CCTV, Consent and Compliance: Understanding the 1 September Changes to the NQF

From 1 September 2025, several nationally agreed child safety reforms will take effect under the Education and Care Services National Law and National Regulations, imposing new legal obligations on approved providers and early learning services across Australia.

These changes, introduced via the Education and Care Services National Amendment Regulations 2025, form part of a broader strategy endorsed by Education Ministers to strengthen child protection under the National Quality Framework (NQF).

This article outlines the key changes, with a particular focus on how providers must now manage CCTV and digital technologies lawfully, transparently, and in accordance with updated privacy and safety standards.

While distinct from the Commonwealth’s Early Childhood Education and Care (Strengthening Regulation of Early Education) Bill 2025 (see our related article for more information: From Crisis to Reform: A New Era of Accountability in Early Learning), the reforms intersect with growing expectations around the use of surveillance technologies in childcare settings.

 

Key Changes

Mandatory 24-Hour Reporting

Allegations or incidents of physical or sexual abuse must be reported to the regulatory authority within 24 hours. This is a reduction from the previous 7-day timeframe (Regulation 176).

Ban on Vaping Devices and Substances (Regulation 82)

• Service environments must be free from vaping products, aligning with existing bans on tobacco, alcohol, and illicit drugs.

Digital Technology and Surveillance Policies (Regulation 168)

Services must have documented policies and procedures addressing the safe use of digital technologies and online environments, including:

• The taking, use, storage, and destruction of images and videos of children.
• Parental authorisation for capturing and storing visual content.
• The use of optical surveillance devices (e.g. CCTV).
• The use of service-issued digital devices by staff.
• The use of digital devices by children.

These provisions are designed to ensure that surveillance and technology use is lawful, proportionate, and respectful of children’s privacy and dignity. Importantly, these provisions also interact with the existing privacy and surveillance legislative framework, giving rise to vital considerations for early learning providers, centre owners and operators, nominated supervisors and educational leaders.

 

Current Framework

1. Federal Privacy Law

Under the Privacy Act 1988 (Privacy Act) and the Australian Privacy Principles (APPs), CCTV footage is considered personal information when it captures identifiable individuals, especially children and staff.

If your service is part of a group or organisation with an annual turnover exceeding $3 million, you are legally bound by these rules. Even if not strictly required, following these principles is considered best practice.

Key obligations include:

• Notification: Families and staff must be informed of the presence, purpose, and scope of CCTV surveillance.
• Consent: Obtain written parental or guardian consent, ideally during enrolment.
• Storage: Footage must be stored securely using encrypted systems, with access restricted to authorised personnel (e.g. Centre Director).
• Retention: Footage must be securely deleted after a reasonable period, typically 14 to 30 days, unless required for legal or investigative purposes.

Services must also comply with the Notifiable Data Breaches (NDB) scheme, which requires notification to the Office of the Australian Information Commissioner (OAIC) and affected individuals if a data breach is likely to result in serious harm.

However, specific retention requirements also apply to early learning services, regulation 183 of the NQF, requires that records are generally retained for three (3) years from a child’s last day at the service. However, if an incident or trauma is involved, records must be kept until the child turns 25. These NQF reforms contain further information about surveillance governance including consent, access rights, destruction protocols and staff device bans.

 

 2. State and Territory Laws

Most early learning centres have adopted CCTV in common areas, including:

• Reception and entry points.
• Communal indoor spaces.
• Outdoor play areas.

At the state level, surveillance laws of vary significantly and impose additional restrictions in each jurisdiction, particularly in relation to the use of surveillance devices in a ‘private area’ or during ‘private activities’.  Surveillance in private areas is expressly prohibited, or otherwise permitted only with strict consent, however the complexity lies in the:

1. ability for a person to provide consent: and
2. the definition of ‘private area’ differing slightly across each state and territory.

In all Australian jurisdictions, children cannot legally provide informed consent to being recorded. As such, the responsibility for consent lies with their parents or legal guardians. However, parental consent alone does not override state surveillance laws, particularly where surveillance occurs in areas deemed “private areas” under the relevant state legislation.

New South Wales (NSW)

Under the Surveillance Devices Act 2007 (NSW), it is an offence to use an optical surveillance device to record a private activity without the consent of the parties involved.  A private activity defined as an activity carried out in circumstances indicating that at least one party desires it to be observed only by themselves. In a childcare context, this includes sleep rooms, nappy change areas, and bathrooms.

Parental or guardian consent does not extend to consent regarding surveillance during private activities. As such, even where a parent/guardian consents to CCTV in an area where private activities occur e.g. sleep rooms, the service may still be in breach of the Act if the child is engaged in a private activity and cannot consent themselves. Therefore, surveillance in such areas is effectively prohibited, regardless of parental/guardian approval.

Victoria (VIC)

The Surveillance Devices Act 1999 (VIC) similarly prohibits the use of optical surveillance devices to record private activities without the consent of all parties involved. This Act defines a private activity as one conducted in circumstances where the participants reasonably expect privacy.

As in NSW, parental/guardian consent is not sufficient to authorise surveillance in areas where children are likely to be engaged in private activities. Surveillance in bathrooms, change areas, or sleep rooms is therefore not permitted, even with parental/guardian consent.

Northern Territory (NT)

The Surveillance Devices Act 2007 (NT) prohibits the use of surveillance devices to record private activities without the consent of the parties involved. This Act defines private activity in similar terms to the NSW and Victorian jurisdictions.

Parental consent is required under the Privacy Act, however it does not authorise surveillance in areas where children have a reasonable expectation of privacy. Surveillance in such areas remains unlawful, irrespective of parental/guardian consent.

 

Closing Comments

In the face of the imminent changes to the NQF, providers, centre owners and operators, nominated supervisors and educational leaders, have a duty to take proactive steps to ensure that they meet and maintain their compliance with their applicable legal obligations, including:

• Conducting a risk management and compliance assessment;
• Reviewing your existing policies and procedures e.g. privacy policy, record keeping and management, incident reporting, to identify deficiencies;
• Reviewing your enrolment documentation; and
• Informative and specialised staff training on privacy obligations and data handling procedures.

Undertaking these measures in a commercially viable manner can be complex and onerous task and requires professional expertise. Now is the perfect time to invest in quality and tailored advice you can trust. Our team of experts at Chamberlains Law Firm, can save you the headache and ensure your business is protected from liability.

This article was prepared with the assistance of Isabella Turner and Emma Saunders.