Child Wellbeing and Safety (Child Link) Regulations 2019

The instrument revolves around a small set of core legal concepts drawn from and calibrated to the Act: relevant service, first contact, prescribed service or program, prescribed person, prescribed purpose, Child Link entry and Child Link identifier, and registrable event. Each concept is concretised in the text and linked to specific Act provisions.

Relevant service. The Regulations identify a specific class of service that, for the purposes of the Act’s definition of "relevant service" in s 46A, is to be treated as relevant: a non‑council Maternal and Child Health provider (reg. 5). The definition in reg. 4 states that this means a State‑funded service not under council control that provides health advice to parents and caregivers of children under six years, with examples (Aboriginal‑led MCH services and community health organisations).

First contact and prescribed event. The Act’s mechanism for creation of Child Link entries turns on a child’s "first contact" with a relevant service. The Regulations specify that, for non‑council Maternal and Child Health providers, "the first notification received by a non‑council Maternal and Child Health provider in relation to the child is a prescribed event" (reg. 6). That fixes the trigger for Secretary action (create Child Link entry and allocate identifier) where the first contact is with such a provider; the Secretary’s role flows from the Act (see reg. 6 reference to s 46C(2)(h) of the Act).

Prescribed services, purposes and data management. The Regulations list two prescribed services for specified Acts provisions: the Registrar of Births, Deaths and Marriages and non‑council Maternal and Child Health providers (regs 8 and 9). For each prescribed service the instrument prescribes narrowly defined purposes tied to familiar administrative functions: for the Registrar, the registering of a registrable event in the Registry of Births, Deaths and Marriages; for the non‑council MCH provider, providing health advice to parents and other caregivers of children under 6 (regs 8(1)(b), 8(2)(b), 9(1)(b), 9(2)(b)). Those purpose statements define the lawful scope for collection, use and disclosure under the Act’s data‑management and collection provisions (ss 46G, 46H).

Prescribed persons and Child Link users. Reg. 10 prescribes persons who may disclose information to the Secretary (the Registrar and persons employed or engaged to provide MCH programs to a non‑council MCH provider). Reg. 11 prescribes Child Link users and the purpose for which they may use Child Link information. The table in reg. 11(1) identifies ten items, each pairing a class of person with a narrow set of purposes. Authorisations are typically required in writing by an identified officer (for example, the person with overall management and control, the Secretary, a principal officer, a chief executive officer) and certain items impose numerical limits (e.g. not more than two persons for items 5 and 7, not more than one person for item 10) (regs 11(2)-(4)).

Interlocking definitions. The Regulations import and cross‑refer definitions from other Victorian statutes, notably the Children, Youth and Families Act 2005, the Children’s Services Act 1996, and the Education and Care Services National Law (Victoria) by specifying that certain terms "have the same meaning as" in those Acts (reg. 4). This makes the Regulations operationally dependent on definitions elsewhere for notions such as Aboriginal agency, approved provider, nominated supervisor, out of home care service, protection order, and several role and organisational descriptors.

Procedure and authorisation. Many permissions and prescribed uses are conditional on written authorisation by a specified officer or a delegation under the Children, Youth and Families Act 2005 (see items 2-7 and 10 in reg. 11). That makes written authorisation an administratively significant gating mechanism: who can be a Child Link user, and for which purpose, is a function of internal authorisations and external authorisations by the Secretary or chief executive officer as specified.

Temporal and administrative scope. The Regulations commenced in July 2019 (reg. 3; Endnotes) and have been amended in 2021 and 2025 (Table of Amendments). They will sunset ten years after making under the Subordinate Legislation Act 1994, on 9 July 2029 (Endnotes), so their operation is time‑bounded unless extended or remade.

The Regulations create duties and permissions that affect a defined set of public and non‑government actors, and indirectly affect children and their families whose data will be included in the Child Link Register.

