NQF digital technology changes: what they mean for your service

Early childhood services have had two rounds of change on digital technology. From 1 September 2025, every service needs a policy and procedures for the safe use of digital technologies and online environments. From 27 February 2026, rules on personal devices and images of children moved from a voluntary code into the National Law. This is a plain-English summary for small centre-based services. Check the detail with ACECQA, your regulatory authority or your adviser before relying on it.

What changed on 1 September 2025

Regulation 168 lists the policies and procedures every service must have. From 1 September 2025 it includes a policy and procedures for the safe use of digital technologies and online environments at the service. According to ACECQA, the policy must cover:

• the taking, use, storage and destruction of images and videos of children
• obtaining authorisation from parents to take, use and store images and videos of children
• the use of any optical surveillance device, such as CCTV
• the use of any digital device issued by the service
• the use of digital devices by children.

ACECQA's current policy guidelines also include identifying and responding to children at risk of abuse or maltreatment through digital technologies, including notifying authorities where required.

The same round of changes cut the time to notify physical or sexual abuse of a child in care to 24 hours, and added vaping substances and devices to the list of things services must be free from. From 1 January 2026, the National Quality Standard was refined to reference child safety in Quality Areas 2 and 7.

Regulation 170 and the rules around your policy

Writing the policy is only the first obligation. The surrounding regulations still apply to it:

• Regulation 170 requires the approved provider to take reasonable steps to ensure the policies and procedures are followed.
• Regulation 171 requires policies and procedures to be kept available.
• Regulation 172 covers notifying families of changes. ACECQA's guidance says families must be told at least 14 days before changes that affect fees, significantly affect education and care, or significantly affect a family's ability to use the service.

Regulation 170 is where the I.T. matters. A policy saying images are stored securely means little if photos sit on a shared tablet with no passcode and sync to someone's personal cloud account.

The National Model Code and the 2026 device rules

ACECQA released the National Model Code for taking images or videos of children on 1 July 2024. It was voluntary. It recommended that only service-supplied devices be used to photograph or film children, that personal devices not be carried while providing care except for essential needs, and that storage of images be tightly controlled.

From 27 February 2026, these principles became law in the Education and Care Services National Law, mainly sections 175A to 175J, with regulations 168(2)(ha), 179A and 179B. NSW has additional and substituted provisions, so NSW services should check the NSW requirements. ACECQA advises WA services to check their commencement dates.

For centre-based services, the key rules are:

• Approved providers, nominated supervisors, staff and volunteers, including students, must not use or possess a personal device while working directly with children.
• Someone on a break away from children is not working directly with children.
• A personal device may be used on excursions and transport when it is necessary for children's safety or education and care.
• The approved provider can give written authorisation for limited purposes: a person's disability or health needs, urgent family communication where service phones are not practical, a broken service device, emergencies, and work health and safety reasons.
• Even under an exception, a personal device must not be used to capture, store or transmit images of children.
• Written authorisations record the person's name and role, who wrote the record, the device, the purpose and the period. Keep them for at least three years.

Service-supplied phones and tablets may be used to capture, store and transmit images for purposes such as family communication, documenting learning and recording attendance. They must not be used for personal purposes, including logging into personal accounts. Providers must configure them in line with their child safety and security policies.

What this means for your I.T.

For a small service, the practical work is getting service devices set up so the policy is true on every device, every day.

1. List every device. Record each service phone, tablet and computer, who uses it and where it is kept. ACECQA encourages providers to keep records of service-supplied devices.
2. Manage the devices centrally. Use a device management tool such as Microsoft Intune. It can enforce passcodes, block personal app stores and personal accounts, and wipe a lost tablet remotely.
3. Decide where images live. Images should go from the device to one approved place, such as your learning platform or a locked-down business OneDrive or SharePoint. Stop automatic sync to personal photo libraries.
4. Set retention and destruction. Your policy must cover destruction of images. Decide how long images are kept, and clear devices on a schedule.
5. Lock down CCTV. Decide who can view footage and how long it is kept. Change default passwords, keep the recorder updated and restrict remote viewing to named people.
6. Turn on multi-factor authentication for email, your childcare management software and any system holding children's images or records.
7. Train staff at induction. ACECQA's guidelines suggest induction training on safe digital technology use, with regular updates at team meetings.

Start with the device list and device management. Nearly every other control depends on knowing which devices the service owns.

Summary checklist

• Your Regulation 168 digital technologies policy covers images, parental authorisation, CCTV, service devices and children's use of devices.
• You can show reasonable steps that the policy is followed (Regulation 170).
• Staff and volunteers do not have personal devices while working directly with children, except under the permitted exceptions.
• Written authorisations are recorded and kept for at least three years.
• Service devices are managed, passcode protected and blocked from personal accounts.
• Images are stored in one approved location and destroyed on a schedule.
• CCTV access and retention are defined and secured.
• Families are notified of policy changes as Regulation 172 requires.