Privacy and Confidentiality Policy

Policy Schedule

Relevant Legislation

• Australian Privacy Principles (Cth)
• Competition and Consumer Act 2010 (Cth) – Schedule 2, Australian Consumer Law
• Education Services for Overseas Students Act 2000 (Cth)
• Education Services for Overseas Students Regulations 2019 (Cth)
• Health Records Act 2001 (Vic)
• Health Records and Information Privacy Act 2002 (NSW)
• Health Records (Privacy and Access) Act 1997 (ACT)
• Information Act 2002 (NT)
• Information Privacy Act 2009 (Qld)
• Information Privacy Act 2014 (ACT)
• Information Privacy Principles Instruction (SA)
• National Code of Practice for Providers of Education and Training to Overseas Students 2018 (Cth)
• National Vocational Education and Training Regulator Act 2011 (Cth)
• Notifiable Data Breaches Scheme – Part IIIC of the Privacy Act 1988 (Cth)
• Personal Information Protection Act 2004 (Tas)
• Privacy Act 1988 (Cth)
• Privacy and Data Protection Act 2014 (Vic)
• Privacy and Personal Information Protection Act 1998 (NSW)
• Privacy and Responsible Information Sharing Act 2024 (WA)
• Privacy and Responsible Information Sharing (Privacy) Regulations 2025 (WA)
• Standards for Registered Training Organisations 2025 (Cth)
• Student Identifiers Act 2014 (Cth)
• Student Identifiers Regulation 2014 (Cth)

1. Purpose

The purpose of this policy is to outline how Thrive Training and Education collects, uses, stores, and discloses personal information.

It ensures that all personal and sensitive information is managed in accordance with the Privacy Act 1988, the Australian Privacy Principles (APPs), and the Standards for RTOs 2025, including Clause 2.1, which requires ongoing compliance with all standards across all operations. This policy also outlines the use of Non-Disclosure Agreements (NDAs) as a mechanism to reinforce confidentiality obligations for staff, contractors, and third-party providers.

2. Scope

This policy applies to all staff, students, contractors, and third-party providers who access, manage, or process personal information on behalf of Thrive Training and Education. It covers all personal data collected through enrolment, training, assessment, administration, and support services.

3. Policy Statement

Thrive Training and Education is committed to protecting the privacy and confidentiality of all individuals. Personal information is collected and accessed only when necessary for the delivery of training and assessment services, compliance with regulatory obligations, and the effective operation of the RTO. All information is handled with integrity and in accordance with relevant legislation and regulatory requirements.

4. Collection of Personal Information

Thrive Training and Education collects personal information directly from individuals through enrolment forms, online systems, recruitment processes, and other communications. This may include names, contact details, date of birth, USI, academic history, and other relevant data.

Sensitive information, such as health or disability details, is collected only with consent and when necessary to provide appropriate support. Thrive Training and Education provides clear explanations at the point of data collection regarding why information is being collected, how it will be used, and who it may be shared with. This supports informed consent and transparency.

5. Use and Disclosure

Personal information is used solely for the purposes for which it was collected, including enrolment, training delivery, certification, and regulatory reporting. Thrive Training and Education may disclose information to government agencies such as ATO, ASQA, NCVER, and the Department of Education as required by law. Information is not shared with third parties without consent unless legally required.

Personal information must not be used or disclosed for secondary purposes unless authorised by law, required to prevent a serious threat, or with the individual’s consent. Where automated systems or artificial intelligence tools are used to process personal information, Thrive Training and Education will ensure that only approved systems are used, information is minimised, contractual privacy protections apply, and no personal information is entered into publicly accessible AI services unless authorised.

6. Data Security

Thrive Training and Education takes all reasonable steps to protect personal information from misuse, loss, unauthorised access, modification, or disclosure. This includes the use of passwords and multi-factor authentication of electronic systems.

Electronic records are stored in secure systems with restricted access, and physical records are kept in locked storage. When no longer required, personal information is securely destroyed or de-identified in accordance with ASQA’s Records Management Policy.

Thrive Training and Education uses Cloud Assess as its secure learner management system to store and manage student records and personal information. Cloud Assess is hosted on encrypted servers with multi-factor authentication and role-based access controls, ensuring that only authorised personnel can access sensitive data. The platform supports secure data backups, audit trails, and automated retention policies, helping Thrive Training and Education meet its obligations under the Australian Privacy Principles and ASQA’s Records Management guidelines. Staff are trained in secure data handling practices, including recognising and responding to data breaches. Thrive maintains a Data Breach Response Plan in accordance with OAIC guidelines.

Thrive Training and Education has a Data Breach Response Plan which covers the procedures that shall take effect in the event of a data breach.

Thrive Training and Education will assess every actual or suspected data breach promptly. Where an eligible data breach is identified, the organisation will comply with the Notifiable Data Breaches Scheme by notifying affected individuals and the Office of the Australian Information Commissioner as soon as practicable. Security controls include phishing awareness, secure remote working, encryption of portable devices, access logging and periodic review of privileged access.

Privacy by Design principles will be applied when introducing new systems, technologies or third-party providers. Only the minimum personal information reasonably necessary for each purpose will be collected, used and retained.

7. Access and Correction

Individuals have the right to access their personal information and request corrections if the data is inaccurate, incomplete, or outdated. Requests must be made in writing and will be responded to within 30 days. No fees are charged for access or correction requests.

Cloud Assess enables students to securely access their own personal information through their student portal. Requests for data correction can be submitted directly within the system, and staff are automatically notified to review and action these requests promptly. This functionality supports Thrive Training and Education’s commitment to transparency and ensures compliance with individuals’ rights under the Privacy Act 1988.

8. Complaints

Complaints about privacy breaches can be submitted in writing to the Director of Thrive Training and Education. All complaints are handled confidentially and resolved within 30 days. If the complainant is not satisfied with the outcome, they may escalate the matter to the Office of the Australian Information Commissioner (OAIC).

Related Policy: 3.4 Complaints and Appeals Policy.

9. Non-Disclosure Agreements

Thrive Training is committed to maintaining the confidentiality and integrity of its operations, intellectual property, and stakeholder information. NDAs ensure that sensitive data is protected and only used for authorised purposes. All relevant parties must sign an NDA before accessing confidential information, and the organisation will enforce this policy consistently and in accordance with applicable laws and standards.

9.1 Definition of Confidential Information

Confidential information includes, but is not limited to:

• Business strategies and plans.
• Financial data.
• Student records and personal information.
• Training content, resources and intellectual property.
• Internal communications and operational procedures.

9.2 NDA Requirements

Employees must sign an NDA as part of their contract of employment. Contractors, partners, and third parties must sign an NDA before commencing any work or collaboration. Students who may access confidential information (e.g., during work placements or projects) must also sign an NDA.

NDAs must include:

• Identification of parties.
• Definition of confidential information.
• Obligations of the receiving party.
• Exclusions from confidentiality.
• Duration of confidentiality.
• Consequences of breach.
• Governing law.

9.3 Storage and Review

All signed NDAs must be securely stored in Thrive Training and Education’s document management system, MS Teams. NDAs will be reviewed annually and renewed as necessary to ensure ongoing compliance.

9.4 Compliance and Enforcement

Failure to comply with this policy may result in:

• Disciplinary action, including termination of employment or contracts.
• Legal action for breach of confidentiality.
• Revocation of access to confidential information.

10. Responsibilities

All staff, upon commencement, are required to sign to confirm that they have received a copy of and understand the content of this policy. All staff are committed to and implement their responsibilities under the Australian Privacy Principles.

All staff are required to complete privacy training and adhere to this policy. Breaches of privacy or confidentiality may result in disciplinary action, including termination of employment or contract.

11. Third Party Arrangements

Where third-party arrangements are in place, the procedures outlined in Thrive Training and Education’s Third Party Arrangements Policy shall be in effect. Regular reviews of third-party performance are conducted to ensure alignment with RTO standards.

All third-party providers that collect, store or process personal information on behalf of Thrive Training and Education must be subject to written contractual privacy, confidentiality, information security and breach notification obligations equivalent to those applying to Thrive Training and Education.

Related Policy: 4.7 Third Party Arrangements Policy.

12. Supporting Documents

• Non-Disclosure Agreement.
• Contract of Employment.
• 1.2 Staff Code of Conduct.
• 4.7 Third Party Arrangements Policy.
• Data Breach Response Plan.