Non‑council Maternal and Child Health providers. The clearest immediate effect falls on State‑funded MCH providers that are not under local council control. The Regulations designate such services as a relevant service (reg. 5), prescribe the first notification received by such a provider as the prescribed event for first contact (reg. 6), make them a prescribed service for purposes of particulars to be included in the Register (reg. 7), and prescribe them for collection, use and disclosure and data management (regs 8(2), 9(2), 10(2)). These designations mean those providers are both sources of information for the Child Link Register and potential points at which a child will acquire a Child Link identifier.

Registrar of Births, Deaths and Marriages. The Registrar is a prescribed service for collection, use and disclosure and data management connected to registering registrable events (regs 8(1), 9(1), 10(1)). The Regulations therefore permit data sharing between the Registrar and the Secretary in relation to registrable events (death and surrogacy arrangements as defined in reg. 4), creating an administrative link between the civil registration system and Child Link.

Employees and contractors who provide MCH programs. Reg. 10(2) and reg. 11(1) item 1 prescribe persons employed or engaged to provide maternal and child health programs for a non‑council MCH provider as prescribed persons and Child Link users, subject to written authorisation by the management of the provider. That means frontline clinicians, nurses, Aboriginal‑led MCH staff and similar program staff may be authorised to access or disclose information to the Secretary under the Act once authorised in writing.

Aboriginal agencies, Aboriginal Children in Aboriginal Care providers, and Aboriginal‑led organisations. The 2025 amendments inserted definitions and bespoke items in the Child Link users table. Items 2-5 and 8 in reg. 11 enumerate roles for principal officers of Aboriginal Children in Aboriginal Care providers and other Aboriginal agencies, persons in delegated case management roles, and staff of Aboriginal‑led organisations focused on childhood services implementation and policy. These provisions directly affect Aboriginal community governance structures and the persons they authorise to use Child Link information, and require written authorisation by the Secretary or principal officer as specified.

Community‑based child and family services and out of home care services. Items 6 and 7 in reg. 11 prescribe chief executives and senior staff of these services to be authorised Child Link users for performance of case management functions in relation to children subject to protection or permanent care orders under the Children, Youth and Families Act 2005.

Schools and education and care services. Item 9 extends access to persons employed to provide student support services in schools (authorised in writing by the Secretary to the Department of Education) for identification and planning of health and wellbeing services. Item 10 permits a nominated supervisor of an approved education and care service or approved children’s service to be authorised in writing by the approved provider to provide education and care and related services to enrolled children.

The Secretary to the Department of Families, Fairness and Housing. Several permissions and authorisations are vested in the Secretary: the Secretary is the authorising officer for principal officers of Aboriginal Children in Aboriginal Care providers and for other specified agency principal officers (reg. 11 items 2 and 4), and the Secretary is central to the Act’s processes for creating Child Link entries and allocating identifiers where prescribed events occur (reg. 6 referencing s 46C(2) of the Act). Accordingly, the Secretary is the administrative decision‑maker for at least some access and authorisation pathways.

Children and families. Although not addressees of duties in the Regulations, children and their families are the subjects of the Register and the source/targets of data flows: the regs identify what information may be collected, by whom, and for what purposes (regs 7-11). The definition of "registrable event" in reg. 4 includes child death and surrogacy, which will trigger Registrar‑linked purposes.

Organisational managers. The person who has overall management and control of a non‑council MCH provider, chief executive officers of specified services, and principal officers of Aboriginal agencies are required to authorise access in writing where the Regulations require written authorisation (reg. 11 table and notes). That places managerial responsibilities on these officers for internal governance, recordkeeping, and compliance.

Indirectly affected entities. Because the Regulations import meanings from the Children, Youth and Families Act 2005, the Children’s Services Act 1996 and the Education and Care Services National Law (Victoria) (reg. 4), organisations governed by those statutes will be affected through cross‑references. Providers must therefore reconcile Child Link obligations with licensing, registration and care obligations arising under those other Acts.

The Regulations do not create freestanding criminal duties; rather they prescribe which persons, services and events fall within the Act’s statutory scheme and set administrative duties and procedural rights that flow from that scheme. The core duties and rights are administrative and disclosure‑management in nature, and most are conditional on written authorisations specified in the Regulations.

