How to write an NDIS privacy and confidentiality policy (2026 template + example)

Why registered NDIS providers need a privacy and confidentiality policy

Every NDIS registered provider — including SIL (Supported Independent Living) providers — must demonstrate compliance with the NDIS Practice Standards and the NDIS Code of Conduct. The Practice Standards include specific requirements around the rights of participants, governance, and the management of participant information. Auditors from approved quality auditors look for a documented, implemented privacy policy as evidence that these obligations are being met.

Beyond the NDIS framework, registered providers handling personal information about participants are also bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Failing to maintain an adequate policy can result in adverse audit findings, conditions on registration, or referral to the NDIS Quality and Safeguards Commission for investigation.

With the strengthened Practice Standards taking effect for new and renewing registrations from 2026, auditors are placing greater scrutiny on whether privacy documentation is embedded in day-to-day operations — not just filed away.

What must your policy cover: the seven core sections

A compliant NDIS privacy and confidentiality policy should address the following areas. Each section maps to a discrete requirement under either the Practice Standards, the Code of Conduct, or the Privacy Act.

1. Purpose and scope — State what the policy covers, who it applies to (board, staff, volunteers, contractors), and which services and sites it governs.
2. Legal framework — Reference the Privacy Act 1988, the Australian Privacy Principles, the NDIS Act 2013, and the NDIS (Provider Registration and Practice Standards) Rules 2018. This shows auditors you understand your obligations holistically.
3. What information you collect and why — List categories of personal and sensitive information collected (support plans, health records, financial details, incident records) and the lawful basis for each category.
4. Consent — Describe how and when informed consent is obtained from participants or their nominees before collecting, using, or disclosing information. Include how consent is recorded and reviewed.
5. Storage, security, and access controls — Detail physical security (locked cabinets), electronic security (access permissions, encryption, audit trails), retention periods, and the process for secure disposal. The Practice Standards require that participant records are protected from unauthorised access.
6. Disclosure and sharing — Clarify when information may be shared without consent (genuine emergency, legal obligation, mandatory reporting) versus when consent is required. SIL providers frequently share information with allied health professionals, families, and funding bodies — each scenario should be addressed.
7. Data breach response — Outline the steps your organisation takes when a breach is suspected or confirmed, including notification timelines to the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme, and to affected participants.

Additional elements for SIL providers

SIL providers operate in shared living environments, which creates specific confidentiality risks not present in other support types. Your policy should also address:

• Housemate confidentiality — Staff must not disclose one participant's information to another participant sharing the same home, even when sharing appears minor or incidental.
• Visitor and family access — Document how requests from families, guardians, or informal supports to access a participant's records are handled, including how participant consent is verified first.
• Use of personal devices and photographs — Include rules on staff use of personal mobile phones, photographing participants, and sharing images on personal or organisational social media.
• Restrictive practice documentation — If your service uses or monitors any regulated restrictive practices, records relating to those practices carry heightened sensitivity and your policy should reflect additional controls.

Step-by-step: how to write your policy

1. Map your information flows. Before writing, trace every point where participant information enters, moves through, and exits your organisation. This prevents gaps in the policy.
2. Assign a policy owner. The NDIS Practice Standards expect that a specific role (typically a Practice Manager or Compliance Officer) is accountable for the policy. Name the role in the document.
3. Draft using plain language. Participants and their nominees have the right to access their records and understand how their information is used. Write in plain English at approximately a Year 8 reading level.
4. Cross-reference your other documents. Link to your complaints policy, incident management procedure, and consent forms. Auditors evaluate documents as a system, not in isolation.
5. Include a review clause. Specify that the policy will be reviewed at least annually and after any significant incident, legislative change, or audit finding. Record the date of last review and the scheduled next review on the cover page.
6. Obtain board or leadership sign-off. The Practice Standards require that governance arrangements are in place. A dated signature from the CEO or Board Chair demonstrates this.
7. Communicate the policy to all staff. Document how staff are made aware of the policy (induction, annual training) and keep records of acknowledgement. Auditors may request evidence of staff training.

Example: policy excerpt (template snippet)

Adapt the above to reflect your organisation's actual forms, systems, and decision-making processes. Do not submit a policy that still contains template placeholder text — auditors treat this as evidence that the document has not been implemented.

What auditors check during a privacy audit

Approved quality auditors will look for evidence that the policy is lived, not just written. Common audit activities include:

• Interviewing staff on their understanding of privacy obligations and what to do in a breach
• Reviewing a sample of participant files to confirm consent forms are present and current
• Inspecting physical storage (cabinets locked, visitor access restricted)
• Checking electronic access logs or permissions settings for case management software
• Requesting training records to confirm all staff have completed privacy induction

The most common non-conformance finding in this area is a policy that exists on paper but has not been translated into staff practice — particularly around photographing participants or sharing information with family members without verified consent.

Keeping the policy current in 2026

The NDIS Commission's strengthened Practice Standards introduce a greater emphasis on continuous improvement and proactive risk management. Providers should treat their privacy policy as a living document. Schedule a formal review whenever:

• There is a change to the Privacy Act or Australian Privacy Principles (including any future reforms)
• A notifiable data breach occurs
• A new digital system for storing participant records is introduced
• An audit finding or complaint relates to information management

If you are building or refreshing your compliance document suite, the 136-document SIL compliance kit at ndiscompliant.com.au includes an editable privacy policy template alongside consent forms, incident procedures, and all other documents typically requested at audit — which can save considerable time at renewal.