External Signals is a monthly briefing on developments affecting Australian independent schools: regulation, technology, sector incidents, funding and social change, and what they mean for the people running them. Produced by Arvoe for principals, business managers, and board members across the sector.
Top 5 signals most relevant this month
Page 4- 01
NESA sets the rule: one take-home HSC task, worth no more than 15 per cent
Teaching & Curriculum - 02
From 10 December, privacy policies must describe the significant decisions software makes or informs
AI & Data Governance - 03
PISA 2025: Australian 15 year olds above the OECD average, and a new measure of learning with digital tools
Teaching & Curriculum - 04
Mathspace breach exposes contact details of more than a million students, staff and parents
Cyber & Data Security - 05
Federal audit seeks about $23 million in disability loading from an independent school in Victoria
Financial & Operations
How much do we hold about students and families, and could we justify keeping it? Two breaches, one at a vendor and one at a school, a draft overhaul of the Privacy Act and new guidance on disclosing automated decisions all bear on what a school keeps, what it does with it, and for how long.
Quieter than August, with two signals scored 7 or above. Cyber & Data Security is the highest-rated area, on two breaches disclosed in the month.
At a glance
In August this briefing asked whether assessment still shows what students know. On the last day of that month NSW answered with a rule: HSC courses may set one take-home task worth no more than 15 per cent, and schools should not rely on AI detection tools as the main safeguard against malpractice. September's weight sat elsewhere, on what schools hold about people and what their records can show. A maths platform and an independent school in Western Australia both disclosed breaches, federal auditors moved to recover about $23 million in disability funding from an independent school in Victoria, and the privacy regulator published guidance on a new duty, from 10 December, to describe in a privacy policy the significant decisions software makes or informs.
Bars show how many signals touch each area; one signal can touch several, so they total more than the verified count. The dot shows how hot the area ran.
When each signal is expected to bite. The hero figure is the first two buckets combined.
NSW HSC courses limited to one take-home task worth no more than 15 per cent.
ACT family violence information-sharing scheme commences; schools included.
EU AI Act bans ‘nudify’ and intimate-deepfake systems.
Privacy policies must describe decisions software makes or informs that significantly affect people (OAIC guidance published 30 Sep).
OAIC must register the Children's Online Privacy Code.
WA public-sector breach reporting begins (non-gov schools excluded).
VIC device-policy registration standard expected to commence.
NSW Preliminary courses come under the same take-home limit.
NSW public schools expected to start voluntary classroom screen-time limits, mandatory from 2028.
Compliant anti-bullying policy a condition of NSW registration.
Agreed target: sectors embed the National Framework and schools publish aligned policies.
SA schools in all sectors start recording hardship-based enrolment refusals, cancellations, suspensions, exclusions and expulsions of students with disability; first return due 31 May 2028.
VIC non-gov schools must show a compliant device policy to hold registration.
Risk weather this month
September was quieter than August. Two signals scored 7 or above, against five last month, across 15 signals rather than 22. The order of the areas also changed. Cyber & Data Security, the lowest-rated area in August, is the highest this month, and AI & Data Governance, the highest in August, now rates mild. Financial & Operations rates cool, mainly because the funding change it carries runs to 2029.
The ratings below combine severity with timing, not volume, so a small area can rate higher than a busy one.
