Child Wellbeing and Safety (Information Sharing) Regulations 2018

The Regulations centre on a small set of recurring legal concepts: "information sharing entity", "restricted information sharing entity", record‑keeping prescribed information, delegation, and the list of prescribed statutory confidentiality provisions that an information sharing entity may rely on to collect, use or disclose confidential information despite otherwise applicable prohibitions.

Information sharing entities. Regulation 5 explicitly links the Schedule 1 list to section 41R of the Act: "For the purposes of section 41R of the Act, the persons and bodies set out in Schedule 1 are information sharing entities" (reg 5). Schedule 1 is the operational catalogue of entities. It includes: departments and named Secretaries (items 2, 14, 30, 14A), statutory bodies (e.g. Commission for Children and Young People item 5, Victorian Institute of Teaching item 25), Victoria Police (item 18), Government and non‑Government schools (items 28-29), approved providers of specified early education and care services (item 31), many categories of service providers funded or engaged under State contract (multiple items), local councils and council‑contracted providers (items 19-21), health sector organisations (items 42-44, 43, 53), and others. Many schedule entries are limited by the words "to the extent that" the person or body performs particular functions, which makes the entity status conditional on function and context rather than universal coverage.

Restricted information sharing entity (Child Link Category). The Regulations create a restricted category named the Child Link Category by prescribing that the Secretary to the Department of Education "belongs" to it (reg 5B(1)). The restricted entity is permitted only the activities in paragraphs (b) and (c) of section 41S(2) of the Act, and then only for the purpose of maintaining the Child Link Register (reg 5B(2)-(3)). This is a narrower operational authorisation than the full information sharing entity status prescribed in reg 5. Regulation 5C then prescribes which officers may exercise those restricted powers on behalf of the Secretary: specified Deputy Secretary and Executive Director roles (reg 5C).

Record‑keeping as a legal obligation. Part 3 governs recording obligations and applies to most information sharing entities and restricted entities (reg 6(1)), with discrete exceptions (reg 6(1)(a) excludes entities listed at items 57 and 58; reg 6(2) provides a "reasonable belief another has recorded" exception for item 12). Regulation 7 prescribes the exact items that must be recorded in relation to a disclosure for the purposes of section 41ZC of the Act. The list includes the requesting and responding entities, the confidential information requested and disclosed, dates, the receiving entity, relevant family violence risk assessments and safety plans, whether the views of the child or parent were sought and, if not, why, and whether the child or parent were informed that the information was or would be disclosed (reg 7(a)-(i)). Regulation 8 prescribes what must be recorded when an information sharing entity declines a request to disclose: details of the request and the reason for declining (reg 8). Regulation 9 prescribes the required details when a complaint is made directly to an information sharing entity about its Part 6A functions: date, nature, actions taken to resolve, remedial or preventative action, time taken, and further steps if unresolved (reg 9(a)-(f)).

Delegation mechanics. Regulation 5A authorises certain public sector heads to delegate their information‑sharing powers, subject to limits. The Secretary to the Department of Education and the Secretary to the Department of Government Services may delegate any power, function or duty conferred on them as an information sharing entity "other than this power of delegation" to any person employed or engaged by that Secretary (reg 5A(1)-(2)). The Early Childhood Regulator is likewise permitted to delegate to persons employed or engaged under section 15 of the Victorian Early Childhood Regulatory Authority Act 2025 (reg 5A(2A)). Any delegation must be made by instrument (reg 5A(3)). The interplay with the Public Administration Act is visible in the specification of executives in reg 5C, which identifies executives "under Part 3 of the Public Administration Act 2004" as eligible to exercise restricted powers.

Permitted displacements of other statutory confidentiality provisions. Regulation 10 answers a narrow but practically significant question: which specific statutory provisions may be disregarded for the purposes of section 41ZH of the Act. The list in reg 10 includes section 347(2) of the Mental Health Act 2014, section 181 of the Personal Safety Intervention Orders Act 2010, section 41B of the Act, section 132ZC of the Disability Act 2006, sections 537(3) and 582(5) of the Children, Youth and Families Act 2005, and sections 18(3) and 99A(5) of the Magistrates' Court Act 1989 (reg 10(a)-(f)). The legal effect is that, where the Act and its conditions for sharing are engaged, these listed provisions are those that the Act is intended to be able to displace, subject to the Act's own conditions.

Tension points created by the Regulations flow from their conditional wording. Much of the Schedule operates on a function‑specific basis ("to the extent that"), which embeds conditionality about when a private contractor becomes an information sharing entity. The record‑keeping Part creates a uniform minimum data capture requirement for disclosures and refusals but explicitly exempts courts officials and allows limited reliance on other entities' records in one instance, introducing coordination dependencies. The Child Link restricted category narrows the set of permitted activities and limits who can exercise them to particular executives. Finally, reg 10's list of displaceable provisions is finite and specific; other confidentiality provisions not listed remain potential obstacles unless covered by the Act itself.

The Regulations affect three broad groups: (1) the entities that are prescribed as information sharing entities in Schedule 1 (and the employees, contractors and executives who perform the specified functions on their behalf), (2) the people whose confidential information is collected, used or disclosed under Part 6A of the Act (principally children, young people and their families), and (3) the organisations and officials that need to cooperate, record and reassure complainants or oversight bodies about how disclosures were handled.

Directly affected entities. Schedule 1 (reg 5) lists a wide range of public bodies, statutory authorities, contracted service providers and other organisations. Key categories include central government Secretaries and departments (for example, the Secretary to the Department of Families, Fairness and Housing, the Secretary to the Department of Education, the Secretary to the Department of Justice and Community Safety, and the Secretary to the Department of Government Services , Sch 1 items 2, 30, 14, 14A); statutory regulators and commissions (Commission for Children and Young People item 5; Victorian Institute of Teaching item 25; Victorian Curriculum and Assessment Authority item 26; Victorian Registration and Qualifications Authority item 27; Victorian Early Childhood Regulatory Authority item 32); Victoria Police (item 18); Government and non‑Government schools and their operators (items 28-29, 31, 41); a broad set of State‑contracted service providers delivering homelessness, AOD, mental health, family violence and other services (items 7-11, 13, 24, 33, 35-36, 39-40, 48-50, 52); local councils and council‑contracted maternal and child health providers (items 19-21); health services and community health centres (items 42-45, 43, 53-54); housing and homelessness agencies (items 4, 45, 48); aged care providers receiving State funding (item 51); disability‑sector regulators and boards (items 3, 55-56); and specialised entries such as participants in Multi‑Agency Panels and Risk Assessment and Management Panels (items 12, 22).

Conditional exposure of private contractors. A common drafting device in Schedule 1 is that many private or non‑government bodies are included only "to the extent that" they perform specified functions, often under a State contract (for example, items 7, 9, 10, 11, 15-17, 24, 33, 35-36, 39-40, 48-50, 52). That means a non‑government body may be an information sharing entity in respect of particular activities but not in respect of others. Practically, this raises compliance responsibilities for contractors delivering State funded services: they must identify the functions that bring them within Schedule 1 and ensure their internal policies, employment contracts and data handling arrangements reflect their Part 6A obligations when performing those functions.

People whose data may flow. The subject of the information sharing framework is principally children and young people and their families. The record‑keeping obligations (reg 7) require capture of items such as whether the child's views were sought and whether the child or parent were informed that confidential information would be disclosed (reg 7(h)-(i)). The Regulations therefore affect children and their parents by creating an evidentiary and administrative trail for information sharing decisions, and by enabling certain sensitive documents (family violence risk assessments, safety plans) to be recorded and attached to disclosure records (reg 7(g)).

Executives and delegates. The Regulations name particular roles that may act for restricted entities (reg 5C) and permit delegations by the Secretaries and Early Childhood Regulator subject to a formal instrument (reg 5A). Those rules affect who may legally exercise information sharing powers within government: specified Deputy Secretaries and Executive Directors may exercise Child Link powers (reg 5C), while the Secretary may delegate other powers to employees or engaged persons (reg 5A).

Complaints and oversight stakeholders. Regulation 9 prescribes what must be recorded when a complaint is made directly to an information sharing entity about its Part 6A duties. That creates a record‑keeping duty which affects how entities handle and resolve complaints, and will be relevant to oversight bodies, inspectors, auditors or tribunal processes that examine compliance with the Act.

Entities exempted from certain duties. The record‑keeping Part does not apply to entities listed at items 57 or 58 (reg 6(1)(a)), which are court officials under the Magistrates' Court Act 1989 and the Children, Youth and Families Act 2005. That carve‑out removes Part 3 obligations from judicial officials and court officers, and shifts the burden for record keeping away from the court system itself.

Indirectly affected parties. Contracts, procurement documents, and State funding arrangements are affected because many Schedule 1 inclusions hinge on performance of state‑contracted functions. Insurers, auditors, human resources managers, IT and records officers, and privacy officers within those entities will also be affected by the requirements to record and retain particular fields and documents. Finally, other information sharing entities that participate in panels and registers will be affected by the coordination demands and by the reg 6(2) "another entity has recorded it" exception which requires inter‑entity confidence about who recorded what.

In short, the Regulations map a network of public and privatised service providers into the Act's information‑sharing framework selectively and functionally, make particular officials and executives the points of lawful action for restricted functions, and place measurable record‑keeping duties on most entities that share confidential information under Part 6A. Those obligations fall on the entity performing the specified functions, including contracted providers, and on the executives who make delegation decisions.

The Regulations create duties of prescription and record‑keeping, enable delegation, restrict some activities to specified actors, and identify the statutory provisions that the Act may override. They do not themselves create the substantive power to collect, use or disclose confidential information; that power derives from Part 6A of the Child Wellbeing and Safety Act 2005. The Regulations operationalise parts of that framework by setting who counts as an information sharing entity, the records required when sharing or declining to share, and the scope of a restricted Child Link entity.

