Child safety in physical and online environments

Guidance on Child Safe Standard 9: Keeping children safe in physical and online environments in early childhood services.

Early childhood

To comply with Child Safe Standard 9, you must take the following steps for the physical and online environments:

conduct detailed risk assessments to identify all types of risk to children
put strategies in place to manage and reduce risks
carefully plan your supervision strategy to keep children safe
promote a culture of safety.

You must comply with all elements of Child Safe Standard 9.

Keeping children safe in physical and online environments

Risks of child abuse and harm can come from:

inside the service
outside the service – during excursions or regular transport
from persons at the service - staff, volunteers, families, agency staff
contacts with external people from outside the service - during incursions, excursions, photography or tradespeople during works or renovations
physical environments - areas of the premises that are difficult to supervise
online environments.

Outside School Hours Care (OSHC) and vacation care services have different risks:

many operate from premises that were not purpose built
school aged children may also bring their own devices
together these factors make supervision more complex.

Standard 9 asks services to:

Conduct a detailed risk assessment of the service (see below for more information). This can help identify any risks of child abuse and harm at the service that relate to:

the physical environment
the online environment, and
any contact with third parties.

Assess the risk.
Take action to manage or control the risks identified.

Child Safe Standard 9

Read the full text of the Standard and its elements.

Physical and online environments promote safety and wellbeing while minimising the opportunity for children to be harmed

Early childhood services must comply with all the following elements of this standard:

Staff and volunteers identify and mitigate risks in the online and physical environments without compromising a child’s right to privacy, access to information, social connections and learning opportunities (9.1).
The online environment is used in accordance with the service’s Code of Conduct and Child Safe Environment Policy and practices (9.2).
Risk management plans consider risks posed by service settings, activities, and the physical environment (9.3).
Services that contract facilities and services from third parties have procurement policies that ensure the safety of children and young people (9.4).

Implement Standard 9

Open all

Conduct detailed risk assessments of both online and physical environments

The following risk assessment tools can help you conduct the assessment:

NQF Child Safe Culture - Self-assessment and risk assessment tool.
NQF Online Child Safe Culture – Self-assessment and risk assessment tool. Download both these tools at Child Safety.

When you conduct the risk assessment, make sure you include:

all the different types of risks to children that you can think of at your service
the strategies you already have in place to reduce these risks
identify any gaps and decide what the service can do to address these gaps.

Make sure you have a policy and procedures on the Safe Use of Digital Technologies and Online Environments

From 1 September 2025, all services regulated under the NQF must have in place policies and procedures on:

providing a child safe environment, including matters relating to the promotion of a culture of child safety and wellbeing within the service
the Safe Use of Digital Technologies and Online Environments The Safe Use of Digital Technologies and Online Environments policy and procedures must include the following matters:
the taking, use, storage and destruction of images and videos of children
how the service will obtain authorisation from parents to take, use and store images and videos of children
the use of any optical surveillance device at the service (e.g. closed-circuit television)
the use of any digital device issued by the service
the use of digital devices by children being educated and cared for by the service. Read more in ACECQA’s policy guidelines on the Safe Use of Digital Technologies and Online Environments.(opens in a new window)

Children’s services regulated under the CS Act (Occasional Care and Limited Hours services) must continue to have in place a policy and procedures on providing a child safe environment, including:

the promotion of a culture of child safety and wellbeing within the service
the safe use of online environments at the service.

Alignment with the National Model Code

For all services in Victoria, their policy and procedures must align with the National Model Code for Taking Images or Videos of Children while providing early childhood education and care(opens in a new window) (the National Model Code).

Aligning with the National Model Code means that:

only service-issued devices can be used to:

take images or videos of children while they are being educated and cared for at early childhood services

services must have strict controls on how these images and videos are stored and retained
anyone working directly with children in a centre-based service must not have personal devices with them that can:

take photos or record images
has personal storage and file transfer media

The only exception to this restriction on the use of personal devices is:

for essential purposes, such as the following:

excursions
emergencies
health
family needs.

All exceptions must be authorised in writing in advance (where possible) by the approved provider. For more information about how the National Model Code and restrictions on the use of personal electronic devices must be implemented by approved providers, refer to Child safe practices for digital technologies and personal electronic devices.

Read more about the National Model Code, watch a short explainer video, access FAQs, posters and other resources at National Model Code.

Manage risk in physical spaces

Conduct a comprehensive risk assessment of all spaces. Both the service premises and on excursions. Pay attention to high-risk settings such as swimming pools and on transportation.

