Whether you run a dance school, tutoring business, sports club or childcare service, you’re likely collecting children’s personal information.
This could include names, dates of birth, photographs, medical or allergy information, emergency contacts, and parents’ or guardians’ contact details.
Add photographs, videos, attendance records, behavioural information and email communications, and your business starts holding a significant amount of information about a child.
The legal obligations that apply to your business will depend on factors such as your turnover, industry and the type of personal information you collect. And now parents increasingly expect businesses to explain what personal information they collect about children, why they need it and how they protect it.
Does the Privacy Act apply to your business?
For small businesses, the Privacy Act can be a minefield.
Many small businesses are exempt from the Privacy Act, but there are important exceptions. Some health service providers, businesses that trade in personal information and certain other organisations can still be covered regardless of turnover.
So, you should not automatically assume that being a small business puts your business outside the Privacy Act. Even where an exemption applies, poor handling of children’s personal information can still create commercial and reputational risks.
For larger businesses, organisations with an annual turnover above $3 million are covered by the Privacy Act 1988 (Cth) as well as the Australian Privacy Principles (APPs). Discover more about APPs in our business guide.
In some cases, schools, government agencies, franchises, funding bodies or commercial partners may require certain privacy standards even where the Privacy Act does not apply. While the obligation may not arise directly under privacy legislation, it may be imposed contractually through head agreements, procurement requirements, funding conditions or industry standards set by an overarching body.
What information about children are you collecting?
Start by looking at the information your business collects.
For a service-based business, like gym classes, educational programs, child-care centres, swim schools or recreational programs, this could include:
- names, addresses and dates of birth;
- parent or guardian details;
- emergency contacts;
- medical conditions, allergies and medication information;
- attendance records;
- behavioural or learning information;
- photographs and videos;
- payment and billing information; and
- emails, messages and other communications relating to the child.
If your business is covered by the Privacy Act, you should only collect personal information that is reasonably necessary for your business’s functions or activities.
For example, a swimming school may reasonably need a child’s name, age, emergency contact details and relevant medical information to safely provide swimming lessons. However, it should not collect additional personal information that has no clear purpose or connection to the service being provided.
Additionally, sensitive information, including health information, has additional requirements that might need to be considered as well. This is discussed further below.
Start with the data flow. Consider what data comes in, where it goes, who receives it, why it is needed and how long it is really kept. Our article on Privacy by Design for SMEs explains how businesses can build privacy into their systems and processes from the outset.
Remember: Collecting information simply because it “might be” useful one day can create unnecessary privacy and security risks.
Does collecting medical or allergy information change our obligations?
Possibly. Information about a child’s health, medical conditions, allergies or disabilities can be health information and therefore “sensitive information” under the Privacy Act.
Sensitive information receives a higher level of protection than other personal information.
However, collecting allergy information does not automatically mean that every dance school, sports club or tutoring business becomes a health service provider. Whether your activities bring your business within the Privacy Act requires a closer look at what services you provide and how you handle health information.
For businesses covered by the Privacy Act, the collection of sensitive information will generally require consent and must be reasonably necessary for the organisation’s functions or activities, unless an exception applies.
This is an area where assumptions can be risky. If you are unsure about your obligations, speak with our experienced lawyers at Prosper Law. We can review how your business collects and handles children’s information and provide practical advice on the legal requirements that apply to you.
When can a child give their own consent?
There is no single age under the Privacy Act at which a child automatically becomes capable of making their own privacy decisions.
Instead, capacity generally depends on whether the child has sufficient maturity and understanding to understand what is being proposed.
Where assessing each child individually is not practical, the Office of the Australian Information Commissioner (OAIC) states an organisation may generally presume a person aged 15 or over has capacity to consent, unless there is something suggesting otherwise.
A person under 15 is generally presumed not to have capacity to consent and therefore, will commonly mean dealing with a parent or guardian.
That does not mean simply adding “parental consent required under 15” to a privacy policy solves the issue. Where consent is required, it should be informed, voluntary, current and specific. For example, a tutoring business may collect emergency contact details from a parent as part of the enrolment process. An online educational platform allowing children to create accounts may face more complex questions around age verification and consent.
Your consent processes should therefore reflect the age of the children you work with, the type of information you are collecting and what you intend to do with it.
Taking photographs and videos of children
For many children’s service businesses, photographs and videos are part of everyday operations and often shared on websites, social media and other publications.
A dance school might photograph an end-of-year concert. A sporting club may record a competition victory. An activity provider might take photographs during a holiday program.
Where a child can be identified from an image or video, the image may constitute personal information under the Privacy Act.
Businesses should therefore think separately about:
- Taking the photograph or video: Why is it being taken, where will it be stored and who will have access to it?
- Using or publishing it: Will it appear on your website, Instagram, Facebook, advertising, brochures, newsletters or other promotional material?
Consent to participate in an activity should not simply be treated as unlimited permission to use a child’s image for any purpose indefinitely.
For example, a parent may be comfortable with their child being photographed for a private end-of-year album but not comfortable with the same image being used in a paid social media advertisement.
