Sample School Privacy Policy (includes CCTV)

1. Introduction

___ [School Name] ___ (“the School”, “we”, “our”) is committed to protecting the privacy and confidentiality of personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy explains how we collect, use, disclose, and manage personal information about students, parents/guardians, staff, and visitors to the School.

2. Purpose

The purpose of this policy is to:

Ensure transparency about the personal information we collect and hold.
Inform the school community about how their information is handled.
Outline how individuals can access and correct their information, or make a complaint.

3. Scope

This policy applies to all personal information collected by the School, including information collected:

Through enrolment processes.
During day-to-day school activities.
Via the School’s website, apps, and communication systems.
Through CCTV cameras installed on School grounds.

4. What Information We Collect

We may collect personal information such as:

Student information: name, date of birth, gender, address, medical details, educational records, behavioural records, and photographs.
Parent/guardian information: contact details, emergency contacts, custody or court orders, billing details.
Staff information: employment records, qualifications, payroll and tax details.
Visitor information: name, contact details, visit records.
CCTV footage of individuals on School grounds.

We only collect information that is reasonably necessary for our functions and activities.

5. How We Collect Information

We collect personal information in various ways including:

Directly from individuals (e.g., enrolment forms, interviews, emails).
Through our website and apps.
Through CCTV cameras, which record video images in designated areas.
From third parties such as previous schools, healthcare providers, or government agencies.

6. Why We Collect Personal Information

We collect personal information to:

Provide quality education and pastoral care.
Fulfil our duty of care to students and staff.
Communicate with parents/guardians and emergency contacts.
Comply with legal and regulatory obligations.
Improve our services and facilities.
Maintain a safe and secure environment.

7. How We Use and Disclose Personal Information

We use and disclose personal information only for the purposes it was collected, or where permitted or required by law.

Examples include:

Sharing relevant information with teachers and support staff.
Providing necessary information to medical or emergency services.
Reporting to government education and regulatory authorities.
Providing CCTV footage to police if required for an investigation.

We will not share your personal information with third parties for marketing purposes without your consent.

8. CCTV and Privacy

The School uses CCTV cameras in designated public areas for security and safety purposes.

Cameras operate ___ [e.g., 24/7] ___ and monitor areas such as entrances, hallways, playgrounds, and car parks.
Cameras are not installed in private areas such as toilets or change rooms.
Footage is securely stored and only accessible to authorised staff.
Footage is retained for ___ [e.g., 30, 60, 90 days] ___ unless needed for an investigation.

Clear signage is displayed at entrances notifying visitors of CCTV use.

9. Data Security

We take reasonable steps to protect personal information from misuse, loss, unauthorised access, modification, or disclosure, including:

Secure storage of paper records.
Password-protected electronic systems.
Limiting access to authorised personnel only.
Staff training on privacy obligations.

10. Access and Correction

You may request access to, or correction of, your personal information by contacting the School’s Privacy Officer (see Section 12).

We will respond within a reasonable time and may charge a small administrative fee for providing access.

11. Complaints

If you believe we have breached your privacy, please contact the Privacy Officer.
We will investigate your complaint and respond within ___ [e.g., 30 days] ___.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).