CCTV, Consent and Compliance: Understanding the 1 September Changes to the NQF

What childcare surveillance reforms begin on 1 September 2025?

From 1 September 2025, several nationally agreed child safety reforms will take effect under the Education and Care Services National Law and National Regulations, imposing new legal obligations on approved providers and early learning services across Australia.

These changes, introduced via the Education and Care Services National Amendment Regulations 2025, form part of a broader strategy endorsed by Education Ministers to strengthen child protection under the National Quality Framework (NQF).

This article outlines the key changes, with a particular focus on how providers must now manage CCTV and digital technologies lawfully, transparently, and in accordance with updated privacy and safety standards.

While distinct from the Commonwealth’s Early Childhood Education and Care (Strengthening Regulation of Early Education) Bill 2025, the reforms intersect with growing expectations around the use of surveillance technologies in childcare settings.

What are the key changes to surveillance laws in childcare?

Mandatory 24-Hour Reporting

Allegations or incidents of physical or sexual abuse must be reported within 24 hours.

Ban on Vaping Devices and Substances (Regulation 82)

Service environments must be free from vaping products.

Digital Technology and Surveillance Policies (Regulation 168)

Services must document policies and procedures covering:

• taking, use, storage and destruction of images and videos
• parental authorisation for capturing and storing visual content
• use of optical surveillance devices (CCTV)
• use of service-issued digital devices by staff
• use of digital devices by children
  

These provisions ensure surveillance and technology use is lawful, proportionate, and respectful of children’s privacy and dignity.

What is the current federal privacy law framework?

Under the Privacy Act 1988 and the Australian Privacy Principles (APPs), CCTV footage is personal information when it captures identifiable individuals.

Key obligations include:

• Notification of surveillance
• Consent from parents/guardians
• Secure storage and restricted access
• Retention and destruction of footage

Services must also comply with the Notifiable Data Breaches scheme.

Regulation 183 of the NQF also requires records to be retained for:

• 3 years after a child’s last day, or
• until age 25 where an incident or trauma is involved.

How do state and territory surveillance laws affect childcare services?

Most early learning centres use CCTV in:

• reception and entry points
• communal indoor areas
• outdoor play areas

However, surveillance laws vary significantly and impose restrictions on surveillance in ‘private areas’ or during ‘private activities’.

Children cannot legally consent, so parental consent is required — but parental consent does not override state surveillance laws.

What do surveillance laws require in NSW childcare settings?

Under the Surveillance Devices Act 2007 (NSW):

• It is an offence to record private activities without consent.
• Private activities include sleep rooms, nappy change areas, and bathrooms.
• A child cannot consent — therefore surveillance in private areas is effectively prohibited, even with parental consent.

What do surveillance laws require in Victoria childcare settings?

Under the Surveillance Devices Act 1999 (VIC):

• Surveillance in private activities is prohibited without consent of all parties.
• Parental consent is insufficient.
• CCTV cannot operate in bathrooms, change areas, or sleep rooms.

What do surveillance laws require in Northern Territory childcare settings?

Under the Surveillance Devices Act 2007 (NT):

• Surveillance of private activities is prohibited without consent of all parties.
• Parental consent does not authorise surveillance in private areas.

How should childcare services prepare for the new surveillance laws?

Providers, centre owners and operators, nominated supervisors and educational leaders must:

• conduct a risk management and compliance assessment
• review privacy, record keeping and incident reporting policies
• update enrolment documentation
• deliver specialised staff training in privacy and data handling
  

Professional expertise is required to ensure compliance and prevent liability. Chamberlains can assist.

This article was prepared with the assistance of Isabella Turner and Emma Saunders.