Duty to be listed and to know the functional scope. Entities named in Schedule 1 are "information sharing entities for the purposes of section 41R of the Act" (reg 5). The duty for an entity is first to identify whether the functions it performs bring it within Schedule 1. Where Schedule 1 limits an item "to the extent that" the person performs specific functions, the duty is function‑specific: a provider that receives State funding must determine whether the activity it is performing is one of the activities for which it is an information sharing entity.

Record‑keeping duties. For the purposes of section 41ZC of the Act, reg 7 prescribes the information that must be recorded in relation to a disclosure of confidential information. The list includes:

• the requesting and requesting entity (reg 7(a));
• the confidential information requested (reg 7(b));
• the date of the request (reg 7(c));
• a record of what confidential information was disclosed and the date of disclosure (reg 7(d)-(e));
• the recipient entity (reg 7(f));
• copies of specific documents prepared that are relevant to the disclosure (family violence risk assessments, safety plans) (reg 7(g)(i)-(iii));
• whether the disclosing entity sought and obtained the views of the child or the child's parent, or if not, why not (reg 7(h));
• whether the child or parent was informed that the confidential information was or would be disclosed (reg 7(i)).

When a request to disclose confidential information is declined, reg 8 prescribes that the disclosing entity must record the details of the request and the reason the request was declined (reg 8(a)-(b)).

When a complaint is made directly to an information sharing entity about its Part 6A performance, reg 9 prescribes detailed complaints recording: date received, nature, actions taken to resolve, remedial action to prevent recurrence, time taken to resolve, and further action if unresolved (reg 9(a)-(f)).

These are statutory record fields. The duty is to record the specified items "for the purposes of section 41ZC of the Act" (reg 7 heading; regs 8-9 headings). The Regulations therefore convert the Act's obligation into concrete data entries and documentary attachments that entities must maintain.

Delegation rights and constraints. Regulation 5A permits the Secretary to the Department of Education and the Secretary to the Department of Government Services and the Early Childhood Regulator to delegate any power, function or duty conferred on them as an information sharing entity, other than the power of delegation itself (reg 5A(1)-(2A)). Delegations must be made by instrument (reg 5A(3)). The right to delegate is therefore procedural rather than unlimited: the statute requires an instrument and excludes delegation of the delegation power.

Restricted entity duties and limits. The Secretary to the Department of Education is prescribed as a restricted information sharing entity in the Child Link Category (reg 5B(1)). The activities the restricted entity may carry out are limited to those set out in paragraphs (b) and (c) of section 41S(2) of the Act and, further, only for the purpose of maintaining the Child Link Register (reg 5B(2)-(3)). Regulation 5C prescribes who may exercise those powers on behalf of this restricted entity , specified Deputy Secretary and Executive Director roles with responsibilities for maintaining the Child Link Register (reg 5C).

Permission to override specific statutory confidentiality provisions. For the purposes of section 41ZH of the Act (which addresses the effect of the Act on other statutory confidentiality provisions), regulation 10 prescribes a finite list of statutory provisions that may be overridden when the Act's own conditions are satisfied (reg 10(a)-(f)). Those include provisions in the Mental Health Act 2014, the Personal Safety Intervention Orders Act 2010, the Disability Act 2006, the Children, Youth and Families Act 2005, and the Magistrates' Court Act 1989, and section 41B of the Child Wellbeing and Safety Act itself. The duty for an entity is to understand that, where the Act authorises sharing under section 41ZH, it may collect, use or disclose confidential information despite those particular statutory restrictions but not necessarily despite any other statutory secrecy provisions not listed.

Exclusions and exceptions. Part 3 (record keeping) applies to information sharing entities except those specified at items 57 and 58 in Schedule 1 (reg 6(1)(a)). There is also an exception for entities specified in item 12 of Schedule 1: a provision in Part 3 does not apply to that entity if it reasonably believes the information required to be recorded has already been recorded by another information sharing entity (reg 6(2)). Entities must therefore assess applicability of Part 3 to their status and implement inter‑agency checks before deciding not to record.

Rights to share: subject to the Act. The Regulations do not themselves create an affirmative right to collect, use or disclose confidential information; they identify who can be treated as an information sharing entity under section 41R of the Act. The actual rights to share, conditions, and defences are set out in Part 6A of the Act. The Regulations' duties are therefore largely administrative (record keeping, formal delegation, and prescribed scope), while the substantive rights and legal test for when sharing is lawful remain with the Act.

In practical terms, an entity that is listed in Schedule 1 and that satisfies the Act's substantive criteria has the duty to capture the specified records when it shares or refuses to share confidential information, may delegate its functions if it is one of the named Secretaries or the Early Childhood Regulator (and only by instrument), and must observe the operational limits where an entry is function‑specific or restricted. Compliance with these duties will be relevant to demonstrating lawful exercise of the Act's sharing powers should oversight or review follow.

The Regulations themselves do not include express penalty clauses or a schedule of fines or criminal offences. Their enforcement role is procedural and evidentiary: they prescribe the information that must be recorded "for the purposes of section 41ZC of the Act" (reg 7 heading), and identify the statutory confidentiality provisions that may be prescribed for the purposes of section 41ZH of the Act (reg 10). That drafting choice means any enforcement, disciplinary, or sanctioning powers that arise for failure to comply with the recording, delegation or other obligations in the Regulations must be sought in the Child Wellbeing and Safety Act 2005 or in any other statute that creates compliance, oversight or penalty mechanisms.

Record‑keeping as the primary compliance lever. The Regulations' principal enforcement mechanism is to standardise the record trail that an information sharing entity must create when it shares or refuses to share confidential information. That record trail is likely to be the primary basis on which regulators, oversight bodies, auditors, or tribunals assess whether the entity complied with Part 6A of the Act. For example, reg 7 requires an entity to record whether the child's views were sought and whether the child or parent were informed of disclosure (reg 7(h)-(i)). Absence of those prescribed records may affect the evidentiary position of an entity under the Act, but the Regulations do not themselves attach a monetary or criminal penalty.

Delegation and instrument form. Regulation 5A requires delegations by the named Secretaries and the Early Childhood Regulator to be made by instrument (reg 5A(3)). Failure to have an instrumented delegation could have legal consequences because a purported delegate may lack authority to exercise the information sharing functions. Any challenge to actions taken by an unauthorised delegate would turn on the administrative law and agency law principles in broader public law rather than on a penalty in the Regulations themselves.

Complaints recording and oversight. Regulation 9 prescribes how entities must record complaints about their Part 6A functions. Those complaint records will be relevant to internal disciplinary processes and to any subsequent external oversight or review. The Regulations therefore create an administrative obligation that feeds enforcement channels without itself specifying sanctions.

Interaction with the Act for penalty rules. Because the Regulations implement particular sections of the Act (for example, reg 7 and the heading referencing section 41ZC; reg 10 referencing section 41ZH), any penalties for breaching the Act's substantive or administrative obligations would be found in the Act or in other relevant statutes. The Regulations do not attempt to create parallel penalty provisions. Practitioners should therefore consult the Child Wellbeing and Safety Act 2005 for the available enforcement mechanisms and sanctions that may follow from non‑compliance with Part 6A duties or related provisions.

Practical risk of non‑compliance. The immediate practical consequences of breaching the Regulations are administrative and reputational: missing or incomplete records, unauthorised delegations, or improper handling of restricted Child Link powers may expose an entity to investigation, audit findings, corrective mandates, civil claims for privacy breach or negligence (depending on other law and facts), and scrutiny by oversight agencies. The Regulations increase the visibility of practices by requiring specified documentary substance to be kept: that increases the likelihood that omissions will be discovered in audits or complaints, even though the instrument itself does not set penalties.

In short, enforcement under these Regulations will be exercised indirectly through the Act's frameworks, administrative law review, complaint handling and audit processes. The Regulations create mandatory procedural duties (recording, instrumented delegations) that will be relied upon as evidence of compliance with Part 6A; they do not create standalone fines or criminal sanctions.

The Regulations are explicitly cross‑referenced to a number of other Acts and regulatory instruments. Their effect is to slot the operational aspects of Part 6A of the Child Wellbeing and Safety Act 2005 into the existing statutory landscape by identifying entities, prescribing record‑keeping information that links to family violence instruments, and specifying which external confidentiality provisions may be displaced under section 41ZH of the Act. The principal interactions are as follows.

Reference to the Child Wellbeing and Safety Act 2005. The Regulations are made under sections 46ZC and 47 of the Child Wellbeing and Safety Act 2005 (reg 2). They operate only to the extent that the Act creates the substantive permission to share, the record‑keeping obligation in section 41ZC, the power to prescribe under section 41ZH, and the definitions in Part 6A (for example, section 41R, section 41S and section 41ZC are directly referenced in regs 5, 5B and the Part 3 heading). The Regulations therefore cannot be read independently of the Act: they specify who counts as an information sharing entity under the Act and prescribe the details to be recorded where the Act requires records.

Interaction with family violence law. Regulation 7(g) requires the recording entity to include copies of family violence risk assessments and safety plans prepared under an approved framework with the Family Violence Protection Act 2008 (reg 7(g)(i)-(iii)). Schedule 1 also includes bodies declared authorised Hub entities under section 144SC of the Family Violence Protection Act 2008 (item 23). Those cross‑references mean the information sharing framework is deliberately integrated with family violence risk assessment and Hub models, and that family violence documents can be attached to disclosure records.

Overlap with child protection and youth justice Acts. The Regulations list many services established under or operating in relation to the Children, Youth and Families Act 2005 (Sch 1 items 1, 6, references in items 2, 14). Regulation 10(e) also prescribes specific provisions from the Children, Youth and Families Act 2005 , sections 537(3) and 582(5) , as provisions that may be displaced by Part 6A in appropriate circumstances (reg 10(e)). The Schedule also includes Youth Parole Board support functions (item 14(d)) and out of home care services (item 6). These connections show that the information sharing framework is intended to operate in the child protection and youth justice ecosystem.

