Child safe practices for digital technologies and personal electronic devices

Overview

The safety of children attending early childhood education and care services is crucial. Monitoring how children’s images or videos are taken, stored and shared is difficult on personal devices. Using only service-issued devices helps services manage the risks to children.

The Victorian Government is taking action to:

require Victorian services to apply the National Model Code and restrict the use of personal devices in services
enforce changes to the Education and Care Services National Regulations requiring new policies and procedures for the safe use of digital technologies and online environments.

National Model Code

The National Model Code for Taking Images or Videos of Children while Providing Early Childhood Education and Care (National Model Code), was released in July 2024 by Australian Children's Education and Care Quality Authority (ACECQA).

Until now it has been voluntary for NQF services educating and caring for children from birth to 5 years to comply. The Victorian Regulatory Authority is now requiring approved providers to comply with the National Model Code.

The National Model Code states that:

Part 1: only service-issued electronic devices should be used when taking images or videos of children while providing education and care

Part 2: personal electronic devices that can take images or videos and personal storage and file transfer media should not be in the possession of any person while providing education and care and working directly with children

Part 3: any exceptions to the restrictions on personal devices should:

be limited to essential purposes other than the taking of images or videos of children
be authorised in writing by the approved provider (or another means if not reasonably practical), and
only be authorised where access does not impede the active supervision of children.

Part 4: approved providers and services should have strict controls in place for the appropriate storage and retention of images and videos of children.

Read more about the National Model Code, watch a video and access additional resources at: National Model Code.

Statement of Regulatory Expectations

The Victorian Regulatory Authority is committed to ensuring the safety and wellbeing of children attending early childhood education and care services.

The following Statement of Regulatory Expectations outlines the obligations and requirements for all approved providers of education and care services operating in Victoria, in implementing the National Model Code for Taking Images or Videos of Children while Providing Early Childhood Education and Care.

The Statement of Regulatory Expectations – National Model Code applies to providers of centre-based services and family day care services approved to operate in Victoria.

Conditions of service approval

Under both the Education and Care Services National Law and the Children's Services Act (CSA), a service approval is granted subject to the following conditions:

the service is operated in a way that ensures the safety, health and wellbeing of the children being educated and cared for by the service (section 51(1)(a) of the National Law and section 50(1) of the CSA); and
the approved provider must ensure that the service is operated in a way that complies with the Child Safe Standards (section 51(4C) of the National Law and section 50(2A) of the CSA).

The Victorian Regulatory Authority under the National Law, CSA and Child Safe Standards, considers that in complying with these conditions, an approved provider must:

have in place policies and procedures that align with the National Model Code (as specified below); and
take steps to ensure these policies and procedures are followed.

Centre-based services include long day care, kindergarten, and outside school hours care services approved to operate under the National Law and children’s services, including occasional care and limited hours services, approved to operate under the CSA.
The approved provider of a centre-based service must ensure that:
- only service-issued electronic devices are used when taking images or videos of children
- personal electronic devices that can take images or videos, and personal storage and file transfer media, are not in the possession of any person while providing education and care and working with children, except for limited essential purposes
- services have strict controls in place for the appropriate storage and retention of images and videos of children
- service policies and procedures required under regulation 168 of the Education and Care Services National Regulations (National Regulations) and regulation 112 of the Children’s Services Regulations must be made or updated so they align with the National Model Code
The approved provider of family day care services must ensure that:
- only service-issued electronic devices are used when taking images or videos of children
- services have strict controls in place for the appropriate storage and retention of images and videos of children
- service policies and procedures required under regulation 168 and regulation 169 of the National Regulations must be made or updated so they align with the requirements of the Statement of Regulatory Expectations – National Model Code for family day care services.
Family day care educators can take images or videos of children using a device only if that device:
- is only used for providing education and care (and not personal use); and
- is registered with the approved provider.
This is considered a ‘service-issued’ device.

Dates for implementation

All approved providers must implement requirements at each of their Victorian education and care services by Friday 26 September 2025.

Following this date, the Victorian Regulatory Authority may take enforcement action against service providers found to be non-compliant with their regulatory obligations, including compliance with the Child Safe Standards.

Guidance on personal electronic devices restrictions

Restricted devices

The restricted devices under the National Model Code are:

personal devices that can take images or videos and
personal storage and file transfer media.

For example:

phones
tablets
digital cameras
smart watches with camera/recording functionality
wearables, such as camera glasses
SD cards
USB drive
hard drives.

Who the restrictions apply to

These restrictions apply to any person who is providing education and care and working directly with children.

Examples include:

teachers and educators, including casual and agency staff
students attending the service as part of a practicum and representatives of tertiary providers who attend the service to assess students
volunteers, including parent volunteers
any third parties delivering programs or incursion activities to children in a service, whether paid or unpaid
allied health and inclusion professionals attending a service to observe, assess or work with a child at the service
mentors or coaches attending the service to support teachers or educators working with children or providing education and care
preschool field officers
primary school teachers attending a service as part of a school transition program.

