The governance and management policy required by regulation 168(2)(l) must include confidentiality of records, which is governed by regulations 181 to 183: information in a record may only be disclosed in five listed circumstances (penalty $6,600), records are stored securely for the periods in regulation 183, and parents may access their child’s records on request subject to court orders and the written consent of other people named in them (r 177(3) to (4C)). Around that core the policy carries the service’s legal housekeeping: the notifications to the regulatory authority in sections 173 and 174 (7 or 14 days, 24 hours for serious matters), the display required by section 172 and regulation 173, keeping the Law and Regulations accessible (r 185), the $10 million public liability condition (r 29, evidence kept under r 180), and the record of the service’s compliance (r 167).
This page sets out the provisions a governance policy must comply with, a contents checklist, and what officers look for under Standard 7.1.
Regulation 168 does not publish model policies. It names the matter the policy must cover and the operational regulations the procedures must comply with. This page reproduces those regulations from the reprint current as at 12 August 2026 and turns them into a contents checklist. Write the policy for your service, in your words, against this list. The regulation 168 hub covers the full set and regulations 169 to 172 on following, keeping available and changing policies.
168(2)(l) governance and management of the service, including confidentiality of records.
| Provision | What it requires | Penalty |
|---|---|---|
| r 181 | Information kept in a record under the Regulations may not be disclosed except: to the extent necessary for the child’s education and care or medical treatment; to a parent under r 177 (not staff records); to the regulatory authority or an authorised officer; as authorised or required by law; or with the written consent of the person who provided it. | $6,600 |
| r 182 | The same rule for records kept by a family day care educator, with disclosure to the provider or nominated supervisor added. | $6,600 |
| r 183 | Records in r 177 are stored safely and securely for the periods set: until the child is 25 for incident, injury, trauma or illness records; 7 years after a death; 3 years after the child last attended for other child records; 3 years after the provider, nominated supervisor or staff member left for their records; 3 years from making for anything else. | $6,600 |
| r 177(2)–(4C), s 175 Law | The prescribed documents must be accurate, available to a parent on request (except where a court order limits access), and personal information about other listed people in them released only with their written consent; the compliance record must be accessible to any person on request. | r 177: $6,600; s 175: $13,500 / $68,700 |
| r 184 | On transfer of a service approval the outgoing provider transfers the records of currently enrolled children, with a parent’s consent for each child. | Transfer |
| r 185 | A copy of the Law and the Regulations accessible at the premises at all times for staff, volunteers, parents and prospective users. | $3,300 |
| s 172 Law, r 173 | Display at the main entrance: provider and service approval details and conditions, each nominated supervisor, the rating certificate, waivers, hours, complaints contact, responsible person, educational leader, regulatory authority contact, anaphylaxis and infectious disease notices. | $10,200 / $51,600 |
| s 173 Law, r 174 | Notify the regulatory authority of the matters in s 173 (changes to the provider, the service, nominated supervisors): 14 days for s 173(4) matters, 7 days otherwise, 14 days before a change of principal office. | s 173 penalties |
| s 174 Law, r 175, r 176 | Notify serious incidents and complaints alleging a serious incident or contravention within 24 hours; changes to hours, ages or nature of care, incidents requiring closure, circumstances posing a risk, and regular transport starting or stopping within 7 days; abuse incidents and allegations within 24 hours. | $13,500 / $68,700 |
| r 167 | Keep a record of the service’s compliance: amendments of the service approval, suspensions, and compliance directions and notices, with reasons and dates, excluding information identifying anyone but the provider. | Record; accessible on request (r 177(3)(b)) |
| r 29, r 180 | Service approval condition: public liability insurance with minimum cover of $10,000,000 (or a state indemnity); evidence of current insurance kept at the premises or principal office and available for inspection. | Condition of approval |
| r 170, r 171, r 172 | Policies followed; accessible to staff and available for inspection; 14 days’ notice to families of significant policy changes and of any change to fees or how they are collected. | $3,300 each |
| s 162, r 150 | A responsible person present at all times, recorded. | $17,100 / $86,100 |
Governance is assessed under Standard 7.1: Element 7.1.1 (philosophy and purpose), 7.1.2 (management systems) and 7.1.3 (roles and responsibilities). Officers check the display, ask for the compliance record, test the confidentiality rules with a scenario (a separated parent asks for the incident record that names the other parent), look at the notification log against incidents in the record, and check the policy review dates. The reprint of the Law and Regulations required by regulation 185 is one of the first things they ask to see.
Regulation 181 allows disclosure only to the extent necessary for the child’s education, care or medical treatment; to a parent under regulation 177; to the regulatory authority or an authorised officer; as authorised or required by law; or with the written consent of the person who provided the information. Penalty for other disclosure: $6,600.
Yes. Regulation 177(3)(a) requires the prescribed documents relating to a child to be made available to a parent on request, except where a court order limits that parent’s access (r 177(4)). Before releasing personal information about another parent, an emergency contact, a nominee or an authorising person, the provider must obtain that person’s written consent (r 177(4A)), which can be withdrawn before disclosure (r 177(4C)).
Regulation 29 makes every service approval subject to a condition that the provider holds public liability insurance with a minimum cover of $10,000,000, or a state or territory government indemnity. Regulation 180 requires evidence of the current policy to be kept at the premises (or the principal office for family day care) and available for inspection.
It depends on the matter. Serious incidents and complaints alleging a serious incident or a contravention: 24 hours (r 176(2)). Abuse incidents and allegations: 24 hours. Changes to hours, ages or nature of care, closures and risks: 7 days (r 176(2)(c)). Section 173 matters about the provider, service or nominated supervisors: 14 days for s 173(4) matters, 7 days otherwise, and 14 days before a change of principal office (r 174).
Yes. Regulation 185 requires a copy of the Law and the Regulations to be accessible at the premises at all times for nominated supervisors, staff, volunteers, parents and prospective users. Penalty $3,300. A current electronic copy that staff and families can open on request satisfies most regulatory authorities; check with yours.
WIDEN Law answers National Quality Framework questions with inline citations to the National Law, the Regulations and the NQS, so you can check the source provision yourself.
14-day free trial, no card →This page is a research summary, not legal or compliance advice. Element and regulation wording is reproduced from the current reprint of the National Regulations; confirm the position with your regulatory authority before relying on it for a compliance decision.