Effect on health and disability confidentiality. Regulation 10(a) and 10(d) list section 347(2) of the Mental Health Act 2014 and section 132ZC of the Disability Act 2006 respectively as provisions that may be prescribed for the purposes of section 41ZH of the Act (reg 10). Schedule 1 includes health service providers (registered funded agencies, multi‑purpose services, community health centres, registered medical practitioners, nurses) and disability sector regulators (items 3, 43-45, 46-47, 50, 55-56). Those entries create an interface between health and disability confidentiality regimes and the information sharing framework: where Part 6A conditions are met and section 41ZH is engaged, the listed confidentiality provisions are identified as ones that the Act may authorise an entity to collect, use or disclose information despite.

Magistrates' Court and court official carve outs. Regulation 10(f) prescribes particular provisions of the Magistrates' Court Act 1989 (sections 18(3) and 99A(5)) for the purposes of section 41ZH (reg 10(f)). At the same time, Schedule 1 specifically lists court officials under the Magistrates' Court Act 1989 and the Children, Youth and Families Act 2005 (items 57 and 58) and reg 6(1)(a) excludes those two schedule entries from the application of Part 3 (record keeping). That creates a delineation between court officers and other information sharing entities: court officials are recognised in the Schedule but are exempted from the record‑keeping duty in Part 3.

Education and early childhood regulatory overlap. Many definitions in reg 4 are linked to the Education and Care Services National Law (Victoria), the national regulations, and the Education and Training Reform Act 2006 (reg 4 definitions). The Schedule includes Government and non‑Government schools, approved providers of relevant education and care services, school nursing programmes, chaplaincy programmes and other education support services (Sch 1 items 28-31, 30(k)-(l)). The Regulations therefore interact with the education regulatory regime by bringing particular educational actors into the information sharing net and tying definitional references to the Education and Care Services National Law.

State contracts and procurement. A major drafting pattern in Schedule 1 is inclusion "to the extent that" a person or body performs particular functions under a State contract. That ties an entity's information sharing entity status to contractual performance. Practically, this means procurement and contract drafting must be attentive to the information sharing consequences: entities delivering State‑contracted services may need to meet the same Part 6A standards as public agencies for the contracted functions.

Instrumental cross‑referencing and limits. The Regulations also refer to other Acts establishing regulators and authorities: the Victorian Early Childhood Regulatory Authority Act 2025 is referenced in reg 4 and reg 5A(2A) (Early Childhood Regulator), the Disability Service Safeguards Act 2018 is referenced for the Victorian Disability Worker Commission and the Disability Worker Registration Board (Sch 1 items 55-56), and the Births, Deaths and Marriages Registration Act 1996 and Relationships Act 2008 are referenced for the Department of Government Services' support functions (item 14A). Those cross‑references mean that changes in those Acts, or in the instruments made under them, can affect which bodies or persons are covered by the information sharing framework.

Net effect. Overall, the Regulations establish a targeted, function‑driven mapping between the Child Wellbeing and Safety Act information sharing powers and the rest of the Victorian statute book. They make the Act operational within family violence, child protection, education, health, disability and justice spheres by prescribing which actors are in scope, what records must be kept when information is shared, and which statutory secrecy provisions the Act may displace. Practitioners must therefore treat the Regulations as a coordination instrument: they do not alter substantive duties in other statutes but prescribe the procedural architecture for how Part 6A data flows should be recorded and, in specified circumstances, how particular statutory confidentiality rules can be set aside.

The Regulations have been amended several times since their making on 4 September 2018 (reg 3 and Endnotes 1-2). The published version in the source is Version No. 006, incorporating amendments as at 1 January 2026. The Endnotes list the statutory rules that have amended the Regulations, together with dates of making and commencement. The amendment history in the source is as follows:

• Child Wellbeing and Safety (Information Sharing) Amendment Regulations 2020, S.R. No. 135/2020. Date of making 15 December 2020; date of commencement 19 April 2021 (Endnotes Table). This instrument inserted multiple definitions into reg 4 (approved education and care service, Catholic school, centre‑based service, education and care service, enrolled nurse, general practice nurse, Government school, non‑Government school, operator, registered medical practitioner, registered nurse, registered school, relevant education and care service, supported playgroup) and substituted reg 5 (prescribing Schedule 1 entities) and inserted reg 5A (delegations) and other consequential changes, as shown by the footnotes to reg 1, reg 4 and reg 5 in the text. The 2020 amendments therefore expanded the education and early childhood coverage and established the initial delegation rules (reg 5A as inserted by S.R. No. 135/2020 reg 8).
• Child Wellbeing and Safety (Information Sharing) Amendment Regulations 2021, S.R. No. 30/2021. Date of making 13 April 2021; date of commencement 19 April 2021 (Endnotes Table). The 2021 instrument amended reg 6 and reg 10, inserting additional prescribed provisions into reg 10 (see reg 10(d) which was amended by S.R. No. 30/2021 reg 6(a) and reg 10(e)-(f) inserted by S.R. No. 30/2021 reg 6(b)). Those insertions added cross‑references to provisions in the Disability Act 2006, the Children, Youth and Families Act 2005 and the Magistrates’ Court Act 1989 that the Act may displace under section 41ZH.
• Child Wellbeing and Safety (Information Sharing) Amendment Regulations 2022, S.R. No. 119/2022. Date of making 18 October 2022; date of commencement 1 November 2022 (Endnotes Table). The 2022 instrument made multiple changes: it added a new Division 2 to Part 2 dealing with restricted information sharing entities (regs 5B and 5C), substituted headings and made amendments across Part 3 (regs 6-9) and the Schedule (Sch 1) including changes to items and definitions; it revoked the Family Safety Victoria definition in reg 4. The 2022 changes therefore introduced the restricted Child Link Category and the specific assignee rules for who may exercise Child Link powers (regs 5B-5C).
• Child Wellbeing and Safety (Information Sharing) Amendment Regulations 2023, S.R. No. 82/2023. Date of making 15 August 2023; date of commencement 30 August 2023 (Endnotes Table). The 2023 instrument substituted reg 5A and made amendments to regs 5B and 5C (see footnotes in regs 5A, 5B and 5C). Those amendments further refined delegation rules and the specification of executives who may act on behalf of the restricted information sharing entity.
• Child Wellbeing and Safety (Information Sharing) Amendment Regulations 2025, S.R. No. 62/2025. Date of making 1 July 2025; date of commencement 2 July 2025 (Endnotes Table). The 2025 instrument made further captioned amendments to Schedule 1 (Sch 1) as reflected in the footnotes, broadening or updating certain schedule entries.
• Child Wellbeing and Safety (Information Sharing) Further Amendment Regulations 2025, S.R. No. 144/2025. Date of making 16 December 2025; date of commencement 1 January 2026 (Endnotes Table). These late‑2025 amendments inserted the Early Childhood Regulator into reg 4 and provided for its delegation powers under reg 5A(2A), and made other definitional and schedule adjustments to reflect new legislation (Victorian Early Childhood Regulatory Authority Act 2025) and organisational changes effective 1 January 2026 (reg 4 and reg 5A(2A) as inserted by S.R. No. 144/2025 reg 4(a) and reg 5A(2A) inserted by S.R. No. 144/2025 reg 5).

The footnotes in the Regulations themselves document the insertion or amendment of particular definitions and provisions with precise cross‑references to the amending statutory rule numbers and regulation numbers (for example, see the numerous "inserted by S.R. No. 135/2020 reg. 6(1)" and similar footnotes throughout reg 4, and the insertion of Pt 2 Div. 2 and regs 5B-5C by S.R. No. 119/2022 reg. 7).

The Endnotes also record that the Regulations will sunset ten years after the day of making on 4 September 2028 (Endnotes 1), pursuant to the Subordinate Legislation Act 1994, which creates an expiry date for the instrument unless re‑made or extended in accordance with the subordinate legislation rules.

Practitioners should therefore be attentive to the versioning and commencement dates when relying on the instrument: many amendments have retrospective insertion references but have specific commencement dates (see the Endnotes table listing each S.R. No. with its date of commencement). The Regulations as presented here incorporate all those amendments up to 1 January 2026 and are published as Version No. 006.

The statutory instrument as produced contains no entries of litigation or case law. The Endnotes include an "Explanatory details" section with the comment "No entries at date of publication" (Endnotes 3), and the Regulations themselves do not cite or rely on any judicial decisions. Schedule 1 and the various Regulations make references to other statutes, but the text does not name any cases, nor does it record decisions interpreting these Regulations.

That absence of reported litigation in the instrument does not mean litigation or disputes cannot arise; it is simply a statement of the text's contents as published. Areas where litigation or review might plausibly occur, should facts give rise to disputes, include:

• interpretation of "to the extent that" language in Schedule 1 entries where private or contracted providers assert they are (or are not) information sharing entities in respect of particular functions;
• the scope and limits of the restricted Child Link Category and whether an action falls within paragraphs (b) and (c) of section 41S(2) and the "for the purpose of maintaining the Child Link Register" limitation in reg 5B(3);
• the validity of delegations made under reg 5A, including challenges to whether delegations were made by instrument as required by reg 5A(3) and whether the delegate had authority to act; and
• compliance with the record‑keeping prescriptions in regs 7-9, particularly where missing records are relied upon in external oversight or negligence claims.

No reported litigation in the Regulations means there is no judicial interpretation specifically recorded here that would guide construction of the instrument beyond the text and the cross‑references to the Act and other statutes. Practitioners needing an authoritative view on ambiguous points must therefore look to the Child Wellbeing and Safety Act 2005, other relevant statutes, administrative law principles and, if necessary, litigate the issue in the appropriate forum. For now, the Regulations themselves provide the operative words and the Endnotes provide the amendment timeline; there is no internal case law or litigation history recorded in the document.

The Regulations present several practical traps and coordination challenges that can cause non‑compliance or operational friction if not anticipated. These "gotchas" are matters of drafting detail, conditionality and inter‑agency reliance.

1. "To the extent that" conditional inclusions in Schedule 1. Many Schedule 1 entries include the phrase "to the extent that the person or body performs functions" or "to the extent that that person or body performs functions relating to ...". That conditional drafting makes entity status function‑specific. Practitioners must not assume a named organisation is always an information sharing entity; they must map each activity or contract to Schedule 1 language to decide whether Part 6A obligations apply. This creates a risk for contracted providers who perform a mix of services: an inaccurate internal classification could leave the provider without required records or, conversely, exposes it to unintended legal obligations.

