Last updated:
Victoria has rigorous vendor assessment requirements. Grounded Scribe provides privacy, security, and data-handling evidence to support each school or governing body through its applicable review and approval process.
Regulated by the Office of the Victorian Information Commissioner (OVIC)
Mandatory — Victorian government agencies must notify OVIC of data breaches that are likely to result in serious harm. Schools operating under DET must follow departmental breach notification procedures.
No standalone AI framework — Victoria does not have a standalone AI governance framework for schools. ST4S includes AI criteria, but it does not currently assess AI services that process health and wellbeing data. Schools considering Grounded Scribe should complete their own internal risk assessment and confirm the approvals required by their governing body.
Here's the process your school follows to adopt a new platform in Victoria. We'll support you at every step.
The school or governing body confirms which departmental, sector, and catalogue requirements apply. ST4S does not currently assess AI services that process health and wellbeing data.
The school assesses whether the proposed use is appropriate and safe. We provide evidence about data handling, security controls, AI use, retention, and human oversight.
The reviewing body examines data flows, access controls, overseas processing, retention, incident response, and the safeguards that apply to staff use.
The school or network completes its Privacy Impact Assessment and obtains any departmental, board, principal, or sector approval required for its use case.
After approval, the school deploys the platform with defined access, consent, and governance settings and reviews the arrangement as its use or requirements change.
The school or governing body confirms which departmental, sector, and catalogue requirements apply. ST4S does not currently assess AI services that process health and wellbeing data.
The school assesses whether the proposed use is appropriate and safe. We provide evidence about data handling, security controls, AI use, retention, and human oversight.
The reviewing body examines data flows, access controls, overseas processing, retention, incident response, and the safeguards that apply to staff use.
The school or network completes its Privacy Impact Assessment and obtains any departmental, board, principal, or sector approval required for its use case.
After approval, the school deploys the platform with defined access, consent, and governance settings and reviews the arrangement as its use or requirements change.
A detailed look at how our platform capabilities align with Victoria's privacy and security requirements for schools.
IPP 4 — Data security
Healthcare-grade encryption at rest and in transit. Role-based access controls. 14+ character password requirements.
IPP 2 — Use and disclosure limitations
Data is used solely for documentation purposes within your school. No data shared with third parties for marketing or other purposes.
VPDSS compliance
Platform security controls align with VPDSS requirements for information security, ICT security, and physical security of data.
Data residency in Australia
All data stored on secure Australian cloud infrastructure in Sydney. Schools using manual notes and the student support system keep all data entirely in Australia. If the optional AI Scribe is used, audio is briefly processed overseas for transcription with zero retention, then deleted — only text is stored, in Sydney.
Audio data handling
Audio recordings are deleted immediately after transcription is complete. Only text documentation is retained — raw audio is never stored permanently.
Audit trail for OVIC compliance
Comprehensive audit logging with 7-year retention. All data access is tracked and available for compliance reporting and incident investigation.
AI transparency and oversight
All AI-generated documentation is reviewed and approved by wellbeing staff before becoming part of any record. No AI training on school data.
Staff-only platform (no student access)
Only authorised wellbeing staff access the platform. Students never interact with AI directly, significantly reducing consent requirements.
Different school sectors in Victoria have different procurement processes. Select your sector for specific guidance.
Key body: Department of Education (DET Victoria)
Victorian government schools must follow departmental procurement and Arc catalogue requirements. Because Grounded Scribe is within an ST4S category that is not currently assessed, schools must confirm whether an alternative review and approval pathway is available before procurement.
Common questions from Victoria schools about privacy compliance and using Grounded Scribe.
We'll provide the documentation your school needs to complete the assessment process in Victoria. Request a compliance pack and we'll be in touch.