Australian Privacy Principles.
• Notifiable Data Breaches scheme (Part IIIC, Privacy Act 1988) — Requires notification to the OAIC and affected individuals in the event of an eligible data breach involving personal information held by the Service
• Surveillance Devices Act 2004 (Cth) — Defines optical surveillance devices; relevant to CCTV and monitoring device use at the Service
• National Principles for Child Safe Organisations — Establishes the framework for embedding child safe practices across all Service operations, including digital environments

6.1 Approved Provider, Nominated Supervisor and Management

Governance and Compliance

• Ensure obligations under the Education and Care Services National Law (including Part 6A) and National Regulations are met
• Ensure educators, staff, students, visitors and volunteers have knowledge of and adhere to this policy and associated procedure
• Provide new employees, students and volunteers with a copy of this policy and procedure as part of induction
• Ensure families are aware of this policy and procedure and advised on how and where it can be accessed
• Ensure processes are in place so families who speak languages other than English understand the requirements of this policy, including providing authorisation for images and videos
• Ensure staff, educators, families and children are informed of updates to policies, procedures or legislation relating to digital technologies and online environments
• Ensure children, educators and parents are aware of the Service's complaints handling process

Child Safety Culture

• Ensure all staff, educators, volunteers and students are aware of current child protection law, National Principles for Child Safe Organisations and their duty of care
• Promote and support a child safe environment, including mandatory reporting obligations
• Embed the National Principles for Child Safe Organisations into organisational structure and operations
• Ensure policies and procedures reflect a commitment to equity and diversity, protect children's privacy, and empower children to be independent

Personal Device Restrictions

• Inform staff, educators, visitors, volunteers and family members that personal electronic devices must not be used to take, store or transfer images or videos of children
• Ensure personal electronic devices are not in the possession of staff, educators or visitors while working directly with children, including during excursions or transport
• Inform staff, educators and visitors of exemptions or prescribed circumstances that may warrant possession of a personal electronic device
• Authorise exemptions in writing, ensuring staff with exemptions do not use the personal device to take images or videos of children
• Ensure all staff, educators, volunteers and students are aware of and adhere to the National Model Code

Service-Supplied Devices

• Ensure all electronic devices purchased and supplied for the Service are recorded via the Electronic Service-Supplied Device Form
• Develop and maintain an Electronic Device Register for all electronic devices purchased and used at the Service
• Document a record of revocation for any electronic devices no longer used at the Service
• Ensure Service-issued devices are securely configured, monitored and maintained to prevent unauthorised access
• Ensure staff and educators only use Service-supplied or issued devices for taking images or videos of children

6.2 Educators and Staff

• Adhere to this policy, associated procedure and the National Model Code at all times
• Not use personal electronic devices while working directly with children except in prescribed circumstances authorised in writing by the approved provider or nominated supervisor
• Only use Service-supplied or issued devices for taking, storing or transmitting images or videos of children
• Ensure children are supervised at all times when using digital technologies or accessing online environments
• Support children to use digital technologies safely and responsibly
• Report any concerns about the use of digital technologies or online environments to management immediately
• Maintain confidentiality of all digital records, images and videos in accordance with the Privacy and Confidentiality Policy
• Complete all required training and professional learning relating to digital safety and the safe use of digital technologies

6.3 Families

• Provide written authorisation for the Service to take, use, store and destroy images and videos of their child
• Adhere to the Service's restrictions on personal electronic devices when present at the Service
• Not take or share images or videos of other children without authorisation from those children's families
• Notify management of any concerns regarding digital technologies, online environments or the taking of images or videos

6.4 Children

• Use digital technologies and online environments responsibly and in accordance with educator guidance
• Seek support from educators if they encounter anything unexpected or uncomfortable online
• Respect the privacy and rights of other children when using digital technologies

7.1 Prevention

7.1.1 Personal Electronic Device Restrictions

• Staff, educators, visitors and volunteers must not use personal electronic devices to take, store or transmit images or videos of children at any time
• Personal electronic devices must not be in the possession of staff or educators while working directly with children, except in prescribed circumstances authorised in writing
• Prescribed circumstances include: genuine medical or health conditions requiring device access; being an on-call emergency contact; family day care educators who are sole operators without a service-supplied device; and where a service-supplied device stops working and a temporary device is required
• All exemptions must be granted in writing by the approved provider or nominated supervisor and must specify the reason, person, and duration
• Staff with exemptions must not use the personal device to take images or videos of children

7.1.2 Service-Supplied Device Management

• All service-supplied devices must be recorded in the Electronic Device Register, including identification code, device type, date of purchase, intended use, assigned user, security settings, and connectivity, storage and recording capabilities
• Service-supplied devices must be securely configured and password protected
• Service-supplied devices must be stored securely when not in use
• Only authorised staff may use service-supplied devices to take images or videos of children
• A record of revocation must be maintained for any device no longer used at the Service

7.1.3 Images, Videos and Authorisation

• Written authorisation must be obtained from a parent or guardian before taking, using, storing or sharing images or videos of a child
• Authorisation must be specific about the purpose of use (e.g. documentation, marketing, communication platforms)
• Images and videos must only be captured on service-supplied devices by authorised staff
• Images and videos must only be used for the purpose for which authorisation was granted
• Images and videos must be stored securely and only accessible to authorised staff
• Images and videos must be destroyed in accordance with the Record Keeping and Retention Policy once no longer required

7.1.4 CCTV and Optical Surveillance

• The use of CCTV or any optical surveillance device at the Service must comply with applicable state and territory surveillance legislation
• Families must be informed in writing that CCTV is in operation at the Service
• CCTV footage must be stored securely and access restricted to authorised personnel only
• CCTV footage must be retained in accordance with the applicable retention period and destroyed when no longer required
• Baby monitors must not be used as a substitute for required physical safe sleep checks
• Access to baby monitors must be restricted through password-protected systems

7.1.5 Children's Use of Digital Technologies

• Digital technologies used by children must be appropriate for the children's ages, developmental stages and individual needs
• Devices used by children must be configured with appropriate content filters and parental controls
• Children must only access age-appropriate, safe and educationally relevant online content
• Children must always be supervised when using internet-connected devices
• Smart toys must be assessed for safety before use and monitored while in use

7.1.6 Artificial Intelligence Tools

• Staff and educators must only use AI tools that have been approved by the approved provider or nominated supervisor
• AI tools must not be used to process or generate content containing personal information about children or families without explicit authorisation
• Any AI-generated content used in the Service's educational program or communications must be reviewed and approved by a qualified educator before use
• Staff must not use generative AI to create images of children or families

7.1.7 Online Environment Safety

• All online platforms, applications and software used at the Service must be assessed for safety and appropriateness before use
• Platform accounts must be password protected and access limited to authorised staff
• Staff and educators must not share personal information about children or families on any online platform without authorisation
• Social media use in connection with the Service must comply with the Social Media Policy

7.2 Detection

7.2.1 Active Supervision and Monitoring

• Children must always be supervised and never left unattended while an electronic device is connected to the internet
• Educators must implement active supervision strategies when children are accessing online environments
• Educators must be aware of high-risk behaviours for children online, including uploading private information or images, engaging with inappropriate content, making in-app purchases, and interacting with unsafe individuals
• Children must be reminded that if they encounter anything unexpected that makes them feel uncomfortable, scared or upset, they can seek support from staff

7.2.2 Auditing and Review

• The Service will perform regular audits to identify risks to children's safety, including changes in room set-ups that can create supervision blind spots when technology is in use
• The Electronic Device Register and exemption records must be reviewed regularly
• Storage of digital data, including images and videos, must be reviewed regularly to ensure compliance with authorisation and retention requirements
• Risk assessments for digital technology and online environments must be reviewed annually or following any identified safety concern