Duty to trigger Child Link creation on prescribed event. Where the first contact with the relevant service is defined by the Regulations to be the first notification received by a non‑council Maternal and Child Health provider, the Secretary must create a Child Link entry and allocate a Child Link identifier triggered by that prescribed event under the Act. The Regulation itself (reg. 6) prescribes the event; the underlying duty to create the entry and allocate the identifier is in the Act provisions cross‑referenced in reg. 6 (s 46C(2) of the Act). Practically, this requires providers to be prepared to record and send the first notification data to the Secretary where applicable and for the Secretary to undertake the identifier allocation.

Collection, use and disclosure for prescribed purposes. Regs 8 and 9 specify that the Registrar of Births, Deaths and Marriages and non‑council Maternal and Child Health providers are prescribed services for the purposes of sections 46G and 46H of the Act. Those sections in the Act regulate collection, use and disclosure and data management; the Regulations narrow the legal bases to specified purposes: registration of registrable events for the Registrar, and providing health advice to parents and caregivers for non‑council MCH providers (regs 8(1)(b), 8(2)(b), 9(1)(b), 9(2)(b)). The practical duty is therefore to limit collection, use and disclosure to those prescribed purposes where the Act requires a prescribed purpose.

Disclosure to the Secretary by prescribed persons. Reg. 10 prescribes two classes of person as authorised to disclose information to the Secretary under section 46I(1)(k) of the Act: the Registrar of Births, Deaths and Marriages for maintenance of the Register (reg. 10(1)); and persons employed or engaged to provide maternal and child health programs for a non‑council MCH provider (reg. 10(2)). Those classes gain the right to disclose to the Secretary for the specified purposes; conversely, recipients must handle the disclosures in accordance with the Act’s constraints.

Authorisation and role requirements for Child Link users. Reg. 11 specifies who may be a Child Link user, and for which purposes. Many entries require written authorisation by a specified officer (for example, the person with overall management and control of the non‑council MCH provider, the Secretary to the Department of Families, Fairness and Housing, the chief executive officer of a service, or the approved provider) (reg. 11 table). The Regulation therefore creates a managerial duty to issue written authorisations and an operational duty on authorised persons to use data only for the prescribed purposes in Column 2 of the table. Several entries impose concurrency limits (regs 11(2)-(4)), which create a duty on agencies to monitor and enforce headcount limits for authorised users.

Delegation and equivalence conditions. Some items require the person to be in a role "equivalent to, or more senior than, an employee of the Department of Families, Fairness and Housing classified as a Child Protection Practitioner Grade 3" before receiving an authorisation (reg. 11 items 3, 5, 7). That is a job‑grade equivalence test that imposes personnel standards as preconditions to authorisation, creating a duty on agencies to verify role equivalence.

Rights to use Child Link data, conditional and purpose‑limited. Authorised users gain rights to identify, plan and provide services as specified in Column 2. For example, item 1 permits authorised maternal and child health program staff to provide care and services to children attending the non‑council MCH provider; item 8 permits authorised staff of Aboriginal‑led organisations to identify children not participating in services and to assist in planning and provision of education, care and services. These rights are narrow and purpose‑bound in the table.

Record‑keeping and internal governance duties implied by written authorisations. Because authorisations must be in writing and the number of authorised persons is limited in some cases, organisations have administrative duties to maintain written authority records, enforce concurrency limits, and ensure that authorised persons meet the role equivalency and seniority conditions specified in the Regulations.

Cross‑Act duties. Several rights and duties require reference to other statutes: the Children, Youth and Families Act 2005 is the source of delegated powers (section 18 and section 18B delegations referenced in reg. 11 items 2 and 3); Part 7A of the Act supplies the definition of approved children's service and approved provider (reg. 4); other role definitions come from the Children’s Services Act 1996 and the Education and Care Services National Law (Victoria) (reg. 4). Entities must therefore comply with reporting and delegation obligations across multiple Acts when implementing Child Link authorisations and data flows.