2. Record‑keeping exemptions and the "another entity recorded it" exception. Regulation 6(1)(a) excludes information sharing entities specified in items 57 and 58 from Part 3 obligations. Those two items are court officials; record keeping therefore does not apply to them. More subtly, reg 6(2) says that Part 3 does not apply to an information sharing entity specified in item 12 (a Risk Assessment and Management Panel participant) if that entity reasonably believes the information required to be recorded has been recorded by another information sharing entity. That creates an inter‑entity dependency: entities must have confidence in other entities' records before deciding not to duplicate. There is a practical risk of disputes about whether the "reasonable belief" threshold was met and whether the other entity's records were sufficiently comprehensive.

3. Attachment of sensitive documents to disclosure records. Regulation 7(g) requires the disclosing entity to include copies of family violence risk assessments and safety plans relevant to the disclosure (reg 7(g)(i)-(iii)). Those documents are highly sensitive. Entities must ensure secure systems, access controls and retention policies before embedding such content into disclosure records. Failure to secure those documents could create privacy breaches even where the disclosure itself was authorised under the Act.

4. Narrow scope for the Child Link restricted entity. The Secretary to the Department of Education is prescribed as belonging to the Child Link Category (reg 5B(1)) and may only carry out the activities set out in paragraphs (b) and (c) of section 41S(2) of the Act, and then only "for the purposes of maintaining the Child Link Register" (reg 5B(2)-(3)). Practitioners should not assume Child Link authority extends to other general information sharing activities. Overseas expectations about centralised registers and broad data matching should be calibrated to this narrow authorisation.

5. Delegation must be by instrument and cannot delegate the power to delegate. Regulation 5A(3) requires delegations to be made by instrument; reg 5A(1)-(2) excludes the delegation power itself from delegation. Practically, entities must keep a clear, signed instrument trail for delegations, and ensure that operational staff act only within the scope of instrumented delegations. Uninstrumented or informal delegation arrangements are legally risky.

6. No penalty provisions in the Regulations. The Regulations prescribe duties but do not create express penalties. The absence of penalties might mislead organisations into thinking compliance is merely advisory. In fact, records required by regs 7-9 will be material evidence in any enforcement or review under the Act or other statutes. Entities should treat these prescriptions as binding compliance obligations, not optional administrative practices.

7. Finite list of displaceable statutory provisions. Regulation 10 prescribes a list of statutory provisions that section 41ZH may enable entities to override when the Act's conditions are met. The list is finite and specific. Confidentiality or non‑disclosure provisions in other statutes that are not listed may remain impediments to sharing unless the Act itself authorises sharing in another way. Entities must therefore check both reg 10 and the Act before assuming they can share despite other statutory secrecy provisions.

8. Timing and commencement of amendments. The Regulations have been amended multiple times with staggered commencements (Endnotes). Practitioners must check the operative version relevant to the date of action, particularly where definitions (for example, "relevant education and care service") were inserted or substituted by later S.R. Nos. Misapplying a later definition to earlier conduct could produce incorrect compliance conclusions.

9. Contract drafting and procurement traps. Because many Schedule 1 entries depend on State contracted functions, contractors and departments must ensure that contracts explicitly state whether the contractor is performing functions that trigger information sharing entity status and allocate responsibilities for record keeping, security, indemnities and oversight. Lack of clarity in contracts can lead to misaligned compliance expectations and liability disputes.

10. Complaints handling obligations are detailed. Regulation 9 requires recording a range of complaint management fields, including action taken to prevent further similar complaints. Entities with ad hoc complaint systems may not meet these prescribed standards; they must structure complaint processes to capture these specific data points and produce evidence of remedial action.

Addressing these gotchas requires concrete internal policies, accurate mapping of functions to Schedule 1, secure information management for attachments, formal delegation instruments, and contract clauses that allocate recordkeeping duties and risk. Failure to attend to these mechanical points is the main practical hazard created by the Regulations.

Compliance requires an administrative programme that maps entity functions to Schedule 1, embeds the prescribed record‑keeping fields into operational systems, ensures delegations are instrumented, secures sensitive attachments, and aligns contract language where schedule status depends on performing State‑contracted functions. The following practical checklist sets out the key steps, each grounded in the relevant regulation.

1. Confirm whether you are an information sharing entity and the scope.

   • Read Schedule 1 (reg 5) and identify the item(s) that might apply to your organisation. Pay close attention to "to the extent that" clauses which limit the entity status to specific functions (Sch 1, many items).
   • If you are a contractor, map each contract and service activity against the Schedule. Confirm whether your performance of a particular function under a State contract is within the scope that the Schedule describes (see multiple Sch 1 items).
   • If you are a court official, note that Part 3 (record keeping) does not apply to items 57 and 58 (reg 6(1)(a)).