| Risk area | What is driving it | This month | Vol. |
|---|---|---|---|
| Cyber & Data Security | Two breaches disclosed in the month, one at a maths platform used in Australian and New Zealand schools and one at an independent school in Western Australia. The school's loss included bank details, medical records and photographs of former students. | WARM | 2 |
| Workforce & IR | National survey data on sexism and misogyny directed at teachers at school, and a pay dispute in ACT public schools in which teachers have endorsed stop-work action. | MILD | 2 |
| AI & Data Governance | The OAIC's new guidance on describing, in privacy policies, the decisions software makes or informs leads the area, ahead of the 10 December start. It sits alongside a draft overhaul of the federal Privacy Act, a US standard limiting how a major vendor may use student data, and New York City pausing student-facing generative AI below high school. | MILD | 4 |
| Teaching & Curriculum | NESA's limit on take-home HSC tasks leads the area, and sits alongside the PISA results, screen-time limits in NSW public classrooms and research on how young people get their news. Most of it lands over months, not weeks. | MILD | 4 |
| Financial & Operations | The main item is a federal draft determination to recover NCCD funding from a Victorian independent school, which the school is contesting. Reporting also puts the loss for non-government schools with a Commonwealth share above 80 per cent of the Schooling Resource Standard at more than $800 million by 2029, and a seasonal outlook flags above-normal bushfire potential. | COOL | 3 |
Each area's rating combines how serious its signals are with how soon they land. Warm means worth watching now; mild means real but not pressing.
The count of signals in the area this month; areas sum to the month's 15. It is separate from the rating: an area can carry a real volume of work while still reading mild.
Top 5 signals most relevant this month
NESA sets the rule: one take-home HSC task, worth no more than 15 per cent
On 31 August the NSW Education Standards Authority published new assessment requirements (NESA 29/26). A school's assessment program for an HSC or Preliminary course may include "no more than one take-home assessment task, worth a maximum weighting of 15%". The limit applies to HSC courses from Term 4 2026, so the HSC Class of 2027 is the first affected, and to Preliminary courses from Term 1 2027. Because school-based assessment makes up half of the HSC mark, a 15 per cent task is worth at most 7.5 per cent of the final result. Fourteen courses with major projects or practical components are exempt, among them Visual Arts, Drama, Music, Design and Technology, English Extension 2, and the Science, History and Music Extension courses. English Extension 1 is not exempt.
NESA also set a requirement and gave advice on AI. Schools must design formal assessment tasks so that marks reflect the student's own knowledge, skills and understanding, and "must not reflect a student's use of generative AI". It advised that "Schools should not rely on AI detection tools as the main safeguard against malpractice." August's edition carried the Minister's request to NESA; this is NESA's answer, delivered within the timeframe the Minister set.
For NSW schools the practical work is immediate. Current Year 11 students begin their HSC courses in Term 4 under the new limit, and Preliminary programs for 2027 are being written now. The detection advice reaches further. NESA's advice applies only in NSW, but it gives every school a reference point, and a school that questions a student's mark on the strength of a detection score alone is relying on something NESA has advised against. The requirement that marks "must not reflect a student's use of generative AI" will take more work, because it applies to how each task is designed in the first place.
Worth checking — For each Stage 6 course we offer, how many take-home tasks are on the 2027 schedule, and are any weighted above 15 per cent? Does our academic integrity procedure ever treat a detection score as evidence on its own? Outside NSW, if our certificate authority adopted the same limit, which tasks would have to change, and how much notice would we want?
From 10 December, privacy policies must describe the significant decisions software makes or informs
On 30 September the Office of the Australian Information Commissioner published guidance on a new transparency duty in the Australian Privacy Principles. From 10 December 2026, "APP entities must include information in their privacy policy where they have arranged for a computer program to make or inform decisions that significantly affect individuals' rights or interests." The guidance comprises a fact sheet on the obligation, a supplementary fact sheet for government agencies, a flowchart for working out whether the obligation applies, and updated guidelines on APP 1, the principle that governs privacy policies. The obligation was introduced by the Privacy and Other Legislation Amendment Act 2024. The policy has to describe the kinds of personal information the programs use and the kinds of decisions involved; it does not have to list products by name. The OAIC says the guidance reflects 90 written submissions.
August's calendar carried the 10 December date. With the guidance now published, a school covered by the Privacy Act has until 10 December to work out whether the duty reaches it and to update its privacy policy if it does. The duty reaches further than fully automated decisions. It also covers a program that does something substantially and directly related to making a decision, where that decision could reasonably be expected to significantly affect someone's rights or interests and the program uses personal information about them. In a school, the software worth checking against that test includes tools that flag students for attendance or wellbeing follow-up, help rank enrolment applications, or inform academic integrity decisions. Whether each one meets the threshold is a judgement the school has to make, and it should record how it decided. This connects to this month's NESA advice. A detection tool used in a malpractice process is the kind of program a school would need to assess.
