7 min read · Updated 2026-10-18
In short
A tutoring centre with annual turnover above $3 million must follow the Privacy Act's 13 Australian Privacy Principles, and a smaller centre may be covered too, for example if it holds health information about students. Covered centres must notify families and the OAIC of a data breach likely to cause serious harm, and need a clear privacy policy. Even an exempt centre should handle children's information as if the Act applied.
General information, not legal advice. Laws and the regulators' rules change: check the sources below, and talk to your own adviser about your centre.
A tutor leaves and you realise they still have last year's class list in their personal email. A parent asks what you hold about their son and nobody can say in one place. An admin emails a report card to the wrong family. A tutoring centre holds a great deal about children: names, dates of birth, schools, results, learning needs, allergies, family arrangements and often home addresses. The federal Privacy Act 1988, regulated by the Office of the Australian Information Commissioner (OAIC), sets the rules for many centres. Whether it applies to yours depends first on turnover, then on a few exceptions.
Does the Privacy Act cover your centre?
Most small businesses are not covered. The OAIC defines a small business as one with an annual turnover of $3 million or less, counting all income from all sources but not assets or capital gains. A centre above that line is covered. A centre below it is still covered if it falls into one of the OAIC's listed categories, which include:
- Providing a health service. The OAIC says a private education provider can be caught this way if it keeps records of a child's medical condition or does things such as making sure a child takes prescribed medication or giving first aid. Its small business checklist also names child care centres and private schools as health service providers.
- Trading in personal information, such as selling or buying contact lists.
- Being related to a business the Act covers.
- Having chosen to opt in to the Act.
Many tutoring centres record allergies, medical conditions or learning diagnoses on an enrolment form, so the health service point deserves a careful look. The OAIC has a privacy checklist for small businesses; if you are still unsure, check with your adviser.
The 13 Australian Privacy Principles, in brief
If you are covered, you follow the 13 Australian Privacy Principles (APPs). They govern how you collect, use and disclose personal information, how you govern and secure it, how you keep it accurate, and people's right to see and correct what you hold. The OAIC says a breach of an APP can lead to regulatory action and penalties. For a tutoring centre the practical points are:
- Collect only what you need to teach and care for the student. A field on the enrolment form should earn its place.
- Tell families, at the time you collect it, why you collect it and who you share it with.
- Use information for the purpose you collected it for. Using it for something unrelated, such as marketing a new program, may need consent.
- Keep it secure: staff see what their role needs, accounts are protected, and old records are destroyed when you no longer need them.
- Let a parent see and correct what you hold about their family.
Children's information
The Privacy Act protects a child's information just as it protects an adult's, and it sets no fixed age at which a young person decides for themselves. The OAIC says capacity is judged case by case, by whether the young person understands what is proposed. Where that is not practical, it says an organisation may generally assume someone over 15 has capacity unless unsure.
A Children's Online Privacy Code is coming. The Privacy and Other Legislation Amendment Act 2024 required the OAIC to develop it, the public consultation has closed, and the final Code must be registered by 10 December 2026. As at 18 October 2026 the OAIC lists it as an upcoming code, not a current one. It is aimed at online services likely to be used by children, such as apps, games and websites. Whether it reaches a tutoring centre's own student portal will depend on the final text, so watch the OAIC's page and ask your adviser once it is registered.
When something goes wrong: data breaches
Under the Notifiable Data Breaches scheme, a covered organisation must tell the affected people and the OAIC about an eligible data breach. That is unauthorised access, unauthorised disclosure or loss of personal information that is likely to cause serious harm, where you have not been able to prevent that harm. If you suspect one, the OAIC expects you to assess it quickly.
- Write a one-page breach plan: who decides, who contains it, who assesses harm, who tells families and the OAIC.
- Turn on two-step sign-in for every staff account that can see family records.
- Stop sharing student lists in loose spreadsheets and personal email.
- Keep home addresses and access notes only where the tutor who needs them can see them.
- Keep children's names and details out of public AI tools. See using AI safely.
- Contain it
Stop the access, recall the email, change the password, or lock the lost device.
- Assess it quickly
Is serious harm likely, and can you still prevent it? The OAIC expects a prompt assessment.
- Notify
If it is an eligible data breach, tell the people affected and the OAIC.
- Learn from it
Change what let it happen, and update your one-page breach plan.
What to put in your privacy policy
APP 1 requires a clearly expressed, up-to-date privacy policy, available free of charge. The OAIC's guide lists what it must cover, and it suggests writing for families rather than lawyers:
- The kinds of personal information you collect, with sensitive information such as health details listed separately.
- How you collect it, including anything you receive from someone other than the family.
- How you hold and secure it, including any third-party storage provider you use.
- Why you collect, use and disclose it, for each of your main activities.
- How a family can ask to see or correct their information, with contact details.
- How to complain, and that a complaint can go on to the OAIC.
- Whether information is likely to go overseas, and to which countries.
Software you use counts: if your systems store records with an overseas provider, or send text to an AI service, say so in the policy. Our security page sets out where XTutio stores records.
How XTutio helps
XTutio keeps families, students, lessons and messages in one place, with every record carrying the centre it belongs to and the database enforcing the boundary, so one centre's staff can never read another's families. Staff see what their role allows, and the owner, admins and finance staff must use two-step sign-in. Our security page lists where records are stored and every service that handles them.
Some details get extra care. A family's home notes, such as a gate code or who will be home, are never sent to an AI model, never put in an email or a text and never written to a log. Before anything reaches an AI model, a child's name becomes Student A and contact details are scrubbed. Parents answer photo consent child by child, and staff see the answer on the child's page. More is on our safety page and in the guide to staff roles and two-step sign-in.
Questions centres ask
- Does the Privacy Act apply to a small tutoring business?
- Not usually if annual turnover is $3 million or less, but some small businesses are covered regardless, for example those providing a health service or trading in personal information. Check the OAIC's small business guidance or ask your adviser.
- Do I have to report a data breach involving student records?
- If your centre is covered by the Privacy Act and the breach is likely to cause serious harm that you could not prevent, you must notify the affected people and the OAIC. Assess any suspected breach quickly.
- Is the Children's Online Privacy Code in force yet?
- Not as at 18 October 2026. The OAIC lists it as an upcoming code, and the final Code must be registered by 10 December 2026.
Sources
- Small business, Office of the Australian Information Commissioner. Read 2026-10-18.
- Children and young people, Office of the Australian Information Commissioner. Read 2026-10-17.
- Australian Privacy Principles, Office of the Australian Information Commissioner. Read 2026-10-17.
- About the Notifiable Data Breaches scheme, Office of the Australian Information Commissioner. Read 2026-10-17.
- When to report a data breach, Office of the Australian Information Commissioner. Read 2026-10-17.
- Guide to developing an APP privacy policy, Office of the Australian Information Commissioner. Read 2026-10-17.
- Draft Children's Online Privacy Code (consultation for industry, civil society, academia), Office of the Australian Information Commissioner. Read 2026-10-18.
- Privacy codes, Office of the Australian Information Commissioner. Read 2026-10-18.
