How independent schools should govern technology approvals
Before a school deploys an app, someone should be able to explain what information it will handle, why it needs it, what has been checked and who has accepted the remaining risk. That decision should still be understandable when the people who made it have moved on.
That is where I would start preparing for Australia’s proposed privacy reforms. A school needs a dependable way to turn evidence about a service into a decision about its use, then carry that decision through to the classroom.
The 2026 exposure draft consultation closes on 18 September. The package remains a proposal, but the OAIC’s existing security guidance already addresses management oversight, information registers and supplier assessment. Schools can begin this work now. The separate privacy reform explainer covers what has happened, December’s milestones and what remains unsettled.
The process I would build is:
ST4S and supplier evidence → assessment of the school’s intended use → delegated approval and recorded conditions → consent where required before use → periodic review.
An approved-service register should connect those steps. Its value is the decision it records and helps staff implement.
Start with the assessment work education already has
Safer Technologies 4 Schools (ST4S) provides a substantial foundation. Education Services Australia administers it for participating government, Catholic and independent education sectors in Australia and New Zealand. Assessments cover privacy, security, interoperability and online safety. Suppliers submit responses and supporting evidence where required; the ST4S team analyses and validates them. Results reach schools through approved stakeholders. ST4S assessment process.
I would use the relevant findings to inform a school’s assessment, checking the product, edition and assessment date. The local decision still needs to account for the students involved, enabled features, information supplied and proposed use. The same platform may present different risks in different configurations.
Queensland’s Department of Education shows how review evidence can support everyday administration. On page 7 of its online-services consent guideline, Process: Obtaining consent, step 1 asks staff to gather each relevant service’s name, URL, hosting location, purpose, terms, privacy policy, information disclosed and additional consent requirements. It directs staff to an Online Service Risk Review, where available; those reviews are restricted to DoE employees. Consent guideline, page 7.
Principals oversee the approved-service register, and incoming principals should review it and accept responsibility for continued use. Guideline, page 5.
Independent schools can adapt that approach to their own structure and legal obligations. There is an established education-sector pattern to learn from: assess the service, make a decision, communicate its conditions and retain responsibility as staff change. The department’s specific consent rules belong to its own legal and policy framework.
Build a register that records the decision
The assessment needs to follow the information a product handles in its intended use. Photo by Vitaly Gariev on Unsplash.
For a SaaS platform, third-party iOS app or software package, I would maintain a privacy and technology risk register with the fields below. These are suggested governance practices, not a template prescribed by the proposed legislation.
| Record | What it should tell the school |
|---|---|
| Service and purpose | Supplier, product, edition, URL, school owner, student cohort and intended use. Include free apps and trials. |
| Information and location | Data collected or inferred; hosting, backup and support countries; subcontractors; advertising or AI-training uses. |
| Evidence | Dated privacy policy and relevant clauses, contract, processing terms, ST4S findings and outstanding questions. Separate supplier claims from verified evidence. |
| Controls | Access settings, data minimisation, incident reporting, retention and deletion arrangements. Reference restricted consent records where needed. |
| Assessment and approval | Likelihood and impact of harm, remaining risk, rationale, permitted use, conditions, decision status, approver and date. |
| Review and exit | Review date, changes that trigger reassessment, contract end date and responsibility for closing accounts or removing data. |
Keep decision status separate from the risk rating. A service can have a completed assessment and still be awaiting approval, deferred while questions are resolved, or declined. Staff need to know whether they may use it and under what conditions.
Australian hosting alone cannot establish trustworthiness. Consider overseas support access, backups, subcontractors, contractual permissions and actual product behaviour. The OAIC’s APP 8 guidance explains the obligations and exceptions around overseas disclosure. A location label cannot answer all of those questions.
Make approval responsibilities explicit
A technical review may establish that an application works on managed devices and supports appropriate access controls. Educational suitability, privacy obligations, contractual commitments and acceptance of remaining risk each need an accountable decision as well.
I would allocate the work this way, adapting the roles to the school’s size:
- IT coordinates evidence and assesses configuration, security, integrations and operational support.
