NDIS Privacy and Cyber Security: What Providers Must Do

The short version: an NDIS provider carries privacy obligations from two directions at once. The NDIS Practice Standards set what a registered provider must show about consent, confidