WWCC and the Privacy Act: Compliance Obligations for Australian Maktabs and Islamic Schools

Introduction

Compliance is not a word most maktab imams and Islamic education volunteers associate with their work. The spirit behind a community madrasah is service to Allah and to the next generation — not paperwork. But Australian law imposes real obligations on anyone who teaches or supervises children, and on any organisation that holds personal information about students and families. Understanding those obligations is not merely a legal matter — it is a matter of protecting children, protecting teachers, and protecting the institution from avoidable harm.

Working with Children Checks: A State-by-State Obligation

Every Australian state and territory requires anyone working or volunteering with children to hold a current Working with Children Check (WWCC). The specific name, process, and requirements differ by state, but the core obligation is universal: unsupervised access to children in a regulated setting requires clearance.

For maktabs and Islamic schools, the relevant category is “child-related work” — which clearly includes teaching Quran, supervising Islamic Studies classes, and running Hifdh programmes. Whether the work is paid or voluntary, the obligation applies.

State-by-State Overview

New South Wales — Working With Children Check
Issued by: Service NSW / Office of the Children’s Guardian
Name: WWCC card (with Working With Children Check number)
Validity: Five years (employee); annually renewed (volunteer)
Application: online.check.service.nsw.gov.au
Cost: Free for volunteers; $80 for paid workers
Relevant for: Masjid Qubaa (Mount Druitt), Daar Aisha College, YMA, all Sydney madrasahs

Victoria — Working with Children Check
Issued by: Department of Justice and Community Safety (DJCS)
Name: Working with Children Check (WWCC) card
Validity: Five years
Application: workingwithchildren.vic.gov.au
Cost: Free for volunteers; $128.40 for paid workers (2024 rates)
Relevant for: Darul Hikmah (Fawkner/Craigieburn), MFA (Fawkner), NPICC (Noble Park), Learn Quran and Arabic Centre, all Melbourne maktabs

Queensland — Blue Card
Issued by: Blue Card Services (Department of Children and Youth Justice)
Name: Blue Card (positive notice) or Exemption Card
Validity: Three years
Application: qld.gov.au/law/keeping-children-safe
Cost: Free for volunteers; $107.95 for paid workers (2024 rates)
Relevant for: Darul Uloom Brisbane, Iqra Academy Slacks Creek, all Queensland Islamic education

Western Australia — Working with Children Check
Issued by: Department of Communities (Western Australia)
Name: WA WWCC card
Validity: Three years
Application: workingwithchildren.wa.gov.au
Cost: Free for volunteers; $11 for paid workers
Relevant for: Al-Hidayah Islamic School Bentley, Ar-Rukun Mosque Rockingham, ICWA Perth

South Australia — Working with Children Check
Issued by: Department of Human Services SA
Name: Child-Related Employment Screening (CRES)
Validity: Five years
Application: families.sa.gov.au

Tasmania — Working with Children Registration
Issued by: Department of Justice Tasmania
Validity: Three years

Northern Territory — Ochre Card
Issued by: Safe Work Australia / SAFE NT
Name: Ochre Card (Working with Children Clearance)
Relevant for: ISOD Darwin madrasah

Australian Capital Territory — Working with Vulnerable People (WWVP)
Issued by: Access Canberra
Validity: Three years

What WWCC Management Means for a Maktab

For a small maktab with 5 volunteer teachers, WWCC management is manageable informally — the imam or coordinator can keep a simple spreadsheet noting each teacher’s WWCC number and expiry date. For a larger institution like Iqra Academy with 230+ students and multiple teachers, or Masjid Qubaa with a full-time Hifdh programme, WWCC management becomes a genuine administrative task.

The minimum WWCC system for a maktab:

1. Record on enrolment: When a teacher or volunteer joins the madrasah, record their WWCC card number, the state it was issued in, and the expiry date.
2. Verify the card: Don’t just accept the card at face value. In NSW, you can verify a WWCC via the OCG portal. In Victoria, via the DJCS portal. Most states offer employer/organisation verification systems.
3. Track expiry: Set a reminder 60–90 days before each card expires. Remind the teacher to renew. Do not allow teaching to continue with an expired card.
4. Document the check: Keep a record that you checked the card on a specific date. In an audit or Child Safe investigation, the ability to demonstrate that you checked and verified each teacher’s clearance is crucial.
5. Update when teachers leave: When a teacher leaves the madrasah, remove their record from the active WWCC file. If you hold copies of their card, dispose of those securely (or follow your privacy policy on document retention).

An Islamic education management platform should include WWCC tracking as a core feature: teacher profiles that include WWCC details, automated expiry alerts, and a verification log.

The Australian Privacy Act and Australian Privacy Principles

The Privacy Act 1988 (Commonwealth) and its Australian Privacy Principles (APPs) govern how organisations handle personal information. The APPs apply to:

• All agencies of the Australian Government
• All private sector organisations with annual turnover above $3 million
• Health service providers (regardless of turnover)
• Certain categories of small business (by opt-in or where handling health information)

Does the Privacy Act apply to a small maktab?