Download ACECQA’s Risk assessment and management template for Excursions from Quality Area 2 - Children’s health and safety (in the ‘Risk Assessment and management tool’ tab). The template can be used by both NQF and CS Act services.

Keep records of risk management activities on file.
Consider risks arising from child-to-child and adult-to-child interactions.
Include identified risks and risk management strategies in:

staff and volunteer inductions
supervision
ongoing training of staff and volunteers.

Consider cultural safety risks. Is your service environment welcoming to:

Aboriginal people
people from diverse cultural backgrounds?

Pay attention to the children’s safety, diverse needs and vulnerabilities. Consider any barriers that might prevent children from raising concerns.
Identify and record the service’s child safety risks in a risk register or similar document.

Ensure strategies are in place to manage those risks.
For NQF services, add plans or actions to the service’s Quality Improvement Plan (QIP).

Train staff and relevant volunteers on risk management policies and procedures.

For NQF and CS Act services, download ACECQA’s Risk assessment and management tool from Quality Area 2 - Children’s health and safety (in the ‘Risk Assessment and management tool’ tab). It includes:

risk management
completing a risk assessment
activities to build understanding of risk assessment
templates and other resources.
Supervise appropriately

Adequate supervision of children of all ages is essential.

Supervision is more challenging for OSHC services as many premises are not purpose-built.

Develop strategies to adequately supervise dark spaces, stairwells, private spaces, corners, and vehicles. This is important for services operating on school grounds.
Inform children about off-limit spaces, including out-of-bounds areas, storerooms and staff rooms.
Avoid activities where one person is alone with a child or children.
Keep records of any intervention orders and court orders about access. Keep them on the child’s enrolment record.
Make sure staff know who is authorised to collect children.
Use observation aids such as windows, concave mirrors, and CCTV. Consider the balance between appropriate visibility and respecting staff and children’s privacy.
Improve lighting in dark areas.
Make sure children know how to raise concerns and where to go if they need help.
Organise professional learning on risk, harm prevention and hazard awareness.
Review incidents against policies and procedures. Where appropriate, ask children about their experience, and make improvements as needed. This may only be appropriate for school-aged children.

Promote a culture of online and physical safety for all children

Inform children and their families about:

appropriate use of the service’s technology
safety tools
how to seek help and report concerns, including cyberbullying and online grooming
share your Safe Use of Digital Technologies and Online Environments Policy and procedures.

Keep up to date with current online safety issues and expert information. Examples include the Office of the e-Safety Commissioner that offers:

an early years eSafety program for child under 5 with useful information, resources and checklists
an eSafety professional learning course about online safety for early childhood educators, that offers self-paced online modules.

Promote activities that raise awareness to prevent bullying and violence. For example, the National Day of Action against Bullying and Violence.
Create a safe environment for people who may be experiencing family violence.

Services must align to the MARAM framework over time. Find out more: Information sharing and MARAM reforms.
Services must also create an environment where children feel comfortable:

talking about family violence experiences, and
seeking support (MARAM responsibility 1).

Ask for children’s permission before taking their photo. They will learn about consent, and to control the use of their image.
Carefully consider the way your service shares information about children with families. Make sure:

the platform keeps children safe, and only allows access to current families
online platforms are password protected
children still attend the service at the end of each year and remove access to families who have left.

Online safety for preschool children

Services educating preschool aged children should start teaching children about online environments. Children will be using service-owned devices at this age.

all devices should have current and updated cyber security protection and use security settings to lock down content
children should be closely monitored while they use devices
consider using play-based online safety activities such as Playing IT Safe developed by the Australian Federal Police and the Alannah & Madeleine Foundation, or other resources developed by recognised authorities
include information in your Safe Use of Digital Technologies and Online Environments Policy and procedures.

Online safety for school aged children

Online safety is different for school aged children attending early childhood services such as OSHC or vacation care.

At this age some children may bring their own device and wish to use it at the service.

Services must decide if they allow children to use their own devices or not.
The service must have a Safe Use of Digital Technologies and Online Environments policy and procedures that outlines:

how personal devices (or service devices) can be used safely
how educators will ensure proper supervision
what are the consequences if children breach these policies.

Help children use the internet and social media in age-appropriate ways. Use resources from the Office of the e-Safety Commissioner such as eSafety Kids.
Prohibit children from signing up to unauthorised third-party services. Tell this expectation to children, families and the service community.
Use filtering software on service-based devices.
Inform children about online safety risks in an age-appropriate way, including:

cyberbullying and trolling
invasion of privacy or digital surveillance
inappropriate sharing of images
phishing, harvesting of personal information or data theft
identity theft
malevolent software (malware)
offensive images and messages
age-inappropriate online content
impersonation/catfishing
grooming.