Worth checking — Do we have a list of the software that makes or informs decisions about students, families or staff, including features inside platforms we already run? For each, has someone worked through the OAIC flowchart and recorded whether the decisions it informs significantly affect people's rights or interests? Who will update our privacy policy before 10 December, and who signs it off?
PISA 2025: Australian 15 year olds above the OECD average, and a new measure of learning with digital tools
The Australian Council for Educational Research released Australia's PISA 2025 results (Volume I) on 8 September, alongside the OECD's international release. More than 14,600 Australian students from 766 schools took part, within a study of more than 760,000 students in 91 countries. Australian 15 year olds scored above the OECD average in all three core domains: reading 491 against 461 (10th), mathematics 478 against 463 (16th) and science 509 against 482 (10th). PISA 2025 also introduced a Learning in the Digital World domain, measuring how students use digital tools to learn and solve problems. Australia's mean was 532 against an OECD average of 500, and 77 per cent of Australian students reached the National Proficient Standard.
ACER reports that students in independent schools scored around 50 points higher than those in government schools, and around 30 points higher than those in Catholic schools, in all three core subjects, and that students in major cities outscored those in regional areas by 24 to 30 points. A second report, due in December, will cover motivation, school environment and technology use.
Independent schools will be asked about the sector gap. It is a raw comparison of results, and families and media will read it as a measure of what schools add. A Head who can say what the school's own cohort data show will be on firmer ground than one who repeats the headline or rejects it. The new digital domain is also worth attention. It measures how well students learn with digital tools, and it arrives while schools are setting their positions on AI, so December's report on technology use is worth reading closely.
Worth checking — Does the board's data pack read our results against external measures as well as our own history, and say what each can and cannot show? Could we explain the sector gap to a parent without overclaiming in either direction? Who will read the December report on technology use, and where will it feed into our position on AI and devices?
Mathspace breach exposes contact details of more than a million students, staff and parents
On 3 September Mathspace, a maths learning platform used in Australian and New Zealand schools, confirmed a data breach. Attackers exploited a vulnerability in its self-hosted Metabase reporting software, which let them obtain administrator access to that system "without a legitimate login". Unauthorised access began on 10 August and data was downloaded on 27 August. Metabase had released a fix on 6 August; Mathspace applied it on 29 August.
Mathspace states that "1,079,819 people were affected, comprising students, staff, and parents or guardians combined", all in Australia and New Zealand. The data taken was account and contact information, including names, email addresses, usernames and login dates. Passwords, single sign-on tokens and other credentials were not exposed, and nor were academic records, learning activities or results. Mathspace notified the Office of the Australian Information Commissioner, the Australian Cyber Security Centre and their New Zealand counterparts on 4 September, began notifying schools the same day and individuals from 6 September.
May's edition led with the Canvas breach, and Mathspace is another case of school data exposed at a vendor. The system breached was an internal reporting tool behind the product students use, and a fix had been available for three weeks before it was applied. A school cannot see that part of a vendor's operation, so the contract is where the school's expectations have to be written down. The data taken was contact information, and names and email addresses linked to a school's maths platform are what a convincing phishing email to a family needs.
Worth checking — Do we know whether our students, staff and families are among those affected, and have we told families what a fraudulent message about the platform might look like? For each platform that holds our students' data, does the contract say how quickly the vendor must tell us of a breach? Does our data breach response plan cover a vendor's breach as well as our own?
Federal audit seeks about $23 million in disability loading from an independent school in Victoria
The federal Department of Education has issued a draft determination seeking repayment of about $23 million in disability loading from an independent school in Victoria, according to EducationHQ. The loading was claimed through the Nationally Consistent Collection of Data on School Students with Disability, known as the NCCD. Disability Insights describes it as a special assistance school. Auditors found it had claimed more than 90 per cent of its students at the extensive level, the highest NCCD adjustment level. Disability Insights reports that students at that level attract more than $45,000 a year each in Commonwealth funding, and that an internal email asked staff to focus on "getting students that are close to the line over the line".
