Index

Policy Purpose

The purpose of this policy is to outline how Short Courses Australia (SCA) collects, uses, stores, protects, discloses and disposes of personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and other applicable legislation.

This policy also supports SCA's commitment to protecting the privacy of learners, prospective learners, employees, contractors, third-party representatives and other stakeholders while meeting its obligations as a Registered Training Organisation (RTO).

Scope

This policy applies to all personal information collected, created, received, stored, used or disclosed by Short Courses Australia (SCA) in the course of its operations.

It applies to:

  • prospective and current learners;
  • graduates and former learners;
  • employees, trainers, assessors and contractors;
  • third-party representatives and service providers;
  • employers and industry partners; and
  • any other individual whose personal information is collected or held by SCA.

This policy applies to information collected through enrolment forms, student management systems, learning management systems, websites, email, telephone, paper records and any other business systems operated by SCA.

SCA manages personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the National VET Data Policy and other applicable Commonwealth and State or Territory legislation.

Definitions

Department of Employment and Workplace Relations (DEWR) – DEWR is authorised by law, including the Privacy Act 1988 (Cth) and the National Vocational Education and Training Regulator Act 2011 (Cth), to collect, use and disclose personal information for functions relating to vocational education and training. Further information is available in the DEWR VET Privacy Notice.

NCVER – National Centre for Vocational Education Research is the national professional body responsible for collecting, managing, analysing and communicating research and statistics on the Australian vocational education and training (VET) sector.

Personal Information: Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not, as defined by the Privacy Act 1988 (Cth). For example, personal information may include:

  • an individual's name, signature, address, phone number or date of birth
  • sensitive information
  • credit information
  • employee record information
  • photographs
  • Internet Protocol (IP) addresses
  • voice print and facial recognition biometrics (because they collect characteristics that make an individual's voice or face unique)
  • location information from a mobile device (because it can reveal user activity patterns and habits).

NOTE: The definition of personal information only relates to 'natural' persons. It does not extend to other 'legal' persons, such as companies.

The Privacy Act 1988 (Privacy Act) is an Australian law that regulates the handling of personal information about individuals. This includes the collection, use, storage, and disclosure of personal information.

Australian Privacy Principles (APPs) – The 13 Australian Privacy Principles contained in Schedule 1 of the Privacy Act 1988 (Cth) establish the standards, rights and obligations for the collection, use, disclosure, storage and management of personal information.

Sensitive Information – Under the Privacy Act, sensitive information is defined as personal information that includes information or an opinion about an individual's:

  • racial or ethnic origin
  • political opinions or associations
  • religious or philosophical beliefs
  • trade union membership or associations
  • sexual orientation or practices
  • criminal record
  • health or genetic information
  • some aspects of biometric information

USI – Unique Student Identifier is an individual's education identifier for life. It also creates an online record of their training attainments in Australia. When undertaking nationally recognised training or a higher education qualification, students need a USI to receive Commonwealth financial assistance and obtain their qualification or statement of attainment.

Policy

Personal Information

Short Courses Australia (SCA) recognises the importance of protecting the privacy and confidentiality of personal information entrusted to the organisation.

Short Courses Australia (SCA) is committed to collecting, using, storing, disclosing, retaining and disposing of personal information lawfully, fairly and securely in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), applicable Commonwealth, State and Territory privacy legislation, and all other relevant legislative and regulatory requirements.

SCA only collects personal information that is reasonably necessary for the delivery of vocational education and training, compliance with legislative and regulatory obligations, employment, business operations and the provision of quality services.

Personal information will only be accessed by authorised personnel who require the information to perform their duties and will be protected against unauthorised access, disclosure, misuse, loss or alteration through appropriate physical, electronic and administrative safeguards.

Under the Data Provision Requirements 2020, Short Courses Australia must collect personal information about you and disclose that personal information to the National Centre for Vocational Education Research Ltd (NCVER).

