Childcare digital technologies policy: images, CCTV and the personal device rules

Last reviewed: 29 October 2026. Checked against the Education and Care Services National Regulations, reprint current as at 12 August 2026.

This is the policy most services had to write from scratch in 2026. This page sets out Part 6A section by section, the five content areas of regulation 168(2)(ha), how CCTV and the Surveillance Devices Act exception work, what the authorisation record must contain, and a contents checklist.

What regulation 168 requires

Part 6A of the National Law: devices in education and care services

Provision	What it requires	Penalty
s 175A	Definitions. Personal device: a device owned or controlled by a person that can capture an image, or store or transmit one, other than a service-supplied or service-authorised device. The examples given are a phone, tablet, camera or smartwatch, and a USB drive, memory card or hard drive. Capture includes film, record or take an image.	Definition
s 175B	A provider may supply a device to be used exclusively for providing education and care, configured to operate in accordance with the service’s child safety and device security policies.	Enabling
s 175C	A family day care provider may authorise a device (the educator’s own) for the same purpose, configured the same way.	Enabling
s 175D	The provider and the nominated supervisor of a centre-based service must take every reasonable precaution to ensure staff and volunteers do not use a device to capture, store or transmit an image of a child unless it is a service-supplied device.	Provider: $6,600 individual, $34,200 otherwise; nominated supervisor: $6,600
s 175E	The family day care equivalent: service-supplied or service-authorised device.	As above
s 175F	The individual offences: a provider, nominated supervisor, staff member or volunteer must not capture, store or transmit an image of a child in care except on a service-supplied (or in FDC service-authorised) device for the purposes of, or in connection with, providing education and care. Does not apply to an optical surveillance device within the meaning of the Surveillance Devices Act 2004 (Cth) installed at the premises and authorised by the provider for security purposes.	$6,600 each
s 175G	Working directly with children for this Division: physically present with a child and employed, engaged or appointed to provide education and care at that time. A person on a short break in accordance with their employment is not working directly with children.	Definition
s 175H	The provider and nominated supervisor of a centre-based service must take every reasonable precaution to ensure that nominated supervisors, staff and volunteers do not have a personal device in their possession or under their control while working directly with children.	Provider: $6,600 / $34,200; nominated supervisor: $6,600
s 175I	The individual offences for a nominated supervisor, staff member or volunteer having a personal device while working directly with children.	$6,600
s 175H(3), s 175I(2), (4)…	Exceptions: a written s 175J authorisation; an excursion or service transport where the device is necessary for safety or education and care; or where an authorisation is not practicable and a reasonable person would consider the device necessary for the person’s disability or health needs, communicating with a family member, safety or care if a service-supplied device fails, an emergency, or work health and safety; or prescribed circumstances.	Exceptions
s 175J, r 179A, r 179B	A provider may authorise a person in writing to have a personal device while working directly with children for the disability or health, family communication, device failure, emergency or WHS purposes. The record must contain: the authorised person’s name and role, the provider’s name, the name of the person making the record, a description of the device, the purpose, and the period. Kept for 3 years.	Record

Family day care is treated differently throughout: the personal device offences in sections 175H and 175I apply to services other than family day care, because the educator’s own device is often the service device, and section 175C exists to authorise it. Family day care educators remain bound by section 175F to capture images only on a service-supplied or service-authorised device.

What the policy must contain

1. Images and videos (168(2)(ha)(i)). Which devices are service-supplied under section 175B and how they are configured (no personal cloud accounts, no messaging apps, passcode, remote wipe); who may take images and for what educational or documentation purpose; where images are stored and for how long; how they are destroyed when a child leaves or the purpose ends; and the rule that no image ever moves to a personal device, which is the section 175F offence.
2. Parent authorisation (168(2)(ha)(ii)). A written authorisation at enrolment, separated into purposes a parent can accept or decline individually: documentation in the child’s learning record, display inside the service, sharing with other families through the service’s platform, use on the service’s website or social media, and use by external people such as students or photographers. How a refusal is flagged to every educator, and how a parent withdraws authorisation.
3. Optical surveillance devices and CCTV (168(2)(ha)(iii)). Whether the service uses CCTV, where cameras are and are not (never in toilets or nappy change areas), the security purpose for which the provider has authorised it (which is what brings it within the section 175F(9) exception), who can view footage, retention, how footage is released to a parent or the regulatory authority, and compliance with the state surveillance devices law and, where the provider is covered, the Privacy Act 1988 and its notice requirements. Audio recording is separately and more tightly regulated in every state and most policies exclude it.
4. Service-issued devices (168(2)(ha)(iv)). The register of devices, who is issued one, acceptable use, security, loss or theft procedure, and the configuration requirement in section 175B(2).
5. Children’s use of devices (168(2)(ha)(v)). Whether and how children use tablets or computers in the program, screen time limits by age (the Australian 24-Hour Movement Guidelines are the usual reference), supervision, content filtering, and children’s own devices in school-age care.
6. Personal devices of staff. The section 175H and 175I rule restated: no phone, smartwatch or camera on the person while working directly with children; where devices are kept; the short break exclusion in section 175G(2); the excursion and transport exception; and the section 175J authorisation process with the regulation 179A record, including who approves it, how long it lasts, and the review.
7. Online environments. The service’s communication platform and social media: what is posted, who posts, no identifying children beyond what parents have authorised, and staff social media conduct about the service, children and families.
8. Breaches. How a breach is handled, when it is a reportable conduct or regulation 175(2) matter, and the note that section 166A(9) treats filming a child as conduct toward the child.
9. Family day care. The section 175C authorisation of the educator’s device, its configuration, and how the provider monitors it.

What assessors look for

Devices are assessed under Element 7.1.2 (management systems, child safe), Element 2.2.3 (child safety and protection) and Element 4.2.2 (professional standards). Officers look at what educators have in their pockets and on their wrists, ask where phones are kept and how a parent reaches a staff member in an emergency, check the service devices for personal accounts, ask for the parent authorisations and the device register, and look at the CCTV placement and the signage. They ask to see any section 175J authorisations and the regulation 179A record.

Common gaps

• Smartwatches overlooked because the policy says “phones”.
• A single blanket photo consent at enrolment with no option to decline social media use.
• Service tablets logged into an educator’s personal cloud account, so images sync off the device.
• CCTV installed without a stated security purpose, which is what the section 175F(9) exception turns on.
• Verbal permission for an educator with a medical need to carry a phone, with no section 175J written record.

Frequently asked questions

This page is a research summary, not legal or compliance advice. Element and regulation wording is reproduced from the current reprint of the National Regulations; confirm the position with your regulatory authority before relying on it for a compliance decision.