- Educational, privacy and business leads assess the proposed use, student impact, consent requirements and contract. Seek legal advice where interpretation is needed.
- The principal or delegated executive approves use within agreed authority, recording conditions and the remaining risk.
- The board or its relevant committee oversees material risks and exceptions, according to the school’s governance arrangements.
One person may hold several responsibilities in a smaller school. The record should still show which decisions they made and under what delegation. No approval can authorise unlawful handling.
Work through the actual classroom use
Consider a fictional reading app that requests a full date of birth, student voice recordings and persistent location access. The first assessment question is the educational need for each. Can the lesson work with an age band, shorter audio retention or location disabled?
Suppose the supplier’s policy leaves AI training and audio deletion unclear. Record those gaps and defer approval for identified student recordings until they are resolved. If the school subsequently approves use, specify the cohort, configuration, information permitted, consent requirements and review date. A product name with a green rating would lose that context.
Where consent is required, the process must reach the staff using the service. They need a workable way to check current consent before accounts are created or information is uploaded, and to act on withdrawals or changes. An alternative activity should be planned where participation depends on optional consent.
I would keep individual consent records access-controlled and link them to the approved use. The general service register should give staff the instructions they need without exposing unnecessary student information.
Keep the decision useful after rollout
A service approval also needs an owner for incidents, changes and eventual retirement.
A new AI feature, changed privacy terms, acquisition or incident should trigger a review when it changes the assessed use or risk. Set a periodic review date as well, with shorter intervals for services handling more consequential information.
I would test the process with a supplier breach reported on a Friday afternoon during school holidays. Can the register identify the service owner, affected information and supplier contact? Who can activate the response, obtain advice and authorise communications? Give those roles deputies so the response can operate when the principal or usual technical contact is unavailable.
Retirement needs similar attention. Abandoned trials, historic class exports, old accounts and duplicate files can outlive the activity that created them. Apply the school’s approved retention requirements, including applicable education and child-safety obligations, and verify what happens to information in the provider’s systems when use ends. The OAIC’s Guide to securing personal information provides an existing foundation for this work.
Future tools could compare supplier policies, flag changes and draft risk ratings. I would want every generated assessment to expose its evidence, assumptions and unknowns. A tool can help keep the register current; a named reviewer still needs to assess the result and a delegated decision-maker approve the use.
Quick sheet for the next leadership meeting
| Focus | A concrete next step |
|---|---|
| Find the services | Reconcile purchasing, device-management and sign-in records with staff declarations of free apps and trials. |
| Establish ownership | Nominate the privacy lead, service owners, approvers and escalation path. |
| Start with consequential data | Prioritise health, wellbeing, safeguarding, biometric and location information. |
| Test the workflow | Take one existing service through evidence, assessment, approval, consent checks and review scheduling. |
| Make decisions usable | Publish approved uses and conditions for staff; keep detailed assessments and student records appropriately restricted. |
| Report what needs attention | Bring unresolved questions, overdue reviews and material exceptions to leadership. Track the reform milestones alongside them. |
Ask for a reviewable decision on one service at the next meeting, with an owner and a date for extending the process. That makes progress visible and exposes where responsibilities or evidence are missing.
Related work: the governance, risk and compliance services at Suburban Secure, which I founded, cover risk registers, policies and reporting to leadership.
References
Education and assessment resources
Education Services Australia. (n.d.). Safer Technologies 4 Schools: General information [Assessment scope and process]. Accessed 12 September 2026.
Queensland Department of Education. (n.d.). Guideline for obtaining and managing online services consent, pp. 5–8. Accessed 12 September 2026.
Queensland Department of Education. (2025, November 28). Obtaining and managing student and individual consent procedure [Version 6.15; effective date].
Privacy guidance and reform context
Office of the Australian Information Commissioner. (n.d.). Guide to securing personal information; and Chapter 8: APP 8, Cross-border disclosure of personal information. Accessed 12 September 2026.
Attorney-General’s Department. (2026, August 31). Privacy reform: Consultation on exposure draft legislation [Consultation portal; closes 18 September 2026].