Privacy impact assessments

What this register is

Kestrel stores the records of school students, and children use parts of it. Seraco Pty Ltd, which provides Kestrel, is bound by the OAIC's Children's Online Privacy Code, made under the Privacy Act 1988. The Code asks for a privacy impact assessment before a service or a change that affects children's privacy, and for a published register of those assessments. This page is that register.

When Seraco makes an assessment

Seraco has assessed Kestrel as it stands, and assesses the privacy impact on children of each of these before it is released:

s38(1)(a)

A new service or activity that children are likely to use, or that is primarily concerned with their activities.

s38(1)(b)

A new or changed way of handling personal information in an existing service that is likely to have a significant impact on children's privacy.

Planning a change to Kestrel asks whether it needs an assessment, and a change that needs one is released with its assessment on this register.

What each assessment covers

Each assessment answers the six things section 38(2) of the Code asks for.

(a) Nature, scope, context, flows and purposes

What the service does, whose information it handles, who uses it, where the information comes from and goes, and what each part of it is for.

(b) Why the handling is strictly necessary

Why each class of information about a child is needed to provide the service, and what is deliberately left uncollected.

(c) Lawful and fair means

How the information is collected, from whom, and what the person is told.

(d) The best interests of the child

Whether the handling is consistent with the best interests of the child, and the reasoning the finding rests on.

(e) Compliance with the Code and the Act

How the service meets the Children's Online Privacy Code and the Australian Privacy Principles.

(f) Risk of harm to children

What could go wrong for a child, how likely and how serious it is, and what reduces it.

The risks of harm it weighs include physical, emotional, developmental and material harm to a child.

The register

PIA-018: A student's own requests in the portal

A student opening the Forms and requests section of the student portal: the forms they have sent with where each stands and the approver's note on a decline, the forms the school offers to students, and sending one, which collects the answers the school's form asks for from the student's own account. It covers what stays out of the section: a form about any other person, a form the school keeps for families or staff, a file, and a consent.

Finding The handling of children's information in the portal's Forms and requests section, offered to a student, is consistent with the best interests of the child. A student reads and sends only about themselves, is offered only the forms the school publishes for students, and sends by their own act with nothing prefilled or kept as a draft. A request a student sends about themselves is listed in the family section of the same name, so a parent can read it, and a decline note is shown as the approver wrote it. Those two risks keep a medium residual.

Under s38(1)(b)

Assessed 25 September 2026

By Seraco Pty Ltd

PIA-017: A child's shared wellbeing entries in the portal

A family reader opening a child's Wellbeing section in the portal: the merits and notes the school marked for parents and each sanction of a kind the school tells parents of, with their dates, read through the two parent-visible read models. It covers what stays out of the answer: an entry not marked for parents, a restricted entry, a counselling note, a case, the reason for a sanction and a void's reason.

Finding The handling of children's information in the portal's Wellbeing section is consistent with the best interests of the child. The section reads only the two read models the school publishes for parents, asks the reader's standing on that child before anything is read, drops a voided entry and its reason, and is offered to families alone. A teacher's note marked for parents is shown as written, and that risk keeps a medium residual.

Under s38(1)(b)

Assessed 24 September 2026

By Seraco Pty Ltd

PIA-016: Reports, dashboards, overnight findings and the warehouse export

The reporting layer as built: the library of standard reports a staff member runs at their own tier, the role dashboards that run those reports when opened, the overnight findings that tell the office which children need attention with a morning message that names no-one, and the nightly warehouse files a school's own tool fetches with a token through a signed link that stops working after ten minutes. Question answering and webhooks are assessed on their own.

Finding The handling of children's information in the reporting layer is consistent with the best interests of the child. Nothing is collected and no figure about a child is stored. A report runs at the reader's own tier and only for a reader with the owning domain's capability, a finding is a stated rule that a person closes, the morning message names no child, and a warehouse file has only declared columns, none at the restricted tier, and today names no child. A file a school has fetched cannot be recalled, and a later column at the sensitive tier or a name in a file widens what leaves, so those two risks keep a medium residual until a review row on this assessment is a condition of each file that adds one.

Under s38(1)(b)

Assessed 24 September 2026

By Seraco Pty Ltd

PIA-015: A child's released results in the portal

A family and a student reading a child's released results in the portal: each result a teacher has released with its mark or level and its feedback, the outcomes its task assesses, the child's progress against those outcomes worked over the released results alone, the family's standing on the child that decides who reads, the switch that keeps a student's own reading off until the school turns it on, and the results a teacher has not released staying out of the answer and out of each figure.

Finding The handling of children's information in the portal's Results section is consistent with the best interests of the child. Nothing is collected or stored. A family reads only where their standing on the child grants reports, a student reads only their own and only where the school has switched the section on, the release rule the teacher chose decides what is read, progress is worked over the released results alone, and no classmate's result is answered. A copy a family saved before a teacher corrected a result cannot be recalled, and that risk keeps a medium residual.

