You're halfway through an enrolment form when the questions become more personal. Your child's immunisation history, allergy plan, emergency contacts, medical notes, family court arrangements and authorised pick-up details all need to go somewhere. Handing that information to people you've only just met can leave you wondering who will see it, where it will be stored and what happens if something goes wrong.
Those are reasonable questions. Privacy and confidentiality in childcare aren't abstract policy ideas. They affect the enrolment form on the reception desk, the medication record in a child's room, the photograph taken during an art experience and the conversation an educator has at the close of the day. At a Victorian early learning centre, good practice means using information for your child's care, limiting access, explaining decisions clearly and giving families a practical way to ask questions.
Why Your Family's Information Matters at Childcare
A family's information arrives at the centre in many forms. A parent may write down a child's asthma action plan, explain a food allergy, provide a second emergency contact and discuss who may collect the child. Another family may need to share information about a court order or a child's developmental needs so educators can keep routines safe and predictable.
Each detail has a purpose, but that doesn't make it feel ordinary. You're trusting the centre with information about your home life as well as your child's wellbeing. You may also be thinking about the less obvious records created after enrolment, including learning observations, incident reports, medication entries, attendance information and photographs.
At a service such as childcare near you, privacy should be visible in everyday behaviour, not just in a document offered during enrolment. The person greeting you at reception should know how to direct a records request. Educators should understand which details they need for their role and which details they don't need to discuss. Leaders should be able to explain how the centre responds to an incorrect record, an unauthorised disclosure or a suspected data breach.
A helpful starting point: Information should be collected because it supports a child's safety, care, learning or lawful administration, not simply because it might be useful one day.
That doesn't mean a centre can keep families in the dark when information is necessary. An educator needs relevant allergy information to respond safely at mealtimes. A nominated supervisor may need authorised collection details when checking who can take a child home. A teacher may need developmental information to plan an appropriate experience.
It does mean families should be able to ask, “Why do you need this?” and receive a plain answer. You should also be able to ask what happens next, who can access the information and whether you can change your consent later.
Privacy supports your family's control over personal information. Confidentiality governs how people behave once they're trusted with it. The two ideas work together, and both matter when a child spends much of the week in someone else's care.
Understanding Privacy and Confidentiality in Simple Terms
Think of your child's information as being kept in a locked filing cabinet.
Privacy is about the cabinet and the key. It covers what information is collected, why it's collected, where it's kept and which people are allowed to access it. A password-protected enrolment system, a locked records cupboard and role-based access are examples of privacy controls.
Confidentiality is the promise made by every person who has a legitimate key. It means they won't discuss, copy or disclose what they see unless there's a proper reason and an authorised pathway.
Privacy: The arrangements that control how personal information is collected, stored, accessed, used and disclosed.
Confidentiality: The responsibility to keep information entrusted to you from being shared with people who aren't authorised to receive it.
What the difference looks like at a centre
Suppose you tell the enrolment officer that your child has a serious nut allergy. Privacy asks whether the form is collected through a secure process, whether the record is stored safely and whether access is limited to people who need it for care. Confidentiality asks whether an educator avoids mentioning the allergy in front of unrelated families or leaving the form visible on a desk.
Another example is toilet learning. An educator may record progress so the team can respond consistently. That's part of responsible information use. The educator shouldn't then discuss your child's toileting with another parent in the hallway, even if the conversation seems casual.
Photographs show how the concepts overlap. A centre may have a system for storing approved images and identifying which families have agreed to particular uses. Staff confidentiality still matters because an educator shouldn't send a child's image from a personal phone or share it with someone who isn't authorised.
When confidentiality has limits
Confidentiality isn't a promise to keep every piece of information secret in every circumstance. A centre may need to disclose information when a parent has authorised it, when an approved professional needs it to support the child, or when the law requires action. Safety and record-keeping responsibilities can also shape what information must be documented and shared through proper channels.
That doesn't give everyone permission to know everything. A disclosure should still be relevant, limited and made to the right person. The practical test is simple:
- What information is being considered?
- Why does this person need it?
- Has the family authorised the disclosure, or is there a legal or safety reason?
- Is the proposed method secure and appropriate?
If the answer to those questions isn't clear, pause and ask the centre director before sharing or requesting the information.
Australian and Victorian Obligations Explained
Australian privacy law applies differently depending on the type of childcare provider. The Office of the Australian Information Commissioner's guidance for children and young people says the Privacy Act 1988 usually covers private childcare centres. It generally doesn't cover local government-run childcare centres unless they're incorporated companies, societies or associations.