Most mosque maktabs have annual turnover well below $3 million, meaning the APPs do not technically apply to them under the current threshold. However:

1. The Australian Government is actively reviewing the Privacy Act (Privacy Act Review 2023 recommended lowering or removing the small business exemption). By 2026, the threshold may have been reduced or removed entirely.
2. State and territory privacy legislation may apply in addition to or instead of the Commonwealth Act. Victoria’s Privacy and Data Protection Act 2014, for example, has a broader scope than the Commonwealth Act.
3. Even where not legally required, the APPs represent best practice for any organisation handling children’s personal information. A maktab that adopts APP-aligned practices builds community trust and reduces risk.
4. ACNC-registered charities (which many maktabs are) have governance obligations that include responsible handling of personal information.

The 13 Australian Privacy Principles — Maktab Implications:

APP 1 — Open and transparent management: Have a Privacy Policy. Publish it. Tell students and families what information you collect and why. A one-page Privacy Policy on the madrasah’s website or in the enrolment pack satisfies this at small-organisation scale.

APP 3 — Collection of solicited personal information: Only collect information directly related to your educational purpose. An enrolment form asking for name, date of birth, parent contact, and medical information (allergies, conditions relevant to teaching) is appropriate. Collecting political or financial information that is not relevant is not appropriate.

APP 5 — Notification of collection: Tell families, at the time you collect their information, why you’re collecting it and what you’ll do with it. A brief notice on the enrolment form serves this purpose.

APP 6 — Use or disclosure of personal information: Don’t use information for a purpose other than the one it was collected for, without consent. Student attendance records exist for educational management — they should not be shared with third parties without specific reason and consent.

APP 11 — Security of personal information: Take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. A student database on an unprotected shared Google Sheet, or student records left in an unlocked cabinet, does not meet this standard.

APP 12 — Access to personal information: Parents have the right to request access to their child’s personal information held by the madrasah. Establish a simple process for handling these requests.

APP 13 — Correction of personal information: If personal information is inaccurate, allow families to request corrections.

Child Safe Standards — Victoria

Victoria has gone beyond WWCC requirements to mandate Child Safe Standards for organisations that provide services or facilities to children. The Victorian Child Safe Standards (updated 2022, effective January 2023) apply to a broad range of “school activities” and “religious organisations.”

The 11 Child Safe Standards require organisations to:

1. Establish a cultural commitment to child safety
2. Ensure staff and volunteers are suitable for child-related work
3. Develop and implement a child safety policy
4. Create procedures for responding to child safety concerns
5. Equip staff and volunteers with relevant knowledge and skills
6. Ensure children can access information, support, and complaints processes
7. Create strategies for identifying and reducing risk of child abuse
8. Ensure physical and online environments are safe
9. Review child safety practices regularly
10. Engage with families and communities on child safety
11. Address the needs of Aboriginal children

For Victorian Islamic schools and maktabs — including Darul Hikmah (Fawkner, Craigieburn), MFA (Fawkner), NPICC (Noble Park), and others — these standards are mandatory, not optional. The regulator (Commission for Children and Young People, CCYP) has enforcement powers.

A maktab that has not developed and implemented these Child Safe Standards by 2026 is not simply behind best practice — it is potentially in breach of Victorian law.

ACNC Obligations for Registered Charity Maktabs

Australian maktabs registered as charities with the ACNC (Australian Charities and Not-for-Profits Commission) have ongoing obligations:

Annual Information Statement: Filed each year with the ACNC, reporting on activities, governance, and finances. Small charities (income under $250,000) file a simplified statement.

Financial statements: Larger charities must prepare and file financial statements reviewed by an independent accountant.

Governance Standards: All registered charities must meet the ACNC’s Governance Standards, which include:

• Having purposes that are charitable
• Not operating for the benefit of members or connected individuals (no private benefit)
• Maintaining financial records
• Having a minimum number of responsible persons (trustees/directors)
• Avoiding conflicts of interest

Responsible person obligations: Trustees must act in the interests of the charity, not their own interests. Imam-led institutions where family members hold multiple trustee positions need clear conflict-of-interest management.

Building a Compliant Maktab: The Minimum Requirements

For any maktab with children in its care, the minimum compliance framework in 2026 is:

1. Charitable trust registration (with Charities Services NZ or ACNC Australia)
2. WWCC / Blue Card / Ochre Card for all teachers and volunteers — recorded, verified, and expiry-tracked
3. Privacy Policy — brief, published, adhered to
4. Child Safety Policy (mandatory in Victoria; best practice elsewhere)
5. Secure student record management — not in unlocked filing cabinets or unprotected shared documents
6. Separate bank account in the institution’s name, with dual signatories
7. Complaints procedure — communicated to families, followed when needed

None of these requirements is beyond the capacity of a well-run community maktab. The barrier is not capability but awareness — most maktab imams and committees do not receive systematic information about these obligations.