Since 1 September 2025, having a CCTV system at your childcare centre is no longer sufficient on its own. The updated National Quality Framework now requires approved providers to have a written, current CCTV policy that addresses all aspects of how surveillance technology is used, maintained, and governed at the service. This policy must reflect the 2025–2026 reforms, centres operating on pre-reform documentation are operating with a compliance gap.
This guide covers exactly what your CCTV policy must include, how to structure it, and the common gaps that cause compliance failures during assessment visits.
Why a Written CCTV Policy Is Now Mandatory
The NQF amendments that took effect in September 2025 introduced a new policy obligation under Quality Area 2. The policy requirement exists because CCTV introduces specific obligations around privacy, data handling, consent, access, and staff conduct that must be documented and actively managed.
An undocumented or outdated CCTV policy is not a minor administrative oversight, it is a failure of your Quality Area 2 documentation that can directly affect your service’s rating.
Core Elements Your CCTV Policy Must Address
1. Purpose and Scope
The policy must clearly state the purpose of CCTV surveillance at your centre. This typically includes child safety monitoring, perimeter security, and documentation of safety events. The scope section should specify which areas of the centre have CCTV coverage and, critically, which areas do not (and why).
2. Camera Placement and Coverage
Your policy must document where cameras are positioned, what each camera covers, and the rationale for that placement. Areas where cameras must not be positioned (toilets, change areas, breastfeeding spaces) must be explicitly excluded. Camera placement decisions should be informed by a risk assessment of the physical environment.
3. Data Retention and Storage
How long is footage retained, where is it stored, and who manages storage? Your policy must specify the retention period (typically 28–90 days depending on your risk assessment), the storage medium and location (local server, cloud, third-party), and the process for secure deletion of footage at the end of the retention period.
4. Access and Authorisation
Who is authorised to access CCTV footage, under what circumstances, and with what level of authorisation? Your policy must list authorised roles (e.g. Nominated Supervisor, Approved Provider Representative) and specify the process for requesting, approving, and documenting footage access. Unauthorised access to CCTV footage by any staff member is a policy breach.
5. Parent and Guardian Consent and Notification
Families must be informed that CCTV surveillance is in operation at the centre. Your policy should specify how consent is obtained (typically through the enrolment agreement), what families are told about the scope and purpose of surveillance, and their rights to request footage access in specific circumstances.
6. Staff Obligations
All staff must understand their obligations under the CCTV policy. This includes what constitutes appropriate and inappropriate use of the system, obligations to report CCTV-detected incidents, and consequences for policy breach. Your training records should show that all staff have received CCTV policy training.
7. Connection to Incident Response Procedures
Your CCTV policy should explicitly link to your incident response procedures, specifically, how CCTV footage is used as part of incident documentation and notification. For centres using real-time alert management systems, the policy should describe how automated detections trigger the response workflow. See our guide on why CCTV alone is not enough for context on why this integration is critical.
Personal Device Obligations and CCTV Policy
The September 2025 personal device ban is closely related to your CCTV policy, both fall under the digital safety amendments to Quality Area 2. Many providers find it practical to document device and CCTV obligations in a combined ‘Digital Technologies and Surveillance Policy’ rather than separate documents. This is acceptable, provided both topics are addressed comprehensively.
Common Policy Gaps That Cause Audit Failures
- Policies that pre-date the September 2025 amendments and do not address the new requirements
- Policies that describe camera locations but not access authorisation or data retention periods
- Policies with no connection to incident response procedures
- Policies that list authorised staff but have no process for documenting actual footage access
- Policies that have not been reviewed in the current 12-month period
Policy Review and Currency
Your CCTV policy must be reviewed at least annually or whenever there is a change in your physical environment, staff structure, or relevant legislation. The date of last review should be recorded on the policy document itself, and a record of each review should be kept.
For the full context of your CCTV documentation obligations within the NQF, see our complete NQF child safety compliance guide.
Summary
A well-constructed CCTV policy demonstrates to assessors that your service has thought carefully about how surveillance technology is governed and connected to your broader child safety framework. It is not a bureaucratic exercise, it is evidence that your centre takes the obligations of Quality Area 2 seriously. For centres that want their CCTV system to actively contribute to compliance documentation, SafeDay integrates with your existing cameras to provide real-time alerts and automatic incident records.
Book a free SafeDay consultation and review your CCTV compliance posture with our team.