Your personal information (including the personal information contained on the enrolment form and your training activity data) may be used or disclosed by Short Courses Australia (SCA) for statistical, regulatory and research purposes. SCA may disclose your personal information for these purposes to third parties, including:

  • School – if you are a secondary student undertaking VET studies.
  • Employer – if you are enrolled in training paid by your employer.
  • Commonwealth and State or Territory government departments and authorised agencies.
  • NCVER.
  • Organisations conducting student surveys; and
  • Researchers.
  • Other government departments, regulators, licensing authorities or authorised agencies where disclosure is required or authorised by law, including but not limited to Liquor & Gaming NSW, Liquor Control Victoria, SafeWork NSW, WorkSafe Victoria, the NSW Food Authority, Austroads and the Victorian Building Authority.

Why we collect your personal information

As a Registered Training Organisation (RTO), Short Courses Australia collects personal information that is reasonably necessary to:

  • process and manage enquiries, applications and enrolments;
  • deliver vocational education and training (VET) services;
  • assess learner competency and issue qualifications and Statements of Attainment;
  • verify student identity, including Unique Student Identifier (USI) requirements;
  • meet reporting obligations to government agencies, regulators and funding bodies where applicable;
  • provide learner support services and reasonable adjustments;
  • communicate with learners, employers and authorised third parties regarding training activities; and
  • meet legal, contractual and regulatory obligations.

How we use your personal information

Short Courses Australia uses personal information only for purposes that are directly related to its functions and activities as a Registered Training Organisation (RTO), or where otherwise authorised or required by law.

Personal information may be used to:

  • deliver education and training services;
  • assess learner competency and issue qualifications or Statements of Attainment;
  • verify identity and Unique Student Identifier (USI) information;
  • communicate with learners regarding their enrolment, training and assessment;
  • provide learner support services and reasonable adjustments where required;
  • manage payments, administration and student records;
  • meet legislative, regulatory and contractual reporting requirements; and
  • improve the quality of training, assessment and student services through continuous improvement activities.

SCA will not use personal information for purposes unrelated to its operations unless the individual has provided consent or the use is authorised or required by law.

How we disclose your personal information

Short Courses Australia may disclose personal information where required or authorised by law, or where the individual has provided consent.

Personal information may be disclosed to:

  • the National Centre for Vocational Education Research (NCVER);
  • Commonwealth, State and Territory Government departments and agencies;
  • the Australian Skills Quality Authority (ASQA);
  • State and Territory Training Authorities (STAs);
  • licensing and regulatory authorities relevant to the training being delivered;
  • employers or schools where they are responsible for the learner's enrolment or training (with appropriate authority);
  • organisations engaged to conduct surveys, research or statistical analysis on behalf of government agencies;
  • third-party service providers engaged by SCA to support training delivery or business operations, where appropriate privacy protections are in place; and
  • any other organisation where disclosure is authorised or required by law.

Personal information will only be disclosed for legitimate educational, administrative, regulatory or legal purposes.

How the NCVER and other bodies handle your personal information

The NCVER will collect, hold, use and disclose your personal information in accordance with the law, including the Privacy Act 1988 (Cth) and the NVETR Act. Your personal information may be used and disclosed by NCVER for purposes that include populating authenticated VET transcripts; administration of VET; facilitation of statistics and research relating to education, including surveys and data linkage; and understanding the VET market.
The NCVER is authorised to disclose information to the Australian Government Department of Employment and Workplace Relations (DEWR), Commonwealth authorities, State and Territory authorities (other than registered training organisations) that deal with matters relating to VET and VET regulators for the purposes of those bodies, including to enable:

  • administration of VET, including program administration, regulation, monitoring and evaluation
  • facilitation of statistics and research relating to education, including surveys and data linkage
  • understanding how the VET market operates, for policy, workforce planning and consumer information.

NCVER may also disclose personal information to persons engaged by NCVER to conduct research on NCVER's behalf.
NCVER does not intend to disclose your personal information to any overseas recipients.
For more information about how NCVER will handle your personal information, please refer to its Privacy Policy at www.ncver.edu.au/privacy.
If you wish to access or correct your personal information, you should first contact Short Courses Australia using the contact details provided in this policy. SCA will respond to requests in accordance with the Privacy Act 1988 (Cth).
DEWR is authorised by law, including the Privacy Act and the NVETR Act, to collect, use and disclose your personal information to fulfil specified functions and activities. For more information about how the DEWR will handle your personal information, please refer to the DEWR VET Privacy Notice at https://www.dewr.gov.au/national-vet-data/vet-privacy-notice.

