Education Platform Privacy Policy: What To Include

Maya is getting ready to launch an online maths tutoring platform for Australian high school students. Students create accounts, parents pay the subscription, teachers upload progress notes, and the platform uses overseas cloud hosting plus analytics tools to see which lessons are working.

Her first school customer asks for her privacy policy, data storage details and breach process before signing the contract. Suddenly, privacy feels much bigger than a footer link on a website.

If your platform collects student, parent, teacher or school data, your privacy policy needs to do more than tick a box. It should clearly explain what you collect, why you collect it, who you share it with and how you protect it.

Do You Need An Education Platform Privacy Policy?

Yes, you should have an education platform privacy policy if your platform collects personal information from students, parents, teachers or schools.

Under the Privacy Act 1988, many Australian businesses must comply with the Australian Privacy Principles, often called the APPs. This usually applies if your annual turnover is more than $3 million, but some smaller businesses are also covered.

For example, you may need to comply even if you're under the $3 million threshold if you:

• provide a health service and hold health information, such as disability, wellbeing or counselling information
• trade in personal information, such as selling student data or lists
• are a contracted service provider to the Australian Government
• are related to a larger business that's covered by the Privacy Act
• choose to opt in to Privacy Act coverage

Even if the Privacy Act doesn't strictly apply to your business yet, schools, universities, investors and enterprise customers may still expect you to meet APP-style standards. Many school procurement teams won't onboard an edtech provider unless the privacy documents are clear and credible.

Think of your privacy policy as both a legal document and a trust document. It helps users understand what happens to their information, and it helps your business answer school due diligence questions without reinventing the wheel each time.

What Student Data Should Your Privacy Policy Cover?

Your privacy policy should cover every type of personal information your platform collects, even if some of it feels routine or technical.

For an education platform, personal information often includes more than a student's name and email address. It can include information collected directly from users, uploaded by schools, generated through platform activity or collected through third party tools.

Common examples include:

• student names, school year, class, school and login details
• parent or guardian names, contact details and payment details
• teacher names, staff emails and role permissions
• assessment results, progress reports, lesson completion data and feedback
• messages, discussion posts, uploaded files and support requests
• device information, IP addresses, cookies, session recordings and analytics data
• photos, videos, voice recordings or classroom interaction data

Some education data can also become sensitive information under the Privacy Act. Sensitive information includes things like health information, racial or ethnic origin, religious beliefs and disability information.

For example, a student's quiz score usually isn't sensitive information on its own. But a support note saying the student has ADHD, anxiety or a hearing impairment may be health or disability information. Your privacy policy should be honest about these categories if your platform collects them.

If you use AI features, recommendation engines or learning analytics, explain this in plain English. Users and schools should be able to understand that your platform may analyse activity to suggest lessons, flag learning gaps or generate reports.

How Should You Handle Children's Information And Consent?

You need to treat children's information with extra care because students may not fully understand what they're agreeing to.

Australian privacy law doesn't set one single age where every child can always consent to privacy collection. Instead, the question is whether the child has enough maturity and understanding to make the decision. As a practical approach, many platforms ask for parent, guardian or school consent for younger users.

If your platform is used in schools, the school may provide or facilitate consent under its own enrolment, technology use or procurement process. Your contract should make this clear, because your privacy policy alone may not be enough.

A Practical Example

Say Maya's tutoring platform has 400 students in a school pilot. The students are aged 12 to 15. The school uploads class lists, teachers set assignments, and parents don't create accounts.

In this case, Maya's documents should explain that:

• the school provides student information so the platform can deliver the service
• teachers control key learning activities and reports
• students shouldn't upload unnecessary personal information
• parents can contact the school or platform about access and correction requests, depending on the issue
• sensitive information, such as learning support needs, is only collected where needed for the service

You should also keep an eye on law reform. The Privacy and Other Legislation Amendment Act 2024 introduced a pathway for a Children's Online Privacy Code. The details will be set through the regulatory process, but if your online service is likely to be accessed by children, privacy expectations are moving toward clearer notices, safer defaults and less unnecessary data collection.

What Should Your Education Platform Privacy Policy Include?

Your education platform privacy policy should explain the full data journey in plain English, from collection to deletion.

A generic website privacy policy often misses the education-specific details schools care about. Your document should be tailored to how your platform actually works, especially if you handle children, learning records, classroom content or school-managed accounts.

Here is a practical outline you can use when briefing your lawyer. It isn't a finished legal document, and it should be tailored before you publish it.

1. Who You Are: State your legal business name, trading name, ABN or ACN, and contact details.
2. Who The Policy Covers: Explain whether it applies to students, parents, teachers, school administrators, website visitors and trial users.
3. What You Collect: List the categories of personal information, including student records, account data, learning data, support requests and technical data.
4. How You Collect It: Cover direct sign-ups, school uploads, integrations, cookies, analytics tools and customer support channels.
5. Why You Collect It: Link each purpose to the service, such as account setup, lesson delivery, reporting, billing, security, support and product improvement.
6. Who You Share It With: Name the types of recipients, such as hosting providers, payment processors, analytics providers, schools and support tools.
7. Overseas Disclosure And Storage: State whether data is stored or accessed overseas, and where you can reasonably identify the countries.
8. Security Measures: Summarise access controls, encryption, backups, staff access limits and incident response processes.
9. Access, Correction And Deletion: Explain how users, parents or schools can request access, correction or deletion, and when you may need to verify identity.
10. Complaints And Contact: Give a clear privacy contact and explain how complaints are handled, including escalation to the Office of the Australian Information Commissioner where relevant.

