Privacy and Confidentiality Policy

Policy Number: POL704

Introduction

Privacy is acknowledged as a fundamental human right. Wildberries Early Learning has an ethical and legal responsibility to protect the privacy and confidentiality of children, individuals and families as outlined in the Early Childhood Code of Ethics, National Education and Care Regulations and the Privacy Act. The right to privacy of all children, their families, and educators and staff of Wildberries Early Learning will be upheld and respected, whilst ensuring that all children have access to high quality early years care and education. All Educators, teachers, staff, students, and volunteers will maintain the confidentiality of personal and sensitive information to foster positive trusting relationships with families.

Purpose

To ensure that the confidentiality of information and files relating to the children, families, educators, and visitors using the Service is upheld at all times. We will ensure that all records and information are held in a secure place and are only retrieved by or released to people who have a legal right to access this information.

Management Responsibilities

It is the responsibility of management and the nominated supervisor to ensure that:

• All Educators, teachers, staff, students and volunteers act in accordance with the requirements of the Australian Privacy Principles and Privacy Act by developing, reviewing, and implementing procedures and practices that identify:
  1. the name and contact details of the Service
  2. what information the Service collects and the source of information
  3. why the information is collected
  4. who will have access to the information
  5. collection, storage, use, disclosure, and disposal of personal information collected by the Service
  6. any law that requires the particular information to be collected
  7. adequate and appropriate storage for personal information collected by the Service
  8. protection of personal information from unauthorised access.
• They provide educators with relevant information regarding changes to Australian privacy law and Service policy
• Personal information is protected in accordance with obligations under the Privacy Act and Privacy Amendments (Enhancing Privacy Protection) Act
• All records and documents are maintained and stored in accordance with Education and Care Service National Regulations 183 and 184
• Regularly back-up personal and sensitive data from computers to protect personal information collected
• Computers are password protected and install security software- antivirus protection
• Families are notified of the time particular records are required to be retained as per Education and Care Services National Regulations
• Appropriate and permitted use of images of children
• Educators, Teachers, staff students, volunteers, and families are provided with a copy of this policy
• They deal with privacy complaints promptly and in a consistent manner, following the Service’s POL705 – Grievance Policy
• Families only have access to the files and records of their own children

• Information given to Educators will be treated with respect and in a professional and confidential manner

• Individual child, educator, teacher, staff, students and volunteers files are stored in a locked and secure cabinet
• Information relating to educator /educator employment will remain confidential and available only to the people directly involved with making personnel decisions

• Information shared with educators, teachers and staff by the family will be treated as confidential unless told otherwise

• They and all educators, teachers, staff, students and volunteers adhere to Service’s policies and procedures at all times
• The Service obtains written consent from parents and/or guardians of children who will be photographed or videoed by the Wildberries Early Learning
• Educators, teachers, staff, students and volunteers do not discuss individual children with people other than the child’s family, except for curriculum planning or group management. Communication in other settings must be approved by the family beforehand
• Information shared with Wildberries Early Learning by the family will be treated as confidential unless told otherwise
• Obtain written consent from parents and/or guardians of children who will be photographed or videoed by the service

Legislation

This policy relates to the legislation below but is not limited to:

Education and Care Services National Regulations

Regulation	Description
Regulation 168	Education and care service must have policies and procedure
Regulation 181	Confidentiality of records kept by approved provider
Regulation 183	Storage of records and other documents
Regulation 184	Storage of records after service approval transferred

National Quality Standard

Element	Description
7.1.1	A statement of philosophy guides all aspects of the service’s operations.
7.1.2	Systems are in place to manage risk and enable the effective management and operation of a quality service.
7.1.3	Roles and responsibilities are clearly defined and understood and support effective decision-making and operation of the service.

Policy

Educators will:

• Read and adhere to this policy at all times
• Read and sign the Services DOC024 – Confidentiality Statement
• Ensure documented information and photographs of children are kept secure but may be accessed at any time by the child’s parents or guardian
• Ensure families only have access to the files and records of their own children
• Treat private and confidential information with respect in a professional manner at all times
• Not discuss individual children with people other than the family of that child, except for the purposes of curriculum planning or group management. Communication in other settings must be approved by the family beforehand.

• Not share information about the individual or service, management information, or other educators as per legislative authority.

Australian Privacy Principles

Under National Law, Section 263, Early Childhood Services are required to comply with Australian privacy law which includes the Privacy Act 1988 (the Act) aimed at protecting the privacy of individuals. Schedule 1 of the Privacy Act (1988) includes 13 Australian Privacy Principles (APPs), which all services are required to apply. The APPs set out the standards, rights and legal obligations concerning collecting, handling, holding and accessing personal information.

The Notifiable Data Breaches (NDB) scheme requires Early Childhood Services, Family Day Care Services, and Out of School Hours Care Services to provide notice to the Office of the Australian Information Commissioner (formerly known as the Privacy Commissioner) and affected individuals of any data breaches that are ‘likely’ to result in ‘serious harm’.

Businesses that suspect an eligible data breach may have occurred, must undertake a reasonable and expeditious assessment to determine if the data breach is likely to result in serious harm to any individual affected. A breach of an Australian Privacy Principle is viewed as an ‘interference with the privacy of an individual’ and can lead to regulatory action and penalties.

Australian Privacy Principles- Personal Information

Wildberries Early Learning is committed to protecting personal information in accordance with our obligations under the Privacy Act 1988 and Privacy Amendments (Enhancing Privacy Protection) Act 2012.

Personal information includes a broad range of information, or an opinion, that could identify an individual. Sensitive information is personal information that includes information or an opinion about a range of personal information that has a higher level of privacy protection than other personal information.

(Source: OAIC-Australian Privacy Laws, Privacy Act 1988)

Wildberries Early Learning will collect personal information which will be held securely and confidentially about you and your child to assist our Service in providing quality education and care to your child whilst promoting and maintaining a child-safe environment for all stakeholders.

Information the Wildberries Early Learning will request regarding enrolled children:

• Child’s name
• Gender
• Date of birth
• Address
• Birth Certificate
• Religion
• Language spoken at home
• Emergency contact details and persons authorised to collect individual children
• Children’s health requirements
• Immunisation records- (Immunisation History Statement)
• Developmental records and summaries
• External agency information
• Custodial arrangements or parenting orders
• Incident reports
• Medication reports
• Child Care Subsidy information
• Medical records
• Permission forms – including permission to take and publish photographs, video, and work samples
• Doctor’s contact information
• Centrelink Customer Reference Number (CRN)
• Dietary requirements
• Parent/s full name
• Address
• Phone number (mobile & work)
• Email address
• Bank account or credit card details for payments
• Centrelink Customer Reference Number (CRN)
• Custody arrangements or parental agreement

Personal information Wildberries Early Learning will be requested regarding educators and volunteers:

• Personal details
• Tax information
• Banking details
• Working contract
• Emergency contact details
• Medical details
• Working With Children Check verification
• Educational Qualifications
• Medical history
• Resume
• Superannuation details
• Child Protection qualifications
• First Aid, Asthma and Anaphylaxis certificates
• Professional Development certificates
• PRODA related documents such as RA number and related background check

Protecting Personal Information

 To protect your personal and sensitive information, we maintain physical, technical and administrative safeguards such as:

• All hard copies of information are stored in children’s individual files or educators individual files in a locked cupboard
• All computers used to store personal information are password protected. Each educator /staff will be provided with a unique username and password for access to CCS software and program software
• Access to personal and sensitive information is restricted to key personnel only.
• Security software is installed on all computers and updated automatically when patches are released
• Data is regularly backed up on an external drive and/or through a cloud storage solution
• Any notifiable breach of data is reported
• Educators are aware of the importance of confidentiality and maintaining the privacy and security of all information.

Access to personal and sensitive information

Personal and sensitive information about educators, families and children will be stored securely.

The Approved Provider and Nominated Supervisor will ensure that information kept in a child’s record is not divulged or communicated through direct or indirect means to another person other than:

• The extent necessary for the education and care or medical treatment of the child to whom the information relates
• A parent of the child to whom the information relates, except in the case of information kept in an educator’s record
• The Regulatory Authority or an authorised officer
• As expressly authorised, permitted, or required to be given by or under any Act or law
• With the written consent of the person who provided the information.

Disclosing personal and sensitive information

Wildberries Early Learning and its educators, teachers and staff will only disclose personal or sensitive information to:

• A third-party provider with parent permission (for example, CCS software provider)
• Child Protection Agency- Office and Regulatory Authority as per POL215 – Child Safe Environment Policy
• As part of the purchase of our business asset with parental permission
• Authorised officers (for example, public health officers)
• The regulatory authority or an authorised officer
• As expressly authorised, permitted, or required to be given by or required to be given by or under any Act or Law
• With the written consent of the person who provided the information.

Complaints and Grievances

If a parent, employee, or volunteer has a complaint or concern about our Service, or they believe there has been a data breach of the Australian Privacy Principles, they are requested to contact the Approved Provider so reasonable steps to investigate the complaint can be made and a response provided.

Storage of Records

The Approved Provider and Nominated Supervisor must ensure the documents kept under Regulations 177, 178, 181, 182 and 183 are stored in a safe and secure place for the relevant period, the relevant period for different types of records is set out below.

• to the extent necessary for the education and care or medical treatment of the child to whom the information relates
• a parent of the child to whom the information relates, except in the case of information kept in an educator’s record
• the Regulatory Authority or an authorised officer
• as expressly authorised, permitted, or required to be given by or under any Act or law; or with the written consent of the person who provided the information.
• Records related to an incident, illness, injury, or trauma suffered by a child while being educated and cared for by the education and care service, until the child is aged 25 years
• Records related to an incident, illness, injury, or trauma suffered by a child that may have occurred following an incident while being educated and cared for by the education and care service, until the child is aged 25 years
• Records related to the death of a child while being educated and cared for by the education and care service or that may have occurred as a result of an incident while being educated and cared for, until the end of 7 years after the death
• In the case of any other record relating to a child enrolled at the education and care service, until the end of 3 years after the last date on which the child was educated and cared for by the service
• Records related to the approved provider, until the end of 3 years after the last date on which the approved provider operated the education and care service
• Records related to a nominated supervisor or educators of an education and care service, until the end of 3 years after the last date on which the nominated supervisor or educators provided education and care on behalf of the service
• In case of any other record, until the end of 3 years after the date on which the record was made.

Supporting Documents & Related Policies

Documents relating to this policy and procedure include:

• DOC017 – Induction Checklist
• DOC012 – Enrolment form
• DOC024 – Confidentiality Statement

Policies relating to this policy and procedure include:

• POL215 – Child Safe Environment Policy

Sources

• ACECQA (Australian Children’s Education & Care Quality Authority)
• Education and Care Services National Regulations
• Education and Care Services National Law
• EYLF (Early Years Learning Framework)
• Australian Privacy Principles and Privacy Act

Policy Review

Wildberries Early Learning may make changes to this policy and procedures from time to time to improve the effectiveness of its operation. This policy will be reviewed in consultation with families, educators, and management every two years unless stated within the policy sooner.

14 days’ notice must be given to families, educators and staff before implementing the new policy. If the approved provider considers that the notice period would pose a risk to the safety, health or wellbeing of any child enrolled at the service, the approved provider must ensure that parents of children enrolled at the service are notified as soon as practicable after making a change.

Document Title:	NQS 7 – Privacy and Confidentiality Policy
Last Reviewed	September 2025	Version:	1.0 Document Created
Reviewed By:	Approved Provider: Michael Steenson	Next Review due date:	September 2027