Under s38(1)(b)

Assessed 24 September 2026

By Seraco Pty Ltd

PIA-014: Absences, sanctions and sick bay visits on a person's timeline

Staff reading a student's absences, sanctions and sick bay visits beside their messages on the person record's Timeline section: the source each of attendance, wellbeing and medical registers, the capability each is read under, the tier each line sits at, the reasons, presentations and treatments that stay sealed in their own layers, and the counselling record staying off the timeline.

Finding The handling of children's information in the timeline sources attendance, wellbeing and medical register is consistent with the best interests of the child. Nothing is collected or stored. A reader is asked only for the sources whose capability they hold and receives no line above their tier, so a reader without medical's capability sees no sign of a visit. A line says a label and a moment and never a reason, a presentation or a treatment, and the counselling record has no source. A reader inferring more from the sequence than any line says cannot be designed out, and that risk keeps a medium residual.

Under s38(1)(b)

Assessed 24 September 2026

By Seraco Pty Ltd

PIA-013: A student chooses subjects in the portal and their family reads the choices

A student ranking the subjects a round offers and sending the whole set from their own portal, the sentence the server gives for each rule a set breaks, the round that takes no choices before it opens or after it closes, a family reading the round and the set that was sent under their standing on the child, the switch that keeps a student's own choosing off until the school turns it on, and the absence of any control for a parent to send.

Finding The handling of children's information in the portal's Subject selection section is consistent with the best interests of the child. Only the student sends their own set and the person written is the signed-in account's own, a family reads only where their standing on the child grants reports and has no control to send, a student reads only their own and only where the school has switched the section on, and a set that breaks a rule saves nothing and shows the reason.

Under s38(1)(b)

Assessed 24 September 2026

By Seraco Pty Ltd

PIA-012: A child due to start on the nurse's worklist

The nurse's action-plan worklist deciding who it is about from enrolment's facts: the children placed at the school today, the children with an accepted place who are due to start inside the next 399 days and the day each of them starts on, the child who is neither leaving both lists, and the nurse working on a declared condition before the child is a student.

Finding The handling of children's information on the nurse's worklist is consistent with the best interests of the child. The change is mostly a narrowing: the worklist is the children the school is responsible for, and a child who withdrew, declined or left is no longer worked on. What it adds is the smallest fact that lets the nurse have a plan, a medication and a briefing ready on a child's first day, that the child is coming and when, read live from enrolment at the reader's own ceiling. A child dropped because the office has not recorded an acceptance keeps a medium residual, and the child's own record shows each declared condition without a filter.

Under s38(1)(b)

Assessed 24 September 2026

By Seraco Pty Ltd

PIA-011: A child's published reports in the portal

A family and a student reading a child's published reports in the portal: the reports the school has sent home under their reporting period, the signed link to each document that stops working after ten minutes, the family's standing on the child that decides who reads, the switch that keeps a student's own reading off until the school turns it on, and the report a school takes back leaving the section at once.

Finding The handling of children's information in the portal's Reports section is consistent with the best interests of the child. Nothing is collected or stored. A family reads only where their standing on the child grants reports, a student reads only their own and only where the school has switched the section on, the answer is the period and a short-lived signed link, with none of the comments as rows, and a report the school takes back is no longer answered. A copy a family saved before a report was taken back cannot be recalled, and that risk keeps a medium residual.

Under s38(1)(b)

Assessed 24 September 2026

By Seraco Pty Ltd

PIA-010: Consent

What a family agrees to about a child: the record of each consent, the purposes a school asks about, the five ways one is given, the twelve-month limit, the withdrawal, the note beside a yes, the rule that only a person with parental responsibility gives a consent about a child, and the staff roles that read and record it. It covers the ask a school raises, who it reaches and the four states each child stands in against it, and the decision that a student does not give their own consent.

Finding The handling of children's information in consent is consistent with the best interests of the child. A consent is a dated fact for one purpose, a consent about a child ends inside twelve months, only a person holding parental responsibility on the day may give it, a family withdraws it whenever it chooses, and the note beside it is sealed. Kestrel records no consent given by a student for themselves.

Under s38(1)(b)

Assessed 24 September 2026

By Seraco Pty Ltd

PIA-009: A child's attendance in the portal

A family reader and a student reading a child's attendance for the term in the portal: the rate, each absence and late arrival with its code and category, and which are still unexplained, from the register the office already keeps.

Finding The handling of children's information in the portal's Attendance section is consistent with the best interests of the child. The section reads the register the school already keeps, answers with the code and no staff note, asks the reader's standing on that child before anything is read, and a student reads their own only where the school switches it on.

