Victoria government logo

Early childhood services - child safety in physical and online environments

Guidance on Child Safe Standard 9: Physical and online environments promote safety and wellbeing while minimising the opportunity for children to be harmed.


This standard requires services to make a cultural shift and consider child abuse in all risk assessments and planning.

Standard 9 focuses on:

  • child safety and wellbeing in physical and online environments
  • ensuring that arrangements for purchasing services from third parties maintain child safety

Services must analyse and understand potential risks to children, including risks created by:

  • physical and online environments
  • incursions
  • excursions
  • regular transportation
  • works or renovations at the premises

Services must address online behaviour in their Child Safe Environment Policy and other service policies.

The risks at Outside School Hours Care (OSHC) or vacation care services are quite different to risks at services for children under school due to:

  • children’s ages and developmental stages
  • the location of these services.

Many OSHC services operate from premises that aren’t built to meet early childhood regulatory requirements. In these cases, supervision is more difficult.

  • Services approved under the National Quality Framework (NQF):

    • long day care
    • family day care
    • kindergartens (preschool)
    • Outside School Hours Care (OSHC)
    • school holiday programs that operate for 28 days or more per year.

    Services approved under the Children’s Services Act (CS Act):

    • limited hours
    • occasional care
    • school holiday programs that operate for less than 28 days per year
    • early childhood intervention services
    • former Budget Based Funded services
    • mobile services.

Actions services must take to comply with Standard 9

Standard 9: Physical and online environments promote safety and wellbeing while minimising the opportunity for children to be harmed.

Early childhood services must comply with all the following elements of this standard:

  • Staff and volunteers identify and mitigate risks in the online and physical environments without compromising a child’s right to privacy, access to information, social connections and learning opportunities (9.1).
  • The online environment is used in accordance with the service’s Code of Conduct and Child Safe Environment Policy and practices (9.2).
  • Risk management plans consider risks posed by service settings, activities, and the physical environment (9.3).
  • Services that contract facilities and services from third parties have procurement policies that ensure the safety of children and young people (9.4).

How to comply - examples and ideas

    • Inform children and their families about:
      • appropriate use of the service’s technology
      • safety tools
      • how to seek help and report concerns, including cyberbullying and online grooming.
    • Keep up to date with current online safety issues and expert information. This includes the Office of the e-Safety CommissionerExternal Link .
    • Promote activities that raise awareness to prevent bullying and violence. For example, the National Day of Action against Bullying and ViolenceExternal Link .
    • Create a respectful, sensitive and safe environment for people who may be experiencing family violence.
    • Ask for children’s permission before taking their photo. They’ll begin to understand how photos of them will be used and published.
    • Carefully consider the way your service shares information about children with families to ensure that it keeps children safe, and is not shared widely. If photos or other items are shared through online platforms make sure they are password protected. Check if children still attend the service annually and remove their access.
  • Download ACECQA’s risk assessment and management tools and templates from Quality Area 2 Children’s health and safetyExternal Link :

    • Conduct a comprehensive risk assessment of all spaces. This includes within the premises and on excursions. Pay attention to high-risk settings such as swimming pools and on transportation.
    • Keep records of risk management activities. Risk assessments for excursions and regular transportation must be kept on file for 3 years [reg 183(2)(g)].
    • Consider risks arising from child-to-child and adult-to-child interactions in physical and online spaces.
    • Include identified risks and risk management strategies in:
      • staff and volunteer inductions
      • supervision
      • ongoing training.
    • Consider cultural safety - is the physical environment at the service welcoming to Aboriginal people and people from diverse cultural backgrounds? Find resources at: Early Childhood Standard 1.
    • Pay attention to the children’s safety, diverse needs and vulnerabilities in each activity or setting. Consider any barriers that might prevent children from raising concerns.
    • Identify and record the service’s child safety risks in a risk register or similar document.
    • Train staff and relevant volunteers on risk management policies and procedures. Download ACECQA’s ‘Risk assessment and management tool’ and infographics from ACECQA’s Quality Area 2 - Children’s health and safetyExternal Link While developed for NQF services it can also be used by CS Act services. It includes:
      • risk management
      • completing a risk assessment
      • activities to build understanding of risk assessment
      • templates and other resources.
  • Adequate supervision of children of all ages is essential. Your service needs to meet the required educator-to-child ratios.

    Supervision is more challenging for OSHC services. Many premises are not purpose-built for early childhood services.

    • Be aware of risks posed by dark spaces, stairwells, private spaces, corners, and vehicles. Develop strategies to address these risks. This is important for services operating on school grounds.
    • Inform children about off-limit spaces, including out-of-bounds areas, storerooms and staff rooms.
    • Limit activities where one person is alone with a child or children.
    • Keep records of any intervention orders and court orders about access. Communicate to staff the names of people authorised to collect children in these circumstances. This information must be kept in the child’s enrolment record.
    • Use observation aids such as observation windows, concave mirrors, and CCTV. Consider the balance between appropriate visibility and respecting staff and students’ privacy.
    • Improve lighting in poorly lit areas.
    • Let children know how to raise concerns and where to go if they need help.
    • Organise professional learning on risk, harm prevention and hazard awareness.
    • Review incidents against policies and procedures. Where appropriate, ask children how incidents were handled and how safe they felt. Then make improvements as needed. This may only be appropriate for school-aged children.
  • For school aged children attending early childhood services (OSHC, vacation care).

