PRISMS records as evidence: what to pull before answering a cancellation notice (2026)

When a cancellation notice arrives, the records worth pulling first are the entries the education provider was legally required to make at the time: the reports entered into the Secretary’s computer system under s 109 of the Education Services for Overseas Students Act 2000 (ESOS Act) — the layer of the system usually called PRISMS records — and the student contact and assessment records the provider had to keep under s 21. This guide relies on the official Federal Register of Legislation text of ESOS Act s 19 “Giving information about accepted students” and s 21 “Record keeping”, as at September 2026; it explains how those duties shape the evidence checklist and is general information only, not advice on any individual case or a substitute for the current official wording.

The practical rule is simple: start with what the law required the provider to record, not with what can be reconstructed after the event.

What must a provider report about an accepted student?

Section 19(1) sets a list of information a registered provider must give within the applicable number of days after the relevant event. Section 19(3) then requires that information to be given by entering it into the computer system established by the Secretary under s 109. For an agent or adviser building a file, that list is the first half of the pull list.

Reportable item	ESOS Act hook	What the provider must do
Accepted student identity	s 19(1)(a)	Give the student’s name and any other prescribed details when they become an accepted student
Course details	s 19(1)(b)	Give the course name, starting day and expected duration for the accepted course
Failure to begin	s 19(1)(c)	Give prescribed information about an accepted student who does not begin the course when expected
Termination of studies	s 19(1)(d)	Report any ending of the student’s studies before the course is completed, whether caused by the student, the provider or otherwise
Change to course identity or duration	s 19(1)(e)	Report any change in the course itself
Student visa condition breach	s 19(2) and (2A)	Give particulars of a breach of a prescribed student visa condition as soon as practicable, even if the student has ceased to be an accepted student
Other prescribed matters	s 19(1)(f)	Report anything else the regulations prescribe relating to accepted students

Failure to comply with s 19 is a strict-liability offence carrying a maximum penalty of 60 penalty units, and it is an offence under s 108 to provide false or misleading information in complying, or purporting to comply, with s 19. Where the provider is an unincorporated body, the duty falls on the principal executive officer instead (s 19(4)).

How soon after the event did the report have to be made?

Section 19(1A) sets the applicable number of days: 14 days if the accepted student is under 18 and the information is about failure to begin or termination of studies, and otherwise 31 days. Those deadlines apply to the s 19(1) list, not to visa breach reports — s 19(2) requires particulars of a breach of a prescribed student visa condition to be given as soon as practicable, and s 19(2A) keeps that duty alive even after the student has ceased to be an accepted student of the provider.

In evidence terms, this means a late report is not automatically invalid, but the date pattern is still worth checking against the applicable rule.

What must the provider keep on file under s 21?

Section 21 applies to each accepted student who is enrolled with the provider or who has paid any tuition fees for a course provided by the provider (s 21(1)). The kept records are the second half of the pull list, and they often explain how a report was generated.

Record set	ESOS Act hook	Requirement and retention
Student contact details	s 21(1)–(2), (2A)	Keep current residential address, mobile number (if any), email address (if any) and other prescribed details; while the student remains accepted, confirm those details in writing at least every 6 months and update the records accordingly
Unit assessment outcomes	s 21(2B)–(2C)	When an accepted student completes a unit and their progress in it is assessed, record the assessment outcome; keep the record as prescribed and keep it up to date
Retention period	s 21(3)	Retain records for at least 2 years after the person ceases to be an accepted student; after cessation there is no duty to keep them up to date

As with s 19, failure to comply with s 21 is a strict-liability offence with a maximum penalty of 60 penalty units (ss 21(5)–(6)), and the principal executive officer carries the duty for an unincorporated provider (s 21(4)).

How can these records be used to test a cancellation notice?

The value of the s 19 and s 21 framework is that it turns a vague request for “evidence” into named record categories. The following checkpoints follow directly from the duties above.