The school's operator rejects any suggestion that staff were told to manufacture adjustments or inflate classifications, saying the instruction was to ensure that adjustments already provided in classrooms were properly recorded and supported by evidence. The school does not accept the draft determination and is considering its options under the Australian Education Act 2013. Disability Insights also reports that more than 20 staff have been made redundant and that the school has cut its projected disability funding by about $10 million.
May's edition carried the federal Budget measure of $40.4 million to strengthen NCCD compliance, against a savings target of $463 million over four years. August's carried updated guidance on the evidence an NCCD audit expects. This case shows what an audit finding can lead to, even before it is final. The determination is a draft and is contested, and a special assistance school's enrolment is unusual, so other schools should look past the 90 per cent figure to the question an NCCD audit asks: whether the school's records show that the adjustment claimed for each student was actually provided at that level. NCCD levels are meant to follow the adjustments a student receives, and a school's internal guidance should make that plain.
Worth checking — For students we record at the substantial and extensive levels, could we produce the evidence of the adjustments actually provided, student by student? Who in the school reviews the NCCD submission before it goes, and on what basis? Does our internal guidance on NCCD talk about the adjustments students receive, rather than the funding attached to each level?
For your next board meeting
We read the month's signals as evidence of governance questions the board already owns. One matter this month. The board's role is to ask the question clearly, and management's role is to provide evidence-based assurance in response.
How much do we hold about students and families, and could we justify keeping it?
Every school collects a great deal about the people in its care, from family and health details to bank details for fees, photographs and wellbeing notes. Some of it sits in the school's own systems and much of it with vendors. Where a school is covered by the Privacy Act, that law applies alongside the school's own policies, and the board owns the question of whether the information is handled well. In May this briefing asked what the school's position is when a vendor is breached. The September signals ask the question that comes before it: what there is to lose, and why it is being kept.
An independent school in Western Australia disclosed a cyber attack in which, according to reporting, family contact details, bank account details, student medical records and photographs of current and former students enrolled since 2015 were taken. The school says it contained the incident and has notified families. The categories taken show how much the school held, and for how long, including information about students who had already left.
Mathspace's breach, covered in the Top 5, took contact details for more than a million people from an internal reporting tool. No credentials or academic records were exposed. The data sat in a system no school could see.
From 10 December, under amendments to the Privacy Act passed in 2024, a school covered by the Act must describe in its privacy policy the kinds of decisions it uses software for, and the kinds of personal information that software draws on, where the software makes the decision or does something substantially and directly related to making it, and the decision could reasonably be expected to significantly affect people's rights or interests. The OAIC's guidance, also in the Top 5, sets out how to meet it. Meeting it depends on knowing what information the school holds and what is done with it, which is the same starting point as this board matter.
On 31 August the Attorney-General released for consultation the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, the second tranche of Privacy Act reform, framed around risks from artificial intelligence and wearable devices. Consultation closed on 18 September. The Attorney-General describes a fair and reasonable test, so that companies can no longer justify collecting more information than they need. Law firm analysis reports that the test would apply to collection, use and disclosure, even where a person has consented, and that entities would have to consider "whether to destroy the personal information" once the purposes for holding it have passed and the law no longer requires it to be kept. It is a draft, with no commencement date.
In the United States, two teachers' unions and Microsoft announced a standard for school districts that bars using student data to train AI models. According to Fortune, it applies to Microsoft's US school district partnerships from 1 November and becomes legally enforceable once written into a district's agreement. It applies only in the US, and it shows that what a vendor may do with student data can be settled in a contract.
Our position should be that we know what personal information we hold on students, families, staff and former students, where it sits, including with each vendor, how long we keep each kind and why, and that we keep no more than we can justify.