7.3 Response

7.3.1 Responding to Children's Disclosures

• Encourage children to seek support if they encounter anything unexpected that makes them feel uncomfortable, scared or upset
• Listen sensitively and respond appropriately to any disclosures children may make relating to unsafe online interactions or exposure to inappropriate content
• Report any breaches and incidents of inappropriate use of digital devices and online services to management

7.3.2 Identification and Reporting of Online Abuse and Safety Concerns

• Ensure all staff, educators, students and volunteers are aware of their mandatory reporting obligations and promptly report any concerns related to child safety, including inappropriate use of digital technology
• Report any suspected cases of online abuse to the relevant authorities, including the eSafety Commissioner and Police, in accordance with legal requirements and child protection procedures
• Ensure all concerns are documented and responded to promptly, with support provided to the child and their family as required
• Consult external agencies or specialists where concerns are identified relating to online abuse, cyberbullying or digital safety risks

7.3.3 Mandatory Reporting and Regulatory Notification

• Staff and educators must report child safety concerns, including those arising from digital technologies or online environments, to child protection authorities as soon as practicable
• The regulatory authority must be notified within 24 hours via NQA ITS if a child is involved in a serious incident, including any unsafe online interactions, exposure to inappropriate content or suspected online abuse
• All educators, staff, students and families must be advised of the Protected Disclosure (Whistleblower) Policy, whistleblower protections and processes

7.3.4 Data Breach Response

The approved provider will notify the Office of the Australian Information Commissioner (OAIC) in the event of a notifiable data breach. This may include:

• A device containing personal information about children and/or families is lost or stolen
• A database with personal information about children and/or families is hacked
• Personal information about a child is mistakenly given to the wrong person
• A device is left behind while on an excursion

7.3.5 Breach of Policy Response

Staff members or educators who fail to adhere to this policy may be in breach of their terms of employment and may face disciplinary action, which may lead to notification to the regulatory authority and child protection authorities. Visitors or volunteers who fail to comply may face termination of their engagement. Family members who do not comply may place their child's enrolment at risk and limit the family member's access to the Service.

7.4 Recovery and Review

7.4.1 Post-Incident Review

Following any incident involving digital technologies or online environments, the Service will:

• Conduct a review of practices, including an assessment of areas for improvement
• Review and update risk assessments as required
• Review and update policies and procedures where necessary

7.4.2 Communication of Changes

• Staff, educators, families and children must be informed of any updates to policies, procedures or legislation relating to digital technologies and online environments
• Families must be notified of policy changes within 14 days in accordance with r.172

7.4.3 Ongoing Improvement

• The approved provider will remain informed of privacy legislation through monitoring of updates from relevant government authorities such as the OAIC
• The Service will regularly review guidance on the use of digital technologies, including information provided by ACECQA, state and territory regulatory authorities, and the eSafety Commissioner

8.1 Device Management Records

• Electronic Device Register — Register of all electronic devices purchased for and used within the Service, including identification code, device type, date of purchase, intended use, assigned user, security settings, and connectivity/storage/recording capabilities. Retain for 3 years from the date the record was made.
• Electronic Service-Supplied Device Form — Record of each service-supplied device including acquisition details, assigned user and configuration. Retain for 3 years from the date the record was made.
• Electronic Device Exemption Form — Written authorisation for each personal device exemption granted, including reason, person, duration and approval. Retain for 3 years from the date the record was made.
• Record of Revocation — Documentation of any device decommissioned or removed from service use, including date and reason for revocation. Retain for 3 years from the date the record was made.

8.2 Images, Videos and Authorisation Records

• Media Authorisation — Child — Written consent from parent or guardian for the taking, use, storage and destruction of images and videos of each child. Retain for the duration of enrolment plus 3 years.
• Media Authorisation — Staff — Written consent for staff images used in Service communications and marketing. Retain for duration of employment plus 3 years.
• CCTV Monitoring Letter to Families — Written notification to families that CCTV is in operation at the Service. Retain for 3 years from the date issued.