From 10 December 2026, APP privacy policies will also need to include information about certain substantially automated decisions that could significantly affect an individual's rights or interests. If your platform uses automated profiling, risk flags or AI-driven recommendations in a way that affects students, start preparing for that now.

What Should You Say About Overseas Storage And Analytics Tools?

You should clearly disclose if personal information is stored, processed or accessed overseas, including through cloud hosting, support teams or analytics tools.

This is a big issue for online learning platform privacy because many edtech products use overseas infrastructure. For example, your hosting provider may store backups in Singapore, your support software may be run from the United States, and your analytics provider may process user behaviour data in multiple countries.

Under APP 8, if you disclose personal information overseas, you generally need to take reasonable steps to make sure the overseas recipient doesn't breach the APPs. In some cases, your business can remain accountable for what happens overseas.

Your privacy policy should avoid vague phrases like saying data may be shared with trusted partners without explaining what that means. Instead, be practical and specific where you can.

You might cover:

• whether student data is stored in Australia, overseas or both
• the countries where major service providers are located, if known
• whether overseas providers can access support tickets or user records
• whether analytics tools collect identifiers, behavioural data or device data
• whether cookies, pixels or session replay tools are used on student-facing pages
• how users or schools can manage cookie or marketing preferences

Be especially careful with analytics on pages used by children. If you don't need a tracking tool on a student dashboard, consider removing it or limiting what it collects. Privacy-friendly design can make school onboarding easier and reduce risk before it becomes a contract problem.

What Do Schools Expect Before They Sign With You?

Schools usually expect more than a privacy policy before they trust your platform with student information.

Your privacy policy is the public-facing explanation, but school contracts often require operational detail. You may be asked to provide security information, confirm where data is hosted, agree to deletion timeframes and promise not to use student data for unrelated marketing.

Common school contract expectations include:

• a written services agreement or software as a service agreement
• a data processing or privacy schedule
• clear rules on who owns school data and student content
• limits on using student data for advertising or unrelated product development
• confidentiality obligations for your team and contractors
• security standards, access controls and audit rights
• data return or deletion when the contract ends
• a process for privacy incidents and suspected data breaches

If your platform integrates with school systems, such as learning management systems or identity providers, the school may also ask about API security, user permissions and administrator controls.

This is where templates often fall short. A privacy lawyer for an education platform can help line up your privacy policy, customer contract, school data schedule and internal processes so they don't contradict each other.

For example, your privacy policy shouldn't say you keep student data indefinitely if your school contract promises deletion within 30 days after termination. Those inconsistencies can slow down procurement and make your business look less prepared than it really is.

What Happens If There Is A Privacy Breach?

If there's a privacy breach, you should act quickly, contain the issue, keep records and assess whether notification is required under the Notifiable Data Breaches scheme.

An eligible data breach can happen where personal information is lost, accessed without authorisation or disclosed without authorisation, and serious harm is likely. If the Privacy Act applies to your business, you may need to notify affected individuals and the Office of the Australian Information Commissioner.

If you suspect a breach, work through these steps in order:

1. Contain It: Disable compromised accounts, revoke tokens, pause integrations or take affected systems offline if needed.
2. Preserve Evidence: Keep logs, support tickets, screenshots, emails and technical records.
3. Assess The Risk: Work out what data was involved, who was affected, whether students are involved and whether serious harm is likely.
4. Complete The Assessment Promptly: If you need to assess whether there has been an eligible data breach, the Privacy Act expects this to be done as quickly as practicable and within 30 days if possible.
5. Notify If Required: If the breach is notifiable, prepare clear notices for affected people and the OAIC.
6. Fix The Gap: Reset permissions, patch systems, update processes and review vendor access.

For an edtech business, the practical consequences can be serious. A school may suspend platform access, parents may ask difficult questions, and your team may need to show exactly what happened. A clear breach process helps you respond calmly and protect your relationships.

Key Takeaways

• An education platform privacy policy should be tailored to student, parent, teacher and school data, not copied from a generic website policy.
• The Privacy Act 1988 and Australian Privacy Principles may apply if your turnover is over $3 million, and some smaller businesses are covered too.
• Children's information, learning support notes and health or disability details need extra care.
• Overseas storage, analytics tools, AI features and school integrations should be disclosed clearly.
• Schools often expect a privacy policy, service agreement, data schedule and breach process before they sign.
• A practical, accurate privacy setup can make procurement easier and help your platform grow with confidence.

If you'd like help with your education platform privacy policy, school customer contracts, data handling processes or privacy compliance documents, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.