Temporal duty to comply. The Regulations commenced on 16 July 2019 (reg. 3) and will sunset on 9 July 2029 (Endnotes). Duties to maintain authorisations and access rights therefore persist while the Regulations are in force; expiry will remove the instrument unless remade or extended.

The Regulations themselves do not set out penalties or direct criminal sanctions in their text. Their primary function is to prescribe services, persons, events and purposes for the statutory data collection and sharing powers in the Child Wellbeing and Safety Act 2005. Consequently, enforcement and penalties for misuse, unauthorised disclosure, or failure to comply will be governed by the Act’s enforcement provisions, related offences and any administrative sanctions the Act provides. The Regulations repeatedly reference relevant provisions in the Act for collection, use, disclosure and access (for example, ss 46G, 46H, 46I, 46K and s 46C(2)), and do not independently create penalty regimes.

Operational accountability and administrative enforcement. While the Regulations do not prescribe penalties, they create administrative obligations that will be enforced through internal governance, authorisation controls and the Act’s framework. For example, written authorisation requirements (reg. 11) and concurrency limits (reg. 11(2)-(4)) are administrative controls; enforcement mechanisms for breaches of those controls will be the responsibility of the sponsoring agencies and the Secretary under the Act’s oversight and any applicable disciplinary, civil or criminal provisions in the Act or other statutes.

Data‑protection liability pathways. The Regulations authorise specific disclosures and uses; any misuse of Child Link data outside the prescribed purposes or unauthorised access by persons not meeting the written authorisation requirements would engage legal risk under the Act and potentially other privacy and public sector information secrecy provisions. The Regulations’ cross‑references to other Acts and to prescribed purposes create a compliance standard that could underpin adverse administrative or legal findings if not followed. However, the text of these Regulations does not itself specify fines, imprisonment or express enforcement steps , you must look to the Act and other applicable law for express sanctions.

Delegation and authorisation oversight. Many authorisations depend on the Secretary or specified officers (reg. 11 table). This concentrates gatekeeping discretion with those officers and produces an administrative route by which enforcement can be exercised: withdrawal or non‑issue of authorisations; direction on permitted uses; and internal review of authorisations. The Regulations therefore create enforcement leverage through access control rather than through regulator‑imposed financial penalties.

Sunset as regulatory control. The Endnotes state that the Regulations will sunset on 9 July 2029. Sunset provisions perform a regulatory control function: they require executive review if the scheme is to continue, and thus provide a time‑limited enforcement and oversight opportunity. The Regulations themselves are silent on monitoring, audit, compliance reporting, or redress mechanisms; those functions are likely to be performed under the Act and departmental policies.

Interaction with other enforcement regimes. Because the Regulations import definitions and conditions from the Children, Youth and Families Act 2005, the Children’s Services Act 1996, and the Education and Care Services National Law (Victoria), failures to comply with authorisation and data‑sharing conditions could also implicate enforcement regimes under those statutes, licensing or accreditation consequences, or professional regulation, depending on the nature of the breach and the actor involved. The Regulations do not specify how enforcement across those regimes will be coordinated.

The Regulations are expressly designed to be read and applied in tandem with the Child Wellbeing and Safety Act 2005 and several other Victorian Acts that supply key definitions and delegation frameworks. The instrument embeds cross‑Act dependencies and prescribes specific interactions.

Primary dependency on the Act. The Regulations are made under sections 46ZC and 47 of the Child Wellbeing and Safety Act 2005 (reg. 2) and repeatedly reference specific provisions of the Act as the functional hook for the Regulations’ prescriptions: the definition of relevant service (s 46A) (reg. 5), the definition of first contact (s 46C(2)) (reg. 6), particulars to be included in the Register (s 46D(1)(m)(vii)) (reg. 7), and the Act’s data collection, data management and disclosure powers (ss 46G, 46H, 46I, 46K) (regs 8-11). The Regulations therefore operate as a delegated instrument that fills in statutory blanks left by the Act.