A retention schedule on paper is a starting point. The test is whether deletion actually happens, including for former students and in vendors' systems, and whether the school could explain to a family why it still holds their bank details or their child's medical record years after they left. The draft reform points the same way, towards collecting only what is fair and reasonable and considering destruction once the purpose has passed and no law requires the record to be kept.
A paper that allows the board to test that position with evidence should cover four areas. An inventory of the main categories of personal information the school holds, such as health, financial, image and pastoral records, and the system or vendor holding each. The retention period set for each category, and evidence that deletion is happening, including for former students. A register of the vendors that hold student data, with what each contract says about breach notification, use of data to train AI, and deletion at the end of the contract. And what the school publishes of students' images, on what consent, and who decides. With that in hand the board can decide whether this is a watch, prepare or act item.
Received this as part of a board pack? The monthly briefing is free to school leaders at arvoe.ai/external-signals.
Signals by risk theme
Teaching & Curriculum
4 signals| Signal | Date | State | Source | Score |
|---|---|---|---|---|
| NESA limits HSC and Preliminary courses to one take-home task worth no more than 15% and advises against relying on AI detection tools | 31 Aug 2026 | NSW | NSW Education Standards AuthorityPRIMARY | 8 |
| PISA 2025: Australia above the OECD average in reading, maths and science; new Learning in the Digital World domain | 8 Sep 2026 | AU | ACERAUTHORITATIVE | 6 |
| NSW sets classroom screen-time limits for public schools by year level, from Term 1 2027 and mandatory in 2028 | 13 Sep 2026 | NSW | ABC NewsCREDIBLE | 6 |
| News and Young Australians 2026: more than a third of 10 to 17 year olds use generative AI as a news source | 31 Aug 2026 | AU | Education MattersCREDIBLE | 5 |
Two of the four set limits on technology in learning, and both come from NSW: NESA on what take-home assessment can carry, and the Department on how much class time can be spent on screens in public schools, starting at 15 minutes a day in the early years. The other two are measures of how students are actually learning with technology. PISA's new digital domain puts Australian students well above the OECD average, while the news study finds a third of young people getting news from generative AI and fewer than half confident they can tell fact from fiction online. Schools setting limits on technology will want both findings in view.
AI & Data Governance
4 signals| Signal | Date | State | Source | Score |
|---|---|---|---|---|
| OAIC publishes guidance on the duty to describe in privacy policies the decisions software makes or informs, which applies from 10 December | 30 Sep 2026 | AU | Office of the Australian Information CommissionerPRIMARY | 8 |
| Attorney-General releases exposure draft Privacy Amendment (Personal Data Protection) Bill 2026, the second tranche of Privacy Act reform | 31 Aug 2026 | AU | Attorney-General's DepartmentPRIMARY | 4 |
| US teachers' unions and Microsoft launch an AI safety and privacy standard for school districts, from 1 November | 9 Sep 2026 | US | FortuneCREDIBLE | 3 |
| New York City pauses student-facing generative AI for one year below high school and bans companion chatbots in all grades | 2 Sep 2026 | US | NYC Mayor's OfficePRIMARY | 2 |
From 10 December, the duty behind one of the four binds schools covered by the Privacy Act, which must describe in their privacy policy the significant decisions software makes or informs. The other three show where expectations are heading. Australia's draft privacy reform would require collection and use of personal information to be fair and reasonable. Two US teachers' unions and a vendor have set limits on the use of student data that districts can write into their contracts. And the largest US school system has chosen to restrict student-facing generative AI below high school. Each of them points towards schools holding a formal, approved position on AI and on student data.
Cyber & Data Security
2 signals| Signal | Date | State | Source | Score |
|---|---|---|---|---|
| Mathspace breach exposes contact details of 1,079,819 students, staff and parents in Australia and New Zealand through a compromised reporting tool | 3 Sep 2026 | AU | MathspaceAUTHORITATIVE | 6 |
| Independent school in WA breached: bank details, student medical records and photographs of students enrolled since 2015 taken | 15 Sep 2026 | WA | DataBreaches.netCREDIBLE | 6 |
One breach was at a vendor and one at a school, and in both the more useful lesson is about what was held. Mathspace's data came from a reporting tool behind the product that had not yet been patched. The school's reported losses included financial and health details and photographs of current and former students going back to 2015. What is kept, and where, is the subject of this month's board matter.