Under s38(1)(b)

Assessed 23 September 2026

By Seraco Pty Ltd

PIA-008: Activity selection and allocation

The round a school collects ranked choices in, the choices a family or a student sends on the portal form, the allocation the ranks and the school's tiebreak propose, the places a coordinator confirms, and the standing each family is told.

Finding The handling of children's information in activity selection is consistent with the best interests of the child. A rank sits a tier above the membership it produces, one capability reaches it, the family section asks the reader's standing on that child, and nothing about a choice leaves the school.

Under s38(1)(b)

Assessed 18 September 2026

By Seraco Pty Ltd

PIA-007: Counselling case notes

The counsellor's own record of a student: what a session, a contact, a referral or a safety plan says, the moment of the session, the case it belongs to, the templates a school writes them from, and the two grants that reach them.

Finding The handling of children's information in the counselling record is consistent with the best interests of the child. A note is its own record under its own capability, sealed and reached by the counsellor alone, no pastoral grant reaches it or is told that one exists, nothing about a note leaves the school, and it is kept as health information.

Under s38(1)(b)

Assessed 18 September 2026

By Seraco Pty Ltd

PIA-006: The statutory returns

The framework that checks a statutory return against the record, produces its file, records each run with its checksum and keeps the file sealed as a document, starting with the census counts.

Finding The handling of children's information in the statutory returns is consistent with the best interests of the child. A return is an obligation the school already has, each run needs the passkey again and is recorded, and the file is sealed and disposed of under the return's class.

Under s38(1)(b)

Assessed 18 September 2026

By Andrew Todd, privacy officer, Seraco Pty Ltd

PIA-005: The calendar and its iCal feeds

The calendar on the console and the family portal, read from the dated records each layer keeps, and the feed a member of staff or a parent subscribes to from a calendar application at a secret address, with what it shows and who it resolves as on each fetch.

Finding The handling of children's information in the calendar and its iCal feeds is consistent with the best interests of the child. The calendar stores no entry, a feed shows titles and times and no place or student, the secret is kept only as a hash, and each fetch resolves the reader's standing again, so a feed shows no more than its person reads signed in.

Under s38(1)(b)

Assessed 18 September 2026

By Seraco Pty Ltd

PIA-004: Communication history and timeline

The telephone calls, counter visits, letters and meetings staff log with a family or about a student, the summary each keeps and the tier its author declares, the timeline on the person record that puts them beside what the school sent, the messages to staff that name a student, and the staff roles that read and log them.

Finding The handling of children's information in the communication history and timeline is consistent with the best interests of the child. A logged conversation keeps a short summary in its author's words, sealed and withheld below the tier its author declared, a teacher reads only the conversations about the students they teach, a message to staff about a student is read by the holders of the message capability alone and never by the family, and nothing about a conversation leaves the school.

Under s38(1)(b)

Assessed 17 September 2026

By Seraco Pty Ltd

PIA-003: Activity rosters and scheduling

The seasons a school runs, the teams, ensembles and clubs in each, which students are on each and from when, which adults supervise each on a current working with children check, and the events each schedules.

Finding The handling of children's information in activity rosters and scheduling is consistent with the best interests of the child. The rosters record who is on each activity and from when with no rating or note, no adult is assigned without a current check, and nothing about a named child leaves the school but a message staff write to the families on a roster.

Under s38(1)(a)

Assessed 17 September 2026

By Seraco Pty Ltd

PIA-002: The NCCD register

The register a school keeps for the Nationally Consistent Collection of Data on School Students with Disability: each student's level of adjustment and category of disability, why the school decided it, the evidence and the consultations behind it, the staff roles that reach it, and the annual review reminder.

Finding The handling of children's information in the NCCD register is consistent with the best interests of the child. The register contains what the collection asks for and no diagnosis, seals the reasons, reaches only the staff who keep it, and names no child in anything it sends.

Under s38(1)(b)

Assessed 17 September 2026

By Seraco Pty Ltd

PIA-001: Kestrel as built

The whole service as it stands on 16 September 2026: the staff console, the family portal, the office kiosk, a school's public forms, the API and the LISS server, the immunisation register, the scheduled jobs, messaging, imports, retention and disposal, and each class of record a school keeps about a child.

Finding The handling of children's information in Kestrel is consistent with the best interests of the child. Each class of information serves the child's safety, education or wellbeing, or a record the law requires the school to keep, and none is used for advertising, profiling, analytics or the training of a model.

Under s38(1)(a)

Assessed 16 September 2026

By Andrew Todd, privacy officer, Seraco Pty Ltd

Reading an assessment

Seraco gives the Information Commissioner a copy of this register and of each assessment on it when the Commissioner asks. A school, or someone assessing Kestrel for one, can ask for a copy of an assessment by writing to privacy@seraco.io.