Cross‑referenced statutory definitions. Reg. 4 imports or aligns many terms with definitions in other Acts: Aboriginal agency, Aboriginal person, out of home care service, principal officer, protection order, approved children’s service, approved education and care service, nominated supervisor, approved provider, case management functions, and community‑based child and family service are expressly given the "same meaning as" corresponding terms in the Children, Youth and Families Act 2005, the Children’s Services Act 1996, or the Education and Care Services National Law (Victoria). That creates an interdependence requiring implementers to consult and apply those other Acts’ definitions when deciding eligibility and role equivalence.

Delegations and powers under the Children, Youth and Families Act 2005. Several items in reg. 11 depend on delegations and authorisations under the Children, Youth and Families Act 2005. Item 2 authorises the principal officer of an Aboriginal Children in Aboriginal Care provider "who is authorised in writing by the Secretary to the Department of Families, Fairness and Housing" to perform functions under section 18 of the Children, Youth and Families Act 2005. Item 3 refers to delegations under section 18B of that Act. Item 4 authorises principal officers of Aboriginal agencies who are "authorised in writing by the Secretary" to perform case management functions. Thus, the Child Link permissions are built into the existing delegation and case management architecture established by the Children, Youth and Families Act 2005.

Registration law interface. The Regulations explicitly connect the Registrar of Births, Deaths and Marriages and the Register of Births, Deaths and Marriages to Child Link operations (regs 8(1), 9(1), 10(1)). The definition of "registrable event" in reg. 4 references the Births, Deaths and Marriages Registration Act 1996 and the Assisted Reproductive Treatment Act 2008. This creates a path for civil registry events (death; surrogacy) to be processed in relation to Child Link purposes, so operators must coordinate registry processes and Child Link data requirements.

Education and child care law. Reg. 11 items 9 and 10 import roles from the Education and Care Services National Law and the Children’s Services Act. An approved provider or nominated supervisor under those Acts can be authorised to access Child Link data for education, care and wellbeing purposes, and those authorisations are conditional on internal written authorisation by the approved provider. Implementers must therefore align Child Link authorisation practices with obligations under the education and child care regulatory frameworks.

Privacy and public sector information law. The Regulations specify prescribed purposes and authorised disclosures but do not themselves recite privacy obligations. Since the Regulations work through the Act’s provisions for collection, use and disclosure (ss 46G, 46H, 46I, 46K as invoked), implementers must read the Regulations together with the Act’s privacy, confidentiality and use restrictions and the Victorian Information Privacy Framework and any Public Records or Freedom of Information regimes that apply to the relevant agencies. The instrument’s cross‑Act dependencies and prescribed purposes mean that privacy compliance must be achieved through the combined statutory architecture.

Subordinate legislation and sunset. The Endnotes explain that the Regulations were made under the Subordinate Legislation Act 1994 and will sunset after ten years. The Table of Amendments records SR Nos. 142/2021 and 107/2025. Any change in the parent Act, or amendments to the referenced Acts, may require re‑examination of these Regulations to ensure continued alignment. Conversely, if the definitions in the other Acts are amended, the scope of the Child Link Regulations will change automatically because of the cross‑references.

The Regulations have been amended at least twice since their original making. The Table of Amendments and marginal notes in the Regulations identify the amending instruments and the regulations affected.

Original making and commencement. The Regulations were made by the Governor in Council on 9 July 2019 under sections 46ZC and 47 of the Child Wellbeing and Safety Act 2005 and came into operation on 16 July 2019 (reg. 3; Endnotes).

Child Wellbeing and Safety (Child Link) Amendment Regulations 2021, S.R. No. 142/2021. The 2021 amendment instrument, made on 23 November 2021 and commencing on 1 December 2021 (Table of Amendments), substituted and inserted several provisions. The marginal notes within the text indicate multiple substitutions and insertions attributed to S.R. No. 142/2021 reg. 7, including substitution of regs 5-7 and insertion of regs 8-10 in their earlier numbering. Reg. 1(b) amendment was made by S.R. No. 142/2021 reg. 5(1), and reg. 1(c) and 1(d) were inserted by S.R. No. 142/2021 reg. 5(2). The 2021 amendments therefore expanded the Regulations’ objectives and reworked the prescribed services and prescribed event mechanics to bring non‑council MCH providers squarely into the Child Link architecture (see the notes accompanying regs 1, 5-10).

Child Wellbeing and Safety (Child Link) Amendment Regulations 2025, S.R. No. 107/2025. The 2025 amendments, made on 14 October 2025 and commencing on 22 October 2025 (Table of Amendments), introduced a suite of new definitions into reg. 4 and substituted reg. 11. The marginal notes indicate the insertion of definitions for Aboriginal agency, Aboriginal Children in Aboriginal Care provider, Aboriginal-led organisation, Aboriginal person, approved children's service, approved education and care service, approved provider, case management functions, community-based child and family service, nominated supervisor, out of home care service, principal officer, and protection order (reg. 4 def. inserted by S.R. No. 107/2025 reg. 5). Reg. 11 was substituted by S.R. No. 107/2025 reg. 6, producing the current comprehensive table of prescribed Child Link users and associated purposes and the concurrency limits in regs 11(2)-(4).

Record of changes in marginal notes. Throughout the Regulations, marginal notes identify where a provision has been substituted or inserted by an amending SR. For example, reg. 4 is noted as substituted by S.R. No. 142/2021 reg. 6, reg. 5-7 are substituted by S.R. No. 142/2021 reg. 7, and regs 8-11 were inserted or substituted by the later amending instruments. These marginal notes form the amendment trail embedded in the published version.

Sunset and future amendment requirement. The Endnotes state the Regulations will sunset 10 years after making under section 5 of the Subordinate Legislation Act 1994, on 9 July 2029. Unless remade or extended, the Regulations will cease then, meaning any changes in policy or practice reflected in the Regulations must be formalised before the sunset date to continue to have effect.

No explanatory details added. The Explanatory details section in the Endnotes records "No entries at date of publication." That means no explanatory memoranda or similar material is embedded in the published Endnotes beyond the Table of Amendments and general information.

The Regulations as published do not report any litigation, and the text contains no references to judicial decisions. The Explanatory details section records "No entries at date of publication" (Endnotes 3), and there are no named cases or court decisions referenced in the instrument.

Because the Regulations operate by prescribing services, persons and purposes under the Child Wellbeing and Safety Act 2005, any litigation that arises will likely involve the Act rather than the Regulations themselves. Potential litigation vectors include:

• disputes about whether an action falls within a "prescribed purpose" or whether an individual was properly authorised in writing under reg. 11;
• judicial review of a Secretary’s decision to authorise or refuse authorisation, or to allocate or withhold a Child Link identifier where the first contact event is contested;
• privacy or administrative law challenges to particular disclosures, especially where a party alleges unauthorised use outside the narrow purposes set by reg. 11 or misuse of information derived from the Registrar of Births, Deaths and Marriages under regs 8-10;
• contention about role equivalence tests (for example, whether a person’s role is "equivalent to, or more senior than" a Child Protection Practitioner Grade 3) where that equivalence is dispositive of access rights.

None of the above litigation types are recorded in the Regulations. Practitioners should therefore search case law databases and tribunal decisions for any subsequent litigation involving the Child Link Register and the Act. The Regulations do not themselves create a record of litigation; they provide the technical scaffolding that will be litigated if disputes arise under the Act.

Several practical pitfalls and implementation risks arise from the Regulations’ structure. These are concrete mechanics that implementers and advisers should watch.

Narrow, purpose‑bound data uses. Regs 8, 9 and 11 pair prescribed services and prescribed persons with narrowly stated purposes. Data collected under the Child Link rules must be used only for those prescribed purposes identified in Column 2 of reg. 11 or in regs 8 and 9. Using Child Link data for other management, research, or administrative purposes not specified risks contravening the Act’s limits. Implementers must map each use case to the specific purpose in the Regulations; broad or generic "health service delivery" descriptions will not suffice.

Written authorisation formalities. Multiple items in reg. 11 require written authorisation by a specified officer (for example, the person with overall management and control of a non‑council MCH provider; the Secretary; a principal officer or chief executive officer; the approved provider). Authorisation must be in writing. Practical risks include failures to document authorisations, failure to include scope or expiry in the written authorisation, and lack of a record trail to show that an authorised person met the criteria at the time access was given.

Concurrency limits. Reg. 11(2)-(4) impose numerical limits on simultaneous authorised persons for certain items (items 5 and 7 limited to two persons each; item 10 limited to one person). Organisations that fail to monitor these headcount caps may inadvertently permit unauthorised concurrent access, which would run contrary to the Regulations. These limits are absolute in the text; agencies must build compliance monitoring into role management systems.

Role equivalence and classification tests. Several items require that a person be in a role "equivalent to, or more senior than, an employee of the Department of Families, Fairness and Housing classified as a Child Protection Practitioner Grade 3" (reg. 11 items 3, 5, 7). These are comparative, not absolute, tests. The Regulations do not explain how equivalence is demonstrated, who certifies it, or what documentary proof is needed. Organisations must create internal criteria and evidentiary standards to show equivalence at the time of authorisation; absent such standards, disputes and disagreements will arise.

Dependency on external definitions. Many definitions are imported from other statutes (reg. 4). Changes in those Acts or their interpretations will alter the meaning of the Regulations without separate alteration of this instrument. Implementers must track changes to the Children, Youth and Families Act 2005, the Children’s Services Act 1996 and the Education and Care Services National Law (Victoria).

First notification trigger nuance. Reg. 6 prescribes that "the first notification received by a non‑council Maternal and Child Health provider in relation to the child is a prescribed event" for first contact. The Regulations do not define "first notification" in greater detail. Ambiguities can arise where multiple actors provide incomplete or duplicate notifications, where parents refuse consent, or where a notification is received electronically but not actioned. Operational procedures are needed to define what counts as the operative notification that triggers Secretary action.

Registrar link and registrable events. Reg. 4 defines registrable event narrowly (death, and surrogacy arrangement), and regs 8-10 link the Registrar’s role to registering registrable events. Practitioners should not assume that ordinary birth registrations automatically feed into Child Link processes; only the specified registrable events are linked by the Regulations. Misunderstanding this may lead to erroneous assumptions about which registry events will produce data flows.

No express privacy safeguards in the Regulations. The Regulations set who may access and for what purpose, but they do not contain operational privacy safeguards, retention limits, audit obligations or complaints processes. Those functions will be in the Act or departmental policy. Organisations must not assume that compliance with the authorisation rules alone is a full privacy compliance strategy.

Sunset date and policy discontinuity. The Regulations will sunset on 9 July 2029 unless remade. That creates a risk of policy discontinuity if stakeholders rely on the current authorisation structures beyond that date without legislative action. Agencies should plan for review and, if continuation is needed, for legislative renewal well in advance of the sunset.

Administrative concentration of authorising power. Several important authorising powers are held by the Secretary or chief executive officers (reg. 11). Concentration of authorisation can create bottlenecks, delays in authorising frontline staff, and single‑point failures if process and delegation are not optimised. Organisations must design delegation and documented processes to avoid operational delays.

This section sets out a practical compliance checklist grounded in the Regulations’ text. Each step maps to specific regulatory provisions.

1. Identify whether you are a non‑council Maternal and Child Health provider. Use reg. 4 definition and examples. If you are State‑funded, not under council control, and provide health advice to parents/caregivers of children under six, regs 5-7, 8(2), 9(2) and 10(2) will apply. If so, proceed to steps 2-8.

2. Prepare to treat the first notification as the trigger for Child Link entry. Reg. 6 prescribes the first notification received by a non‑council MCH provider as the prescribed event. Establish operational procedures to record, time‑stamp and forward required information promptly to the Secretary (consistent with the Act) so that the Child Link entry can be created and an identifier allocated. Clarify what your organisation will count as the operative "first notification" for your records.

