RTO.au / Records

Student records, privacy and access

Learners generally have a right to see them.

Student files contain personal information and in most jurisdictions the individual has a right of access and correction, subject to defined exceptions. Providers frequently treat these as internal documents.

That has practical consequences for how assessor comments and file notes are written, since anything recorded may be read by the person described, and characterisations that would be uncomfortable to justify should not be recorded as findings.

Disclosure to third parties, including employers who paid for the training and parents of adult learners, generally requires consent and is one of the more common informal breaches.

Data held by third party systems remains the provider's responsibility, including where a platform vendor holds it offshore, and cross-border arrangements carry their own requirements in several jurisdictions.

Privacy obligations differ substantially by jurisdiction and by whether an organisation is covered by a particular regime. The applicable law should be established directly rather than from sector convention.

It is worth adding that access requests from students are usually informal rather than formal, and a provider that only recognises a written request under the applicable privacy instrument will mishandle most of them. Treating an ordinary ask as an access request is both simpler and better practice.