If a third party professional attending a service and working directly with children (such as an allied health or inclusion professional) needs to use a device (for example, to undertake an assessment or take notes) they can use a device that is:

issued by their business or institution; and
used only for work purposes (and not personal use).

Broader child safe policies and procedures, including for the safe use of digital technologies and online environments at the service, will continue to apply in these examples.

Facilitating the use of service-issued devices

Services may consider facilitating the use of a service-issued device where

a student attending the service as part of a practicum; or
a visiting allied health or inclusion professional needs to take images or videos but has no business or institution-issued device.

Staff using personal devices to access Arrival

Teachers and educators cannot use personal devices for multi-factor authentication to access and use Arrival while providing education and care and working directly with children.

Services using Arrival to collect and manage attendance data will receive further advice from the department on how to implement the restrictions and continue to access and use Arrival to sign children in and out.

Who the restrictions do not apply to

The restrictions do not apply to people who are not providing education and care and not working directly with children.

This includes:

parents and carers attending the service to drop off or pick up their child
Victorian Regulatory Authority Authorised Officers
police
officers of other regulators, such as environmental health officers
third parties who are attending the service but are not working with children or providing education or care (for example, maintenance contractors).

Broader child safe policies and procedures and supervision requirements continue to apply in these examples.

Exceptions to the restrictions

The National Model Code lists the following essential purposes for which the use or possession of a personal devices may be authorised where access does not impede the active supervision of children:

communication in an emergency situation to ensure safety
- involving a lost child, injury to child or staff member, or other serious incident
- in the case of a lockdown or evacuation of the service premises
personal health requirements
- for example, heart or blood sugar level monitoring
disability
- for example, where a personal electronic device is an essential means of communication for an educator or other staff member
family necessity
- for example, an early childhood staff member with an ill family member
technology failure
- for example, when a temporary outage of service-issued electronic devices has occurred
during a local emergency event to receive emergency notifications. This could include government warning systems such as a bushfire evacuation text notification.

Additional essential purposes

In addition to these essential purposes listed above, the Victorian Regulatory Authority considers that the following may be essential purposes for which the possession of a personal electronic device may be authorised where access does not impede the active supervision of children:

emergency communication during excursions and regular outings
- for example, when groups of children and educators get split up
emergency communication when children are transported or travel on transport arranged by the service.

Approved providers cannot authorise the use of a personal device to take images or videos of children.

Uses that are not considered essential purposes

The Victorian Regulatory Authority does not consider routine communication during bush, beach or other nature programs to be an essential purpose for which approved providers can authorise the possession and use of personal devices.

Approved providers should ensure there are sufficient service-issued devices available when programs are delivered outside the approved service premises.

Documentation required for essential purposes authorisations

All authorisations must be documented by the approved provider:

Authorisations must be made in writing in advance where possible.
Approved providers must create and maintain suitable logs or registers for recording:
- authorisations made in writing in advance, and
- retrospectively, authorisations made through another means where written authorisation is not possible (for example, in an emergency situation).
The logs or registers should be stored securely. All documentation should be available at the service for authorised officers to inspect.

When staff can use personal devices

Personal devices can be accessible to teachers, educators and other staff when they are not providing education and care or working directly with children.

Examples could include:

while taking a scheduled break from work, such as a lunch or tea break
during planning time
during administrative activities.

Staff can also carry and use personal electronic devices that:

cannot take images or videos, and
are not storage and file transfer media.

National Regulation changes

From 1 September 2025, approved providers under the National Law must ensure their services have policies and procedures for the safe use of digital technologies and online environments.

This includes policies and procedures for:

the taking, use, storage and destruction of images and videos of children
obtaining authorisation from parents to take, use and store images and videos of children
the use of any optical surveillance device (e.g. CCTV)
the use of any digital device issued by the service.

Read the ACECQA policy guidelines for assistance in drafting a Safe Use of Digital Technologies and Online Environment policy and procedures. The policy and procedures must align with the National Model Code.

Actions for approved providers

To demonstrate adequate policies and procedures for the taking, use, storage and destruction of images and videos of children, approved providers must ensure the following.

All their services comply with all the Child Safe Standards, in particular Standard 9 and 11.
All service staff, leaders, volunteers and families are aware of:
- their obligations under the National Model Code, and
- the consequences of using personal devices for taking, sending and storing images or videos of children while they attend the service.