 

Surveys

You may receive a student survey, which may be run by a government department or an NCVER employee, agent, third-party contractor or another authorised agency. Please note you may opt out of the survey at the time of being contacted.

Contact information

Individuals may contact Short Courses Australia at any time to:

  • request access to their personal information;
  • request correction of inaccurate, incomplete or out-of-date personal information;
  • withdraw consent where applicable;
  • make a privacy complaint;
  • enquire about how personal information is collected, used or disclosed; or
  • obtain further information about this Privacy Policy.

Requests should be submitted in writing to info@shortcoursesau.edu.au.

Access to Personal Records

All matters related to course enrolment, assessment results, course fees, or any other issue can only be discussed with the student unless the course enrolment form is signed by a third party (such as a parent or guardian for students under the age of 18) or a letter of permission allowing access to the student's information is provided by the student for their file.

When the requested information may breach the privacy of others, the details will be provided to the student requesting the information in a format (written, verbal, statistical) that meets their needs but ensures the privacy of others is maintained.

Requests to view personal files must be made in writing, detailing the specific information required. Requests can be submitted to Short Courses Australia via email: info@shortcoursesau.edu.au.

SCA will respond to requests for access or correction within a reasonable timeframe. Access may be refused where permitted by law, including where providing access would unreasonably impact the privacy of another individual or where another lawful exception applies. If access is refused, SCA will provide written reasons where required by law.

Information Storage

SCA is required to securely retain and be able to produce in full at audit or by the National Regulator, the Australian Skills Quality Authority (ASQA) if requested to do so, all completed learner assessment items for two (2) years from the date on which the judgement of competence for the learner was made. After this timeframe, records will be destroyed, with only the evidence of how the assessor reached the judgment outcome.

All records are stored on SCA's dedicated servers, and backup copies are securely maintained using off-site and cloud-based storage solutions.

Restricted access is enforced on files with sensitive information to ensure authorised access only.

SCA will at all times take reasonable steps to ensure the security of physical files (including student files), computers, networks and communications are maintained.

Personal information is protected through appropriate physical, electronic and administrative safeguards, including role-based access controls, secure authentication, regular system backups and secure disposal of records in accordance with legislative retention requirements.

SCA regularly reviews its information security practices to reduce the risk of unauthorised access, disclosure, alteration or loss of personal information.

Data Breach Management

Short Courses Australia (SCA) is committed to protecting personal information from unauthorised access, disclosure, misuse, loss, interference or alteration.

In the event of an actual or suspected privacy or data breach involving personal information, SCA will:

  • immediately contain the breach where practicable;
  • investigate the nature and extent of the breach;
  • assess the likelihood of serious harm to affected individuals;
  • take reasonable steps to minimise the impact of the breach;
  • notify affected individuals where required by law;
  • notify the Office of the Australian Information Commissioner (OAIC) where the breach is considered an eligible data breach under the Notifiable Data Breaches (NDB) Scheme; and
  • implement corrective actions and continuous improvement measures to reduce the risk of future breaches.

All employees, trainers, assessors and contractors are responsible for reporting any actual or suspected privacy or data breaches to management immediately upon becoming aware of the incident.

Records of privacy incidents and data breaches will be maintained and reviewed as part of SCA's risk management and continuous improvement processes.

Document Version: V2026.1
Document Owner: Chief Executive Officer
Approved by: Chief Executive Officer
Approved date: 29.04.2026
Review date: 29.04.2027
Legislative Reference: Standards for Registered Training Organisations (RTOs) 2025
Privacy Act 1988 (Cth)
Australian Privacy Principles (Schedule 1 – Privacy Act 1988 (Cth))
Privacy Amendment (Enhancing Privacy Protection) Act 2012
National Vocational Education and Training Regulator Act 2011 (Cth)
Student Identifiers Act 2014
National VET Data Policy