How OWNA is helping services meet the new child safety requirements

OWNA
Sep 11
3 min read

From 1 September 2025, new legislative requirements took effect under the National Quality Framework (NQF), reshaping how early childhood education and care (ECEC) services protect children's safety, especially in digital environments.

These reforms strengthen expectations around child safe policies, digital safety, staff accountability, and compliance monitoring.

In this article, we'll outline the changes, what OWNA does to assist services, and what providers need to do next.

Requirements under Regulation 168

Under the new regulatory changes, regulation 168 requires providers to have a policy and procedures in place for the safe use of digital technologies and online environments at the service. These must include:

The taking, use, storage and destruction of images and videos of children
Obtaining authorisation from parents to take, use and store images and videos of children
The use of any optical surveillance device (e.g. CCTV)
The use of any digital device issued by the service
The use of digital devices by children.

Other reforms include changes to the notification timeframes for allegations or incidents of physical and sexual abuse, and for services to be free from vaping substances and vaping devices.

How OWNA supports compliance under new reforms

A number of existing and new measures undertaken by OWNA may help services in relation to these reforms. Here is a list of relevant security and compliance protocols:

1. Data Security

OWNA securely hosts all data in Australian Microsoft Azure data centres.
All information is encrypted in transit (when flowing between devices and our servers) and at rest (when stored).
For full details, see our security policy here: OWNA Security Policy.

2. Access Controls

Role-based permissions mean admins can access all content, educators and staff have individual logins that can be deactivated instantly if needed.
Any downloads of any data will be logged.
Services can set parent communications to "private," so each parent only sees their own child's information unless it's a general message for all families.
Admin users can configure portal and app availability for staff, preventing them from accessing child and parent information outside the permitted times.
To meet new personal device policies, OWNA is rolling out a Device Register Log:
- Only approved, service-issued devices can log into the platform.
- Any login attempt from an unapproved device is blocked and triggers an automatic email alert to the centre.
Screenshots are disabled in our mobile apps to prevent unauthorised image saving.

3. Record-Keeping & Activity Audit Trail

We track who has viewed content, using 'seen by' indicators for both families and staff.
Incident reports and routine records are date-stamped and tracked to the staff member who completed them.
Deleted content remains trackable and recoverable for a set period to support audit and compliance needs.

4. Retention and Deletion

OWNA does not store personal data unnecessarily or indefinitely. Data is retained only where there's a legal, regulatory, or operational need.
If a parent or guardian requests data deletion, we evaluate the request with the service provider, and if no retention obligation applies, the data is permanently removed.

5. Privacy & Compliance

OWNA fully complies with the Privacy Act 1988 (Cth), the Education and Care Services National Regulations, and the Child Care Provider Handbook.
Daily encrypted backups are securely stored in Microsoft Azure.

What Providers should do next

While every approved provider is ultimately responsible for meeting these obligations, OWNA is committed to making the compliance journey easy, reliable, and effective.

Providers should be developing policies and procedures to align with the new regulations, and can use our latest features - such as the Device Register Log - to assess their device management.