For a private Victorian centre, that means children's records, enrolment details, medical notes, family contact information and development information should be treated as personal information subject to appropriate handling. The exact legal position can depend on the organisation and the circumstances, so families with a complex concern may need independent legal advice.
The national breach framework
A data breach might involve a lost device, an incorrectly addressed email, unauthorised access to a database or a paper file viewed by someone who shouldn't have seen it. Childcare services fall within Australia's Notifiable Data Breaches framework, which requires an organisation to assess whether a breach is likely to result in serious harm.
If that assessment indicates serious harm is likely, the organisation must notify the OAIC and affected individuals. The practical response should also include containing the incident, identifying what information was involved, reviewing the cause and taking steps to reduce the chance of a repeat occurrence. A centre shouldn't wait for families to discover a serious problem themselves.
The national picture explains why operational controls matter. The OAIC recorded 1,113 data breach notifications in 2024, the highest annual total recorded since mandatory reporting began, and 1,205 notifications in 2025, an 8% increase over 2024. The figures are reported in the OAIC's record year for data breaches announcement. The 2024 report also recorded that 69% of breaches in the second half of that year were caused by malicious or criminal attacks, with 61% of those involving cyber-security incidents.
Those numbers don't mean every childcare centre faces the same risk. They do show why a privacy policy needs to be supported by secure systems, staff training, controlled access and a tested response plan.
Child-specific standards are developing
Australia's Children's Online Privacy Code is being designed to require organisations to consider children's best interests before collecting, using or disclosing personal information. The OAIC identifies a public consultation in 2026 and a planned commencement date of 10 December 2026 in its exposure draft announcement.
For Victorian families, privacy also sits alongside the centre's duty of care and record-keeping responsibilities. Educators must have enough relevant information to respond to health needs, manage authorised collection and support learning. A responsible service doesn't solve that tension by collecting everything or sharing nothing. It asks what's necessary, records it accurately and limits access to people with a legitimate role.
Families looking at long day care in Melbourne can ask how those legal duties translate into daily routines. A clear answer should cover enrolment, medical records, observations, photographs, authorised disclosures and breach response without relying only on legal terminology.
How Kids Club ELC Collects, Stores and Shares Information
Let's follow one fictional family through an ordinary enrolment process. We'll call the child Mia. Her parent provides an enrolment form, emergency contacts, immunisation information, an allergy plan and permission details for collection and photographs.
The centre should collect each item for a clear reason. The allergy plan helps educators prepare food and respond to symptoms. Emergency contacts provide alternatives if a parent can't be reached. Collection permissions help the team check whether the adult at the gate is authorised. Developmental information helps educators understand Mia's routines, interests and support needs.
A good conversation at enrolment also distinguishes between information needed for care and optional choices. A family may need to provide medical information for safety, while a photograph for a public social media post is a separate decision. Combining both choices into one vague permission can make consent difficult to understand.
Where the records sit
Mia's paper information should be kept in a secure location rather than on an open reception counter or in a room that is not secured. Digital records should be protected by appropriate account security, with access limited according to a person's role. An educator working directly with Mia may need relevant care and learning information, while someone with no role in her room doesn't need to browse her complete file.
This is called need-to-know access. It doesn't mean staff members are untrusted. It recognises that reducing unnecessary access reduces the number of opportunities for information to be misread, copied or disclosed.
Daily notes and observations also require care. An educator might record that Mia settled after her parent left, joined a group experience or needed support during lunch. The note should focus on information relevant to her care and learning, use respectful language and be stored through the centre's approved process.
When information moves
Information can sometimes move outside the immediate room. A funded kindergarten program may need relevant records to support continuity. A speech pathologist or other specialist may need information when the family has requested support and the appropriate permission is in place. An authorised medical professional may need health information to respond safely.
That movement should be deliberate. The centre should know what is being shared, why it's needed, who will receive it and how it will be sent. A staff member shouldn't forward a whole file when a specialist only needs a relevant report.
Information shouldn't be shared with another parent out of curiosity, used for an unrelated purpose or uploaded to a personal device for convenience. If a family asks what the centre holds about Mia, the response should be practical rather than defensive. Parents can contact the centre and ask what personal information is recorded, how it's used and whether anything needs correcting.
Your Rights as a Parent and How Consent Works
Privacy works best when parents can take action, not just read a policy. You can ask a centre to explain what information it holds about your child, request access to relevant personal information and point out an error. You can also ask how information has been used or shared, subject to legal limits and the circumstances of the request.
The OAIC's 2023 community survey found that 90% of Australians said they clearly understood why they should protect personal information, while 51% said they understood how to protect it and 21% rated their knowledge of privacy rights and data protection as very good or excellent. The Australian Community Attitudes to Privacy Survey 2023 also found that 47% knew they could request access to personal information, but only 9% had done so.
Those findings reflect a common experience. Parents may know privacy matters but still feel unsure about what to say. You can start with a straightforward request: “Could you please explain what records you hold about my child, who can access them and how I can request a correction?”
Consent should be understandable
Genuine consent is specific, voluntary and informed. The centre should explain what will happen, why it's needed and whether saying no affects the child's access to ordinary care. A long enrolment form that bundles optional publicity uses with essential care information doesn't help families make a meaningful choice.
Consent may also change. You might agree to photographs being used in a private family communication app but not on a public social media page. You might approve sharing a report with a speech therapist and later ask the centre to stop future sharing. Ask how to withdraw consent and whether information already used can be removed or recalled.
| Situation | Consent needed? | Can you change your mind? |
|---|---|---|
| Photograph for the centre's public social media | Usually, specific permission should be sought for this use | Ask the centre to withdraw future permission and explain what may already have been published |
| Permission for an excursion | The centre should explain the activity and obtain the relevant permission | Contact the centre promptly, before the activity, to discuss withdrawal |
| Sharing a report with a speech therapist | Normally, the family should understand and authorise the proposed disclosure, unless another lawful basis applies | Ask the centre to stop future disclosures and clarify what has already been sent |
| Medical information needed for safe care | The centre needs relevant information to meet care and safety responsibilities | You can't safely withhold necessary information while expecting the centre to manage the known risk, but you can ask how it's stored and accessed |
Parents remain important decision-makers for their child's information, but consent isn't the only basis for every use. Legal duties, safety requirements and authorised professional support can affect the answer. When in doubt, ask the centre to separate essential information from optional uses.
Practical Privacy Tips for Families and Staff
Privacy becomes easier when families and staff build small habits into the day. You don't need to be a technology specialist to ask sensible questions, and staff don't need a complicated script to protect a child's dignity.
For families
- Ask before enrolling: Find out where paper and digital records are stored, who can access them and how the centre handles photographs.
- Read the photo policy: Check whether it covers private communication platforms, public social media, group images and third-party photographers.
- Update changes quickly: Tell the centre when an emergency contact, medical plan, authorised collector or family arrangement changes.
- Use secure channels: Send sensitive documents through the centre's approved process rather than a personal social media message.
- Talk with your child: As children grow, teach them that their name, photo, health details and family information belong to them and shouldn't be shared without care.
A parent can also ask for a plain-language explanation of any form that feels unclear. It's better to clarify a permission before signing than to discover later that two people understood it differently.
For educators and operators
- Use need-to-know access: Give each staff member the information required for their role, not automatic access to every record.
- Protect daily notes: Keep observations, medication records and incident documentation in approved systems and away from public view.
- Choose conversations carefully: Discuss a child's care in a private room, not in a corridor, foyer or shared online group.
- Follow photo protocols: Use approved devices and systems, check each family's choices and never improvise with personal accounts.
- Practise the response: Staff should know who to tell if a device is lost, an email goes to the wrong person or a record is accessed unexpectedly.
A strong privacy culture feels calm and ordinary. Staff check before sharing, families ask before agreeing and leaders treat concerns as useful information about how the service can improve.
Raising Concerns, Sample Policy Elements and FAQs
If something worries you, start with the centre director. Ask to see the privacy and confidentiality policy, request an explanation in writing and keep a note of the response. Kids Club's policy and procedures information should help families understand the service's approach. If the issue isn't resolved, you can consider raising a complaint with the OAIC.
A useful policy should cover collection, storage, access permissions, disclosures, photographs and social media, consent withdrawal, corrections and breach response.
FAQs
How long are records kept after my child leaves?
The answer depends on the type of record and applicable record-keeping requirements. Ask the centre which retention rules apply and how secure disposal occurs.
Can both parents access a child's file?
Access depends on parental responsibility, court orders and the nature of the request. The centre may need to check the legal arrangements before responding.
What happens if a staff member discusses confidential information?
The centre should record and assess the incident, contain any further disclosure, notify the right people where required and review its procedures.
You're allowed to ask questions. A thoughtful centre will welcome them because clear communication protects children, families and educators alike.
Kids Club Early Learning Centre provides nurturing care and developmentally aligned learning for children from six weeks to six years, with VIT-registered teachers, kindergarten and pre-PREP programs, and practical enrolment support across Melbourne locations. Visit Kids Club Early Learning Centre to discuss your family's care needs and ask how privacy and confidentiality are handled from enrolment onwards.