3. Restrict data collection, use and disclosure to prescribed purposes. For the Registrar, the prescribed purpose is registering a registrable event in the Register of Births, Deaths and Marriages (regs 8(1)(b), 9(1)(b)). For non‑council MCH providers, the prescribed purpose is providing health advice to parents and caregivers of children under six (regs 8(2)(b), 9(2)(b)). Map every data element you collect and every downstream use to these purposes; record lawful bases under the Act sections cited.

4. Implement written authorisation processes. Reg. 11 requires written authorisation for a wide range of Child Link user roles. Draft template authorisation letters, specify required signatories (for example, the person with overall management and control, the Secretary, the chief executive officer, principal officer or approved provider as applicable), include scope and expiry, and keep an auditable register of authorisations. Ensure that the text of authorisation aligns exactly with the purposes set out in Column 2 of reg. 11 for the relevant item.

5. Verify role equivalence and seniority where required. Items 3, 5 and 7 require role equivalence to a Child Protection Practitioner Grade 3. Establish HR procedures to certify equivalence, maintain personnel records showing job descriptions and classification comparisons, and have a named officer attest to equivalence in writing before authorisation is issued.

6. Observe concurrency limits. For items with numerical caps (reg. 11(2)-(4)), maintain a real‑time roster of authorised staff and enforce limits. Build IT and HR controls to prevent more than the permitted number being active as authorised users at any time.

7. Ensure authorised persons use data only for the prescribed purposes. Train authorised users on the narrow purposes in the table and on the Act’s collection and disclosure rules. Create and enforce policies prohibiting repurposing of Child Link data for research, fundraising, general analytics or other non‑prescribed activities without separate legal authorisation.

8. Coordinate with the Registrar for registrable events. If your work requires interaction with the Registrar of Births, Deaths and Marriages (regs 8(1), 9(1), 10(1)), ensure you understand which registrable events apply (reg. 4 defines registrable events) and the appropriate administrative route for disclosing and receiving data linked to registration activity.

9. Align governance with cross‑reference Acts. Because the Regulations import meanings and rely on delegations under other Acts, check governance and compliance against the Children, Youth and Families Act 2005, the Children’s Services Act 1996, the Education and Care Services National Law (Victoria), and any departmental delegation instruments. For items referencing functions under ss 18 and 18B of the Children, Youth and Families Act 2005, ensure delegations exist and are documented consistently.

10. Document data flows and retention. Even though retention limits are not specified in these Regulations, document what data you will store, how long, and under what authority. Map how Child Link data will be accessed, logged and audited, and ensure records of disclosures to the Secretary and internal accesses are kept.

11. Prepare privacy impact assessments and incident procedures. Conduct a privacy impact assessment for Child Link access and sharing, document mitigations, and have breach response plans that reference the Act and departmental policies. The Regulations set access and purpose boundaries; your privacy assessment should ensure those boundaries are enforced.

12. Implement technical access controls. Limit access to Child Link data to authorised personnel through role‑based access control, multi‑factor authentication and logging. Ensure that logs capture who accessed what and for which authorised purpose to support auditability.

13. Maintain liaison with the Secretary. For authorisations that the Secretary must grant (for example items 2 and 4 in reg. 11), establish a named contact point and service level for requests. Keep copies of Secretary authorisations and any documentation of delegated authority.

14. Monitor legislative and amendment risk. Track amendments to the Child Wellbeing and Safety Act 2005 and to the other Acts from which definitions are imported. Also note the sunset date of 9 July 2029 in the Endnotes and plan for potential changes before that date.

15. Train and certify staff. Provide role‑specific training for authorised Child Link users about the limited purposes in reg. 11, about written authorisation requirements, and about the interplay with other statutory obligations. Require periodic recertification and review of authorisations.

Following these steps aligns operational practice with the specific prescriptions in regs 4-11, records required authorisations and role equivalence, and ensures that collection, use and disclosure activities are confined to the purposes authorised by the Regulations and the Act.