    • Help children use the internet and social media in age-appropriate ways by using the Office of the e-Safety CommissionerExternal Link .
    • Inform children about online safety risks if age-appropriate, including:
      • cyberbullying and trolling
      • invasion of privacy or digital surveillance
      • inappropriate sharing of images
      • phishing, harvesting of personal information or data theft
      • identity theft
      • malevolent software (malware)
      • offensive images and messages
      • age-inappropriate online content
      • impersonation/catfishing
      • grooming.
    • Outline acceptable use of personal devices for school aged children.
    • Prohibit the use of student email addresses to sign up to unauthorised third-party services. Communicate this expectation to children, families and the service community.
    • Use filtering software on service-based devices.
    • Encourage families to use parental controls on personal devices.
    • Regularly discuss online safety with staff, volunteers, families and children.
    • Tell children how to seek help from a trusted adult if they are exposed to inappropriate imagery or content that upsets them.
    • Monitor online activity. Respond to breaches of the online policies and procedures with appropriate consequences.
    • Include in your Code of Conduct:
      • use of social media, email, instant messages, SMS and other apps
      • misuse of digital devices and unacceptable behaviour.
    • Include in your Child Safe Environment Policy:
      • acceptable and non-acceptable online behaviour
      • guidelines for taking, storing and using images and videos of children.
    • Outline acceptable use of personal devices by staff and volunteers.
    • Review communication protocols regularly. Consider emerging services and technologies, such as disappearing message services.
    • Protect children’s privacy. Support them to limit the amount of information provided online.
    • Require service staff to do information security training to reduce the risk of phishing or malware.

    Handle breaches and concerns

    • Uphold policies. Report breaches in line with complaints handling processes and the Code of Conduct.
    • Provide clear ways for children, families, carers and staff to report online issues or concerns.
    • Carefully check contractor’s child safety when engaging third parties; request valid Working with ChildrenClearances. A new contractor presents new risks.
    • Give contractors the Code of Conduct and Child Safe Environment Policy.
    • Make child safety a feature in legal contracts. The Victorian Government Common Funding Agreement has this as a standard.
    • Conduct a Privacy Impact Assessment for any software that handles children’s and families’ personal information.

    Collect compliance information

    • Nominate a staff member to collect child safety compliance information about contractors when they enter the service.
    • Ask contractors to give their Working with Children Clearance when they enter the service.
    • Keep records of processes for checking contractors.
    • Require evidence of Child Safe Standards compliance when establishing contracts for services to children.

    Contractors on the premises

    • Properly supervise contractors at all times when they are on service premises when children are attending. Unauthorised people must not remain at a service unless a staff member directly supervises them.
    • If a contractor does not comply with the Child Safe Standards:
      • cease all activities with the contractor until the issue is resolved
      • if appropriate, inform the contractor of the non-compliance and provide an opportunity to rectify the problem
      • if the issue is serious, contact the relevant authorities.
  • Early childhood services have extensive obligations under the National Law and CS Act and associated Regulations.

    Services must already:

    • protect the safety, health and wellbeing of children attending the service
    • take every reasonable precaution to protect children from harm and any hazard likely to cause injury
    • adequately supervise children of all ages
    • conduct risk assessments and create management plans
    • ensure unauthorised persons do not remain at a service unless they are directly supervised by a staff member
    • only allow children to leave the premises when:
      • collected by a parent
      • collected by an authorised person named in the enrolment record
      • written authorisation is provided.

    The National Law and Regulations requires services to conduct risk assessments in situations including:

    • Transportation
    • Excursions and regular outings
    • Emergency and evacuation procedures


    Children are at increased risk during single trips or regular transportation. Carefully plan transportation to make sure no children are left in vehicles, especially at transition points.

    Services must have policies and procedures for excursions, regular outings and transportation. All staff and volunteers must follow them.

    For transportation provided or arranged by the service, you must:

    • conduct a detailed risk assessment
    • get written authorisation from parents for the child to be transported.

    The risk assessment and written authorisation must be completed once every 12 months for regular outings and transportation that are substantially the same.

    ACECQA’s downloadable templates and information:


    Excursions present additional risks. Services must have an excursion policy.

    For each excursion you must:

    • complete a detailed risk assessment
    • manage transport
    • get written authorisation from parents.

    Download a template for excursion risk assessment at: Forms and templates | ACECQAExternal Link

    Emergency and evacuation procedure

    Services must:

    1. conduct a risk assessment to identify relevant potential emergencies
    2. prepare emergency and evacuation procedures.

    Downoad ACECQA’s ‘Emergency and evacuation policy and procedure guidelines’ from Preparing NQF Policies and ProceduresExternal Link .


Reviewed 08 July 2022

Child Safe Standards

Was this page helpful?