Consent
Consent means someone giving permission for their personal information to be collected, used, and/or shared. In schools, this is often a parent or carer on behalf of a child.
Schools and the department must ask for consent in certain circumstances. For example, consent is generally required for the collection, use or disclosure of health information (unless one of the exemptions under privacy law applies, such as to lessen or prevent a serious threat to someone’s life, health, safety or welfare).
There are some exceptions in privacy law that allow the department and schools to use or disclose personal information without consent, such as sharing with a law enforcement agency to help an investigation. The department and schools are also able to share personal information through both the Child Information Sharing Scheme (CISS) to promote the wellbeing or safety of children and the Family Violence Information Sharing Scheme (FVISS) to assess or manage family violence risk.
More information is also available in the Schools' privacy .
Valid consent
When giving consent, the person must have the capacity to consent. Therefore, consent is usually gained by parents, carers or mature minors.
For consent to be valid, it must be:
- informed: the person or their parent/carer can understand what they are agreeing to
- specific: it is clear what the consent is for
- current: it applies to the situation right now
- voluntary: the person, parent or carer agrees to it freely.
This is especially important when the subject matter or content is sensitive.
Schools must ask for consent again if they want to use or disclose personal information in a way that is different from the primary purpose it was collected or a reasonably expected secondary purpose.
Types of consent
For most purposes, schools must obtain consent through either an opt-in or opt-out process:
- Opt-in consent is when the person actively gives permission.
- Opt-out consent assumes the person has consented unless they take active steps to say no.
Common examples of activities that require consent include:
- implementing new software
- photographing and recording staff and students for non-standard school functions
- research in schools.
When to use opt-in
Opt-in consent must be used when the activity or software collects:
- health or wellbeing information
- photos
- other sensitive information.
Sensitive information can include things such as cultural background and sexual orientation.
Opt-in consent is also advised for any activity or software that has aspects that could increase privacy risk, such as group chats or publishing material online.
When to use opt-out
Opt-out consent can be used when minimal personal information is being collected or used for a school purpose.
This includes for software such as apps that only requires name and year level.
When no consent is needed
There are specific purposes where the department can collect and manage personal information without specific consent. These are described in the Schools’ privacy and Schools' privacy collection .
As a summary, the specific purposes include:
- educating students
- supporting students’ health or social and emotional wellbeing
- fulfilling legal obligations, including duty of care, anti-discrimination law and occupational health and safety law
- communicating and engaging with parents
- undertaking student administration and school management
- same-day notification of unexplained absences.
There are also some exceptions in privacy laws that allow schools to use or disclose information without consent. These include:
- when necessary to lessen or prevent serious harm
- as required for law enforcement purposes.
For advice on sharing personal and health information, including for child safety, refer to Sharing information.
If you require more information on when an exemption may apply, please email the Privacy team at privacy@education.vic.gov.au
Implementing software and new technology in schools
When implementing new software and new technology, schools must consider whether consent is needed for use of the software. If consent is needed, schools will need to identify whether it is an opt-in or opt-out consent situation.
Consent and artificial intelligence
When using new technology such as artificial intelligence (AI), schools should act with caution, as the privacy risks may not be obvious.
A common type of AI is generative AI. Generative AI tools can produce various types of content such as text, imagery, audio and other synthetic data.
Personal information must not be uploaded to generative AI tools. Parents should have the option to opt-out of their child from using or having their information stored in AI tools.
For more guidance on the use of generative AI tools, refer to the Generative Artificial Intelligence policy.
For further advice on consent for use of software, contact the Privacy team by emailing privacy@education.vic.gov.au
For guidance on informing parents and gaining consent, refer to Collection notices.
Conducting research in schools
All research conducted in schools requires consent from participants. For any student under the age of 18, consent must be sought from parents/carers.
This applies to both research conducted or commissioned by the department or research conducted by external researchers.
If the research involves photographing or filming, the researcher must ensure specific consent is gained.
For the department’s policy, refer to Research and Evaluation in Schools.
Cover letter and consent form templates for external research are available for schools, refer to:
Reviewed 09 July 2025