8.3 Incident and Breach Records

• Data Breach Response Record — Documentation of any data breach event including nature of breach, affected parties, actions taken and notifications made to OAIC. Retain for 7 years.
• Incident Records — Records of any digital safety incident involving children, including unsafe online interactions, exposure to inappropriate content or suspected online abuse. Retain in accordance with the Record Keeping and Retention Policy.

8.4 Policy Compliance Records

• Staff Acknowledgement Records — Signed acknowledgement from each staff member, educator, student and volunteer confirming they have read and understood this policy and associated procedures. Retain for duration of engagement plus 3 years.
• Professional Learning Records — Records of training and professional development provided to educators and staff on the safe use of digital technologies. Retain for 3 years.

8.5 Data Security and Privacy Records

• Privacy Audit — Documented audit of the Service's privacy practices including collection, use, storage and destruction of personal information. Conduct annually; retain for 3 years.
• Data Security Checklist — Regular review of data security measures including device security, password management, cloud storage and access controls. Conduct at minimum annually; retain for 3 years.
• Back-up Records — Confirmation that monthly back-ups of all digital data have been performed. Retain for 1 year.

This section is for individual services to complete. The fields below must be customised to reflect the specific arrangements at your Service. This section does not alter the national base policy or state-specific requirements — it records how your Service implements them.

CCTV / Optical Surveillance

• Does the Service use CCTV? ______ (Yes / No)
• Does the Service use baby monitors? ______ (Yes / No)
• Number of cameras: ______
• Camera locations: ______
• Camera type (fixed/mobile): ______
• Monitor location: ______
• Recording system type: ______
• CCTV footage retention period: ______ (days/weeks)
• CCTV footage storage location at the Service: ______
• Signage location advising of CCTV surveillance: ______

Digital Devices

• Educational program software used: ______
• Parent communication app/platform used: ______
• Accounting/payroll software used: ______
• HR/compliance platform used: ______
• CCS Software access controls: ______

AI Tools

• Does the Service permit staff use of AI tools? ______ (Yes / No)
• If yes, approved AI tools: ______
• Service-specific AI use protocols: ______

External Photography

• Does the Service engage external photographers? ______ (Yes / No)
• If yes, specify arrangements: ______
• Marketing photography protocols: ______

Device Storage

• Location of locked storage for service-supplied devices at end of day: ______
• Location of locked storage for children's personal devices: ______

Service-Specific Protocols

• Any additional service-specific digital technology protocols: ______

All fields in this section must be completed by the approved provider or nominated supervisor. Review these details whenever there is a change to the Service's digital technology arrangements.

Induction Requirements

All new employees, students and volunteers must be provided with a copy of the Safe Use of Digital Technologies and Online Environments Policy and Procedure as part of their induction. They must be advised on how and where the policy can be accessed on an ongoing basis.

Acknowledgement Requirements

All staff, educators, students and volunteers must acknowledge in writing that they:

• Have read and understood this policy and associated procedures
• Understand the restrictions on the use of personal electronic devices while working directly with children
• Understand the requirements for taking, using, storing and destroying images and videos of children
• Understand their mandatory reporting obligations in relation to child safety concerns, including those arising from digital technologies or online environments
• Understand the consequences of breaching this policy, including potential disciplinary action and notification to the regulatory authority and child protection authorities
• Will adhere to the National Model Code for taking images or videos of children

Ongoing Awareness

Staff, educators, families and children must be informed of updates to this policy, associated procedures, or relevant legislation relating to digital technologies and online environments. Professional learning must be provided to educators and staff on an ongoing basis relating to the safe use of digital technologies and online environments.

Consequences of Non-Compliance

Staff members or educators who fail to adhere to this policy may face disciplinary action, which may lead to notification to the regulatory authority and child protection authorities. Visitors or volunteers who fail to comply may face termination of their engagement. Family members who do not comply may place their child's enrolment at risk and limit the family member's access to the Service.