Where Does a School’s Duty of Care End When the Device Goes Home?

Since 1 January 2026, Queensland schools have been operating under a new, mandatory set of obligations. The Child Safe Organisations Act 2024 introduced ten Child Safe Standards, overseen by the Queensland Family and Child Commission, and most schools now fall within scope. A further Reportable Conduct Scheme obligation lands for schools from 1 January 2027.

Much of the early compliance work has focused on what happens inside the school gate. Policies, training, complaints processes and physical environments have all had their turn under the microscope. Fewer schools have worked through what these standards mean once a school-issued laptop leaves the building.

A note before we go further. This article shares a perspective on a genuinely open question. It is general commentary intended for discussion among school leaders, not legal advice, and should not be relied on as a statement of any school’s legal obligations. If a school needs a definitive position, that is a conversation for the school’s legal advisors, informed by their specific circumstances.

With that said, here is the question this post explores. Not because there is a neat answer, but because the answer matters, and right now it is genuinely unclear.

“Where does a school’s duty of care end when the device goes home?”

What Standard 8 asks for

Standard 8 covers physical and online environments. It asks organisations to maintain online platforms that are safe, well monitored, and aligned with the broader Child Safe Standards. It expects the online environment to operate under the same code of conduct and safety policies that apply everywhere else. And it specifically requires a plan for responding to incidents in digital environments, cyberbullying among them.

Nowhere in the published text does the standard say any of this stops applying once the student walks out the gate. That silence is the starting point for this discussion, not a conclusion about anyone’s legal position.

A school device is a school environment, wherever it is

A school-issued laptop is not just a piece of hardware. It comes bundled with a student email account, access to the school’s portals and learning platforms, and often a layer of content filtering and monitoring software installed on top. That bundle is, functionally, part of the school’s digital environment.

If Standard 8 requires a safe, well-monitored online environment, and that environment travels home on a school laptop every afternoon, it is arguable that the obligation travels with it too. That is one reading. It is not the only one, and it has not, to our knowledge, been tested in this specific context.

Three scenarios that test where the line sits

Consider three situations that most schools will already recognise.

A day student takes a laptop home and logs into their school email at 9pm. Is that still, for Standard 8 purposes, a school environment?

A boarding student never really leaves. Their device is used in a dormitory, not a family home, often with no parent in the building at all. Does “school environment” simply apply to that device around the clock?

A student takes a school laptop on an overseas exchange or sports tour. The network changes, the supervision arrangements change, and the time zone changes, but the device, the accounts and the code of conduct do not.

None of these scenarios has an obvious, universally correct answer. That is exactly the point of raising them.

The standard also protects against overreach

Before any school reaches for the obvious response, blanket monitoring everywhere, all the time, it is worth reading Standard 8 in full. It requires organisations to mitigate online risk without compromising a child’s right to privacy, access to information, social connections and learning opportunities.

That is a genuine constraint. A school that responds to this uncertainty with invasive, round-the-clock surveillance of a student’s personal time may find that approach sits in tension with the same standard it is trying to satisfy. Standard 8, on its face, is not asking schools to watch everything. It reads as asking for a safety approach that is proportionate, documented and defensible.

Where this becomes a genuinely technical question

Whether a school can meet a “safe platform” obligation at home often depends on decisions made long before the laptop leaves the building. Cloud based content will generally keep working wherever the device connects to the internet. Filtering that depends on the school’s own network appliances typically usually stops when the student leaves the school Wi-Fi coverage.

A policy that promises protection “on all school-issued devices” is only as strong as the architecture sitting underneath it. This is where a school’s duty of care and its IT infrastructure decisions stop being separate conversations, at least from a practical standpoint.

Questions worth asking before your school is asked them

A few questions we think every school leadership team should be able to answer with confidence.

Does our content filtering and monitoring travel with the device, or does it stop at the school gate?
Have we defined, in writing, what reasonable after-hours monitoring looks like, and why we drew the line where we did?
Do our boarding students’ devices get treated differently to day students’ devices, and does our policy say so?
If a school laptop is used to send a distressing message from a family holiday overseas, is that a school incident, a family matter, or something in between, and who decided that?
Have we told families, in plain language, what we do and do not monitor, and why?

There is not a single right answer to most of these. Every school benefits from having considered them before an incident forces the question, and from documenting that thinking with its own legal and governance advisors.

This is not an IT question. It sits across leadership, wellbeing, privacy, parent communication and ICT. It is best resolved before an incident forces the issue.

Work with Aryon

At Aryon, we help schools work through exactly this kind of grey area, where duty of care, technology architecture and regulatory obligation all meet in the same decision. Our role is technical and operational. We can help you understand what your current device and monitoring setup can deliver, and where the gaps between policy, technology and practice might sit.

Get in touch with us to find out more about how to address these evolving concerns.

Resources