Match the allegation to a reportable event. If the notice says the student did not start, the corresponding hook is s 19(1)(c); if it relies on a course change, s 19(1)(e); if it depends on progress after a unit was assessed, the relevant category is the assessment record required by s 21(2B). Naming the hook prevents comparing the wrong document.
Compare the event date with the applicable deadline. For failure to begin or termination, check whether the student was under 18 at the event: if so, 14 days applied, otherwise 31 days (s 19(1A)). A gap between event and report is still worth noting, but it does not by itself dispose of a breach report, because s 19(2A) expressly allows later breach reporting once the student has ceased to be an accepted student.
Look at assessment records rather than assumptions. Section 21 requires the provider to record the outcome once a unit is completed and the student’s progress in that unit is assessed. The existence, content and up-to-date status of that record is what can be weighed against any progress-based allegation.
Consider the contact-details cycle. The six-monthly confirmation duty in s 21(2A) means the provider should have refreshed and updated address, phone and email details while the student remained accepted. Those entries show what contact information the provider held at the relevant time.
Check whether the retention window still covers the records. Because s 21(3) requires retention for at least 2 years after the person ceases to be an accepted student, recent enrolments will usually still fall inside the statutory minimum window; beyond that period the Act no longer requires the provider to hold them.

Assume an applicant receives a non-commencement allegation

Assume an applicant is issued a cancellation notice that says they did not begin the course when expected. Under s 19(1)(c), that exact event is reportable. For a student aged under 18 at that point, the provider had 14 days; otherwise the applicable number of days was 31 (s 19(1A)). The record trail to line up against the notice is therefore the accepted-student and course entries under s 19(1)(a)–(b), the non-commencement report itself, the contact-details confirmation cycle in s 21(2A), and — if the file is older — whether the retention period in s 21(3) still covers the records. This is a labelled illustration of how the provisions interact, not a prediction about any real outcome.

What do these duties not decide?

These sections impose provider-side obligations and describe what should exist in the record set; they do not themselves set out visa cancellation grounds, and they do not guarantee that any response will succeed. Where a cancellation notice turns on criteria outside the ESOS Act, those criteria and the current official wording control. Nothing here is individual advice, and no outcome is promised.

Frequently Asked Questions

Are PRISMS records enough on their own to answer a cancellation notice?

No. The provider reports and s 21 records are core provider-side evidence and often the most useful starting point, but a response still has to address the actual cancellation grounds and the specific allegations in the notice. Treat the records as the baseline for testing the decision-maker’s account, not as a complete answer by themselves. This is general framing only, not advice on individual prospects.

What events force a provider to report an accepted student?

Under s 19(1), becoming an accepted student, the course start day and expected duration, failure to begin, termination of studies before completion, any change in the course’s identity or duration, and other prescribed matters. A breach of a prescribed student visa condition is a separate duty under s 19(2), reported as soon as practicable.

Is there a difference between the 14-day and 31-day reporting deadlines?

Yes. Section 19(1A) gives 14 days when the accepted student is under 18 and the information is about failure to begin or termination of studies; otherwise the applicable number of days is 31. These deadlines apply to the s 19(1) list, not to visa breach reports, which are governed by “as soon as practicable” in s 19(2).

Can a provider still report a breach after the student has left?

Yes. Section 19(2A) requires particulars of a student visa condition breach to be given even if the student has already ceased to be an accepted student of that provider. The duty to report does not end simply because the enrolment relationship has ended.

How long do student records have to be kept?

Section 21(3) requires records to be retained for at least 2 years after the person ceases to be an accepted student; after that point the records no longer need to be kept up to date. The six-monthly confirmation cycle in s 21(2A) applies only while the student remains an accepted student.

What happens if information entered into the system is false or misleading?

It is an offence under s 108 of the ESOS Act to provide false or misleading information in complying, or purporting to comply, with s 19. Separately, failing to comply with s 19 or s 21 is a strict-liability offence with a maximum penalty of 60 penalty units. The existence of these provisions does not mean any particular entry is wrong; they simply set the legal context for the records.