Workforce & IR
2 signals| Signal | Date | State | Source | Score |
|---|---|---|---|---|
| Monash and AEU survey of more than 2,600 teachers: 78% have observed or experienced sexism or misogyny at school, one in three frequently | 28 Aug 2026 | AU | Monash UniversityAUTHORITATIVE | 6 |
| ACT public-school teachers reject a 9% pay offer over three years and endorse rolling stop-work action from 21 September | 11 Sep 2026 | ACT | Region CanberraCREDIBLE | 5 |
The Monash survey is of public-school teachers, but the behaviour it describes is likely to be familiar across sectors, and its authors frame it as a workplace health and safety matter as well as a student behaviour one. One in three respondents said gendered violence sometimes makes them consider leaving. The ACT dispute is about pay, and also about staffing and class sizes. Both bear on whether schools can keep the staff they have.
Financial & Operations
3 signals| Signal | Date | State | Source | Score |
|---|---|---|---|---|
| Federal draft determination seeks about $23 million in NCCD disability loading from an independent school in Victoria; the school is contesting it | 1 Sep 2026 | VIC | EducationHQCREDIBLE | 6 |
| Reporting puts losses at more than $800 million across over 1,000 non-government schools by 2029, as schools with a Commonwealth share above 80% of the SRS move to 80% | 3 Sep 2026 | AU | CathNewsCREDIBLE | 5 |
| AFAC Spring 2026 outlook flags above-normal bushfire potential in parts of every mainland state and the NT | 19 Aug 2026 | AU | AFACAUTHORITATIVE | 3 |
Two of the three bear on the money a school can count on. The NCCD determination shows what an audit can lead to, a few months after the integrity measure carried in May's edition, and every school that claims the loading will want to know its own records would hold. The funding change is long settled policy: the Department of Education sets out that non-government schools with a Commonwealth share above 80 per cent of the Schooling Resource Standard move to that share by 2029. What is new is the reported size of the reduction, which CathNews, citing the Daily Telegraph, puts at more than $800 million, with Independent Schools Australia warning that schools may cut or defer programs, reduce staffing or raise fees. The bushfire outlook is the prompt for schools in the flagged regions to check emergency and closure plans, and the regulator requirements that apply to them, before summer.
How this briefing is made
Every month we scan the full policy, technology, social, economic, legal and environmental landscape affecting Australian schools, across all sectors rather than only independent. From that, we surface only what clears verification. We would rather report fewer signals we trust than a large scan count. This month, 15 signals cleared the bar. Signals are included by the month they belong to, by discovery or event; the event date shown may fall either side of the period.
Each signal is scored for relevance to schools and placed on a horizon of how soon it lands and a set of risk domains. The risk weather combines severity and immediacy into a single read per area, so you can see where the pressure sits and track it month to month.
Every signal is checked against its source, and load-bearing claims are read off the primary where one exists. Every source is shown with its authority: primary is the instrument or the body itself, authoritative is a sector or expert body, credible is established reporting. So you can see what a claim rests on. We do not name schools involved in adverse incidents, because the lesson does not depend on the name.
This is a briefing to help you see what is coming and ask better questions. It is not compliance advice, and not a substitute for your own legal, IR or child-safety processes.
Want a signal read against your school's specific profile?
Arvoe helps schools turn signals like these into a clear position for the board, backed by evidence. If the board question above raised something the school cannot yet answer with confidence, our quick interactive assessment is a free place to start. To have one of this edition's signals looked at for your school, reply to the email this briefing arrived with, or visit arvoe.ai.
We help schools unlock AI with confidence, so our kids can thrive in an AI world.
Ryan Speak · ryan@arvoe.ai · arvoe.ai/signals