A clear photo and video consent process can help businesses establish exactly what has been agreed to and avoid misunderstandings later. If you are unsure whether your current consent process is sufficient, our Brisbane privacy lawyers help you draft clear photo and video consent forms that reflect how your business uses children’s images, so you meet your legal obligations and protect your reputation.
Can staff use their personal phones to photograph children?
This is an important operational question that should be addressed in your internal policies.
If staff members use personal phones to photograph or record children, consider what happens to those files afterwards.
- Are they automatically backed up to the employee’s personal cloud account?
- Are they deleted from the device after being transferred?
- Could other people who use that device access them?
- What happens if the staff member leaves the business?
Your business should have clear procedures covering how staff capture, transfer, store, use and delete photographs and videos of children.
A note for childcare and early education services: from February 2026, specific restrictions apply to personal digital devices in regulated education and care services, including requirements around the use of service-supplied devices for images of children. If you are unsure how these requirements apply to your service or what changes you may need to make, contact us for practical legal guidance.
What if a parent withdraws consent or a child leaves?
Businesses should also have a process for dealing with requests to withdraw consent, access information or delete records. The appropriate response will depend on why the information was collected and whether there is a legal, operational or safety reason for retaining it.
When a child leaves an organisation, businesses should review whether the information is still needed and whether any photographs, marketing content or archived records should be removed or retained.
Does your privacy policy reflect what you do?
A privacy policy should not be a generic document that was added to your website several years ago and forgotten.
Your actual practice should match what the policy says.
For example, if your privacy policy says information is only used to administer enrolments, but your business also uses children’s photographs for marketing, stores information with third-party providers or communicates through external messaging platforms, your privacy documentation and practices may need reviewing.
Staff training on privacy
Your privacy policy is only one part of protecting children’s personal information.
Staff should understand practical issues such as:
- what information they are permitted to collect;
- where information should be saved;
- who is allowed to access it;
- whether personal devices can be used;
- how photographs and videos should be handled;
- what to do if a parent withdraws consent; and
- who to contact if information is lost, incorrectly disclosed or compromised.
Simple internal procedures and regular staff training can prevent everyday mistakes from becoming larger privacy problems.
Does the Children's Online Privacy Code apply to my business?
For many traditional service-based businesses, the proposed Children’s Online Privacy Code will likely not be the main privacy issue.
The Children’s Online Privacy Code is being developed to provide stronger privacy protections for children when they use certain online services, such as apps, online games or online tutorial services.
The final Code is due to be registered by 10 December 2026.
Want to know more about the Children’s Online Privacy Code? Read our separate guide on what the proposed Code may mean for online businesses and services here.
Privacy Tips for Small Businesses
Even if your business is exempt from the Privacy Act, you should still:
- collect only information you genuinely need;
- explain why you are collecting it;
- restrict access to staff who need it;
- securely store children’s records;
- delete information when it is no longer required; and
- review third-party software providers that handle children’s data.
These practices help build trust with parents and reduce the risk of privacy complaints or data breaches. The goal is to make sure your business can explain (and justify) what it does with children’s data.
For some businesses, the Privacy Act and the Children’s Online Privacy Code will impose specific legal obligations. For others, strong privacy practices may simply be part of running a professional and trustworthy business.
Either way, now is a good time to review your privacy documents and data-handling practices. Reach out to Prosper Law’s data and privacy lawyers to find out more.
Frequently asked questions
What if the Privacy Act or Code does not apply to my business?
Being exempt from the Privacy Act does not mean privacy risks disappear. Parents or guardians may still complain if information is mishandled. Schools, insurers, government agencies and commercial partners may also expect appropriate privacy standards.
Good privacy practices can improve trust and reduce the impact of data breaches, regardless of legal obligations.
What is the biggest privacy mistake businesses make with children’s data?
Treating privacy as merely a document issue rather than a business process. A well-drafted privacy policy on your website will not actually fix unnecessary collection, excessive retention or inappropriate sharing of someone’s data.
How long should my business keep children’s information?
There is currently no single retention period. As a general guide, businesses should keep information only for as long as there is a genuine legal or operational reason to do so.
What if a third-party platform collects the information for us?
You should still understand what is collected, where it is stored, who receives it and whether it is used for other purposes.
If you need help reviewing your privacy practices or updating your privacy documents, contact Prosper Law to discuss what applies to your business.
When should I update my privacy policy?
Before updating your privacy policy, map what your business actually collects. We often see businesses remembering what appears on an enrolment form, but then overlooking photos in shared drives, allergy information in spreadsheets, messages through third party platforms, or data automatically collected by websites and apps.
Your privacy policy, collection notices, consent wording, forms, app settings and internal practices should all line up. It is important to remember that a generic privacy policy, or one generated using artificial intelligence, may not reflect how your business actually handles personal information.
Reach out to Prosper Law’s Privacy and Data lawyers to chat through your requirements.
About the Author
Farrah Motley
Contact an Australian Business Lawyer Today.
Contact us for a free consultation
