// schools — Western Australia
Your school completes its own Privacy Impact Assessment. This is the vendor half — written against Privacy and Responsible Information Sharing Act 2024 (WA), so it can be attached rather than requested.
Data hosted in
Australia — Azure Australia East (Sydney)
Government schools
Privacy and Responsible Information Sharing Act 2024 (WA)
Independent & Catholic
Privacy Act 1988 (Cth)
// WA — your framework
Western Australia government schools are public-sector organisations under Privacy and Responsible Information Sharing Act 2024 (WA) and its WA Information Privacy Principles, regulated by Office of the Information Commissioner Western Australia.
Independent and Catholic schools are not. They are private-sector organisations bound by Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), regulated by the Office of the Australian Information Commissioner (OAIC). The technical controls are identical either way — the framework you assess them against is not, and it is worth being sure which one your assessment is written against.
On child safety, your obligations sit under the Child Safe Standards (Western Australia). The school remains the responsible entity; our part is making sure the technical controls support your policy — access granted by the school rather than shared between families, consent recorded and bound to the exact content it approves, and an audit trail that answers who could see what, and between which dates.
Specific to WA: WA only recently legislated comprehensive public-sector privacy, and obligations are commencing in stages — worth confirming which provisions apply at the time of your assessment.
The legislative references on this page are a starting point for your assessment and have not yet been confirmed by our legal advisers. Please verify them against your own requirements — and if anything here is wrong, tell us and we will correct it for every school in WA.
Where the data is hosted, how it is encrypted, who can see a document about a named student, how deletion works, and who else processes it — none of that changes by state, so it is written once rather than restated eight times.
// other states