New Yorkers United for Kids

How to Check a School’s Third-Party Data Sharing

Schools collect extensive information about children, from attendance and learning results to medical details, photographs and disability adjustments. Some of this information stays within the school system, while other data may be processed by software companies, testing providers, cloud platforms, transport services or wellbeing applications.

In Australia, the answer can depend on whether the school is government, Catholic or independent, and which state or territory regulates it. A school in Sydney may follow NSW Department of Education procedures, while a school in Melbourne may operate under Victorian privacy rules. Parents can still ask clear, specific questions and request documents showing how student information is handled.

Identify What Counts As Data Sharing

Data sharing does not always mean that a school has sold a child’s information. It can include giving a software provider access to names, student numbers, attendance records, assessment results, behavioural notes, photographs, voice recordings or device identifiers. A company may process information on the school’s behalf while storing it in Australia or overseas.

Check whether the proposed use involves a learning management system, reading program, online assessment, artificial intelligence tool, school photography company, payment platform or communication app. NAPLAN-related information, disability adjustments and wellbeing records require particular care because they may reveal sensitive details about a child.

Ask The School For The Right Documents

Begin with the principal, privacy officer, business manager or department privacy contact. Ask for the name of every third party receiving student information, the categories of data disclosed, the purpose of the arrangement, the contract or data-processing agreement, and the date on which it expires.

Also request the provider’s privacy policy, security standards, data retention period and deletion procedure. Ask whether the company can use information for product development, advertising, profiling, artificial intelligence training or resale. A vague statement that a provider is “approved” is not a substitute for seeing the relevant policy or contract terms.

Check The Applicable Australian Rules

The Privacy Act 1988 and Australian Privacy Principles may apply to private schools and education providers, although exemptions and specific arrangements can complicate the position. Government schools are also governed by state or territory legislation and departmental policies. In NSW, parents may need to look at departmental privacy information and Government Information (Public Access) procedures; in Victoria, the Public Records Act and state privacy framework may be relevant.

Ask which law and policy govern the agreement, where records are stored, and whether information leaves Australia. The Office of the Australian Information Commissioner can explain privacy obligations, while state education departments, Catholic education offices and independent-school associations may publish their own guidance. A school’s enrolment pack should not be treated as the only source of information.

Use Records And Formal Requests

Keep copies of emails, consent forms, app notices and screenshots showing what parents were told. Search the school website, annual reports, procurement notices and committee minutes for provider names. A company’s Australian website may describe its service in general terms without revealing what information a particular school has supplied.

If informal enquiries produce no answer, make a written request for access to records. Government-school families may have rights under freedom-of-information or state access laws, while private-school families may need to rely on the school’s privacy policy, enrolment contract or a complaint process. Ask for redacted copies if commercial confidentiality is raised, since sensitive contract terms do not automatically justify withholding every document.

Look Beyond Consent Forms

Consent is important, but a permission checkbox may not explain enough. It should identify the data collected, the reason for collection, the recipients, overseas disclosures, retention period and choices available to families. Some services may rely on necessity, statutory authority or a department-wide agreement instead of individual consent.

Consider whether a child can participate in class without creating an account or supplying optional information. Ask how the school handles withdrawal of consent, correction of inaccurate records, access requests and data breaches. Parents in Brisbane, Perth or Adelaide may encounter different forms and department terminology, but the practical test is the same: can the school explain the arrangement in plain English?

Keep The Conversation Child-Centred

Children should understand, in age-appropriate language, why an app or assessment is being used and what happens to their information. This is especially important when refusing a service could make a student feel excluded from classmates. Families can find wider material about testing and student privacy through parent privacy resources, including perspectives from an organisation focused on education accountability and parental involvement.

A calm conversation can separate a school’s educational purpose from a technology company’s commercial interests. For younger children, explain that their school may use a digital tool but that adults are checking who can see the information. For teenagers, discuss account settings, public profiles, targeted advertising and the long-term effect of permanent records. Guidance on explaining testing decisions is available in this conversation guide.

Practical Checks For Families

The most reliable approach is to create a paper trail and compare the school’s explanation with its privacy notice and contract. If the documents do not match, identify the exact inconsistency and ask for clarification rather than relying on verbal assurances. A written request naming the provider, data categories, storage location and deletion process gives families a practical way to establish whether information is being shared and under what conditions.

✉