- Staff and volunteers identify and mitigate risks in the online and physical environments without compromising a child’s right to privacy, access to information, social connections and learning opportunities (9.1).
- The online environment is used in accordance with the organisation’s Code of Conduct and Child Safety and Wellbeing Policy (Child Safe Environment Policy) and practices (9.2).
- Risk management plans consider risks posed by organisational setting, activities and the physical environment (9.3).
What approved providers have to show
You could demonstrate your compliance by having the following documents:
Risk assessments that identify risks of child abuse and harm:
- in both physical and online environments connected with the organisation, and
- from the use of electronic devices for taking, sending and storing images or videos of children while they attend the service (Child Safe Standards 9.1, 9.3).
Risk management plans that:
- list the actions the organisation will take to prevent or reduce each of the risks of child abuse and harm
- address the use of electronic devices for taking, sending and storing images or videos of children while they attend the service (Child Safe Standard 9.3).
The Code of Conduct and Child Safety and Wellbeing Policy (Child Safe Environment Policy) that identify how the organisation will keep children safe:
- in physical and online environments
- in higher-risk activities
  - including staff using electronic devices for taking, sending and storing images or videos of children while they attend the service (Child Safe Standards 9.2, 9.3).
- Policies and procedures address all Child Safe Standards (11.1)
- Policies and procedures are documented and easy to understand (11.2)
- Best practice models and stakeholder consultation inform the development of policies and procedures (11.3)
- Leaders champion and model compliance with policies and procedures (11.4)
- Staff and volunteers understand and implement policies and procedures (11.5)
What approved providers have to show
You could demonstrate your compliance by having the following documents:
- A Child Safety and Wellbeing Policy (Child Safe Environment Policy) and the Safe Use of Digital Technologies and Online Environments as required under regulation 168 of the National Regulations or regulation 112 of the Children’s Services Regulations that includes:
  - the service's expectations, practices and approach in relation to the use of electronic devices for taking, sending and storing images or videos of children while they attend the service in accordance with the National Model Code
  - This relates to Child Safe Standards 11.1, 11.2 and links to 2.3)
Creating or updating the Code of Conduct for staff within the service’s Staffing policies and procedures that sets the service’s expectations for behaviour and responsibilities of staff and volunteers in relation to
- the use of personal devices in services
- the approach to taking, sending and storing images or videos of children while they attend the service
- This relates to the National Model Code and Child Safe Standards 11.1, 11.2 and links to 2.4, and regulation 168 of the National Regulations or regulation 112 of the Children's Services Regulation.
To help comply with the Statement of Regulatory Expectations – National Model Code, below is a checklist of actions you must address:
- Update your policies and procedures for providing a Child Safety and Wellbeing Policy (Child Safe Environment Policy):
  - make sure educators, staff, volunteers and families are aware of the service's expectations, practices and approach
  - ensure you have appropriate consents for any general purpose photography or filming, and respect a family's decision to withhold their consent
  - ensure your service uses or discloses personal information for the purpose for which it was collected, unless the family has specifically consented, or disclosure is needed for enforcement purposes
  - ensure policies and procedures cover the use of personal electronic devices for taking, sending and storing images or videos of children taken while they attend the service in accordance with the National Mode Code.
- Update your staffing policies and procedures to make sure all service staff and volunteers are:
  - aware of their obligations, and
  - the consequences of using personal electronic devices for taking, sending and storing images or videos of children while they attend the service in accordance with the National Model Code.
- Share new or updated policies and procedures about safe environments for children and staff with:
  - all staff and volunteers, and
  - families of children attending the service.
- Undertake regular risk assessments of the taking, use, storage and destruction of images and videos of children being educated and cared for by the service.
- Implement a risk management plan to ensure you successfully implement the National Model Code at your service.
- Make sure all service-issued devices:
  - have an identification code
  - are distinctly branded
  - are easily identifiable from a distance.
- Create and maintain suitable logs or registers for recording:
  - how service-issued devices are issued and returned
  - authorisations for the possession and use of personal devices for essential purposes, including:
    authorisations given in writing in advance, and
    authorisations made through other means (for example, in an emergency situation).
- Create a place to securely store service-issued devices when not in use. Consider how you will control your devices if staff are moving between locations.
- Install lockable storage for staff to:
  - securely store and access their personal devices when not working with children
  - make sure it is conveniently located.
- Purchase a sufficient number of service-issued devices. Create a place to store these devices securely when not in use.
- Make sure each staff member has:
  - individual account credentials
  - passwords to any online platforms used by the service.
- Create processes for:
  - permanently deleting or destroying photos and videos of children that no longer need to be retained.
- Check your processes are working as intended. Undertake regular:
  - audits
  - risk assessments
  - reviews.
- Review all your policies, procedures, systems and devices regularly
- Share factsheets with staff:
  - Factsheet for centre-based staff
  - Factsheet for family day care staff

Factsheets for staff

Consequence of failing to comply

Failure to put appropriate mechanisms in place to establish child safe practices for the use of electronic devices in education and care services, such that children are at risk of harm, may be a failure to comply with the conditions of service approval.

Penalties for any approved provider found to have failed to comply with the conditions of their service approval include:

fines of up to $57,400 for long day care, kindergarten, outside school hours care and family day care services or up to $61,053 for occasional care and limited hours services
suspension or cancellation of their service approval.

Further information

For further enquiries, contact the contact the Quality Assessment and Regulation Division (QARD) by:

email: licensed.childrens.services@education.vic.gov.au
phone: 1300 307 415

The Victorian Government is committed to providing accessible information. This page may not meet level AA of the Web Content Accessibility Guidelines 2.1. If you are unable to use any of the content of this page, you can contact us to request an accessible version.

Contact email: licensed.childrens.services@education.vic.gov.au
Contact number: 1300 307 415

Education

Updated 15 August 2025