2. Implement prescribed record‑keeping fields and processes.

   • For every disclosure of confidential information under Part 6A of the Act, ensure your information management system captures the fields listed in reg 7: requesting entity (reg 7(a)); confidential information requested (reg 7(b)); date of request (reg 7(c)); a record of confidential information disclosed and date (reg 7(d)-(e)); recipient entity (reg 7(f)); copies of relevant family violence risk assessments or safety plans where applicable (reg 7(g)); whether the child's or parent's views were sought or, if not, why (reg 7(h)); and whether the child or parent was informed of the disclosure (reg 7(i)). These should be mandatory fields in disclosure workflows.
   • When declining a request, capture the details of the request and the reason for declining as required by reg 8(a)-(b).
   • For complaints made directly to your entity about Part 6A performance, record the date, nature, action taken to resolve, remediation steps to prevent recurrence, the resolution timeframe, and any further action if unresolved (reg 9(a)-(f)).

3. Secure storage and access controls for attached documents.

   • Reg 7(g) requires attaching family violence risk assessments and safety plans where relevant. Implement secure document repositories with role‑based access controls, encryption in transit and at rest, retention schedules and audit logging.
   • Ensure staff handling these attachments are trained on confidentiality, relevant privacy law, and the security procedures needed to protect sensitive information.

4. Delegations must be by instrument and correctly authorised.

   • If you are the Secretary to the Department of Education, the Secretary to the Department of Government Services, or the Early Childhood Regulator, you may delegate information sharing powers to employed or engaged persons but only by instrument (reg 5A(1)-(3); reg 5A(2A)). Maintain a delegation register and ensure delegations identify the specific Part 6A powers being delegated and the authorised delegates by position.
   • Do not assume informal or oral delegation suffices. Confirm that the instrument is executed in the form required by your agency's governance rules.

5. For Child Link restricted functions, comply with the limited scope and specified exercisers.

   • The Secretary to the Department of Education is a restricted information sharing entity for the Child Link Category (reg 5B(1)). The Secretary may only carry out the activities in paragraphs (b) and (c) of section 41S(2) of the Act and only for maintaining the Child Link Register (reg 5B(2)-(3)). Ensure any Child Link activity is demonstrably linked to maintaining that register.
   • Only the specified Deputy Secretary or Executive Director roles set out in reg 5C may exercise these powers on behalf of the Department. Ensure an updated list of incumbents in those roles is maintained and that appointment records demonstrate the roles’ responsibilities for maintaining the register.

6. Contracting and procurement alignment.

   • If your information sharing entity status is triggered by performing functions under a State contract, ensure the contract clearly identifies the obligations under Part 6A that will apply, allocates responsibilities for record keeping, data security, indemnities and cooperation with audit or oversight, and permits access to necessary records for audits.
   • Ensure subcontractors understand whether they are treated as information sharing entities for particular tasks.

7. Training, policy and governance.

   • Develop specific written policies that implement regs 7-9 and reg 10 (for example, a policy for when family violence risk assessment attachments are required, a refusal and complaints recording policy, and a process for obtaining and recording the child's and parent's views).
   • Train staff who handle disclosures, who are authorised to request information from other entities, and who maintain records. Ensure staff know how to capture the "reason why" when views were not sought (reg 7(h)) and how to document whether the child or parent were informed (reg 7(i)).

8. Privacy, legal and oversight checks.

   • Before relying on section 41ZH to override a statutory confidentiality provision, confirm the provision is one that reg 10 prescribes (reg 10(a)-(f)). If the provision is not listed, seek legal advice and document the legal basis for disclosure.
   • Keep a compliance checklist for each disclosure that demonstrates the legal basis, the required records captured under reg 7, the security measures applied, and the complaints process steps available to affected persons.

9. Inter‑entity coordination for panel participation and recording duplication.

   • If you participate in a Risk Assessment and Management Panel (item 12 of Sch 1) and believe another entity has recorded the required Part 3 information, document the reasons you reasonably believe that to be true (reg 6(2)). Establish inter‑agency protocols for sharing record ownership information and for resolving disputes about which entity holds the authoritative record.

10. Audit trail and retention.

• Maintain an auditable record trail of all information sharing decisions, instruments of delegation, complaint records and attachments. Retention periods should be consistent with your agency’s records disposal schedule and any statutory retention obligations applicable to the documents being stored.

11. Stay current with amendments and version control.

• The Regulations have been amended several times. Ensure legal and compliance teams review the current version relevant to the date of action. The Endnotes list S.R. Nos and commencement dates; implement a process to monitor statutory rule changes and adjust operational policies accordingly.

12. Test and review.

• Periodically test compliance with regs 7-9 through internal audit. Confirm that the required fields are being captured and that risk assessments and safety plans are being attached where necessary. Document corrective actions where records are incomplete.

Implementing these steps will bring an entity into conformance with the mechanical obligations in the Regulations: identifying whether it is an information sharing entity for the relevant functions, instrumenting delegations, capturing the prescribed record fields for disclosures, refusals and complaints, securing attachments, and aligning contracts and governance. Because the Regulations do not themselves create the substantive legal test for lawful disclosure (that remains in Part 6A of the Act), always couple these procedural steps with legal review of the underlying statutory basis for any proposed collection, use or disclosure of confidential information.