Encourage families to use parental controls on personal devices.
Discuss online safety with staff, volunteers, families and children often.
Tell children to speak toa trusted adult if they see:

inappropriate imagery
content that upsets them.

Promote acceptable behaviour by staff and volunteers

Your staffing policy and procedures must align with theNational Model Code for Taking Images or Videos of Children while providing early childhood education and care (the National Model Code).
Include in your Code of Conduct:

use of social media, email, instant messages, SMS and other apps
misuse of digital devices and unacceptable behaviour.

Include in your Child Safety and Wellbeing policy (Child Safe Environment policy) and Safe Use of Digital Technologies and Online Environments policy:

use of service-issued devices and personal devices
acceptable and non-acceptable online behaviour
guidelines for taking, storing and using images and videos of children.

Outline acceptable use of personal devices by staff and volunteers.
Review communication protocols once a year. Consider emerging services and technologies, such as disappearing message services.
Protect children’s privacy. Support them to limit the amount of information they provide online.
Train staff about information security. Better understanding can reduce the risk of phishing or malware.

Handle breaches and concerns

Uphold policies. Report breaches in line with complaints handling processes and the Code of Conduct.
Make sure there is a clear and easy way to report online issues or concerns for:

children
families and carers
staff, and
volunteers.

Conduct checks when engaging contractors and services

Check contractors before they start work. A new contractor presents new risks to children.

Request a valid Working with Children Clearance.
Give contractors your service Code of Conduct and Child Safety and Wellbeing policy (Child Safe Environment policy).

Make child safety a feature in legal contracts. The Victorian Government Common Funding Agreement has this as a standard.
Conduct a Privacy Impact Assessment before you use any software at the service. Make sure it keeps children and families’ personal information safe.

Collect compliance information

Check every contractor’s Working with Children Clearance when they first enter the service. + Nominate a staff member to collect this information.

Keep records of processes followed to check contractors.

Make sure service providers meet the Child Safe Standards. Include this in the contract.

Contractors on the premises

Supervise outside contractors at all times when they are on service premises. Unauthorised people on service premises must be under direct supervision. This must be by a staff member.
If a contractor breaches the service’s Child Safe Standards policy:

the contractor cannot work at the service until you resolve the issue
tell them that they are not complying and provide an opportunity to fix the problem
if the issue is serious, contact the relevant authorities. (ADD LINK)

NQF Child Safety Guides

The two NQF Safety Guides focus on creating, maintaining and improving a child safe culture in early childhood services. They include:

information on each Child Safe Standard
case studies
questions to guide reflection
additional reading and resources.
Download the guides and extra tools

The two NQF Safety Guides include information and practical guidance:

NQF Child Safe Culture Guide
NQF Online Safety Guide. There are also additional resources:
NQF Child Safe Culture – Self-assessment and risk assessment tool
NQF Online Safe Culture – Self-assessment and risk assessment tool
Child Safety incident response template – Responding to complaints, concerns, allegations and disclosures
Reporting and Responding Schemes tool. Download these resources at Child Safety, together with links to additional ACECQA resources about child safety.

Additional resources

Understand the Standards

The Commission for Children and Young People (CCYP) have information for all types of organisations that must comply with the Child Safe Standards. This includes:

CCYP | Resources and support for the Child Safe Standards
CCYP | Translated resources about the Child Safe Standards Note: information isn’t tailored for early childhood services.

Possible next steps

Read more about all the Child Safe Standards (opens in a new window)in early childhood services.

Education & training

Updated 26 March 2026

Victorian Early Childhood Regulatory Authority (VECRA)

Economic Growth Statement

Mini vic.gov.au

Child safety in physical and online environments

Early childhood

On this page

Keeping children safe in physical and online environments

Child Safe Standard 9

Implement Standard 9

NQF Child Safety Guides

Additional resources

Possible next steps

About the VIC Government

Grants and programs

Jobs and careers

Arts, culture and heritage

Business and the workplace

Communities

Education and training

Environment, water and energy

Finance and economy

Housing and property

Law and justice

Safety and emergencies

Science and technology

Sport and recreation

Traffic and transport

Working in the Victorian Government

Child safety in physical and online environments

Early childhood

On this page

Keeping children safe in physical and online environments

Child Safe Standard 9

Implement Standard 9

NQF Child Safety Guides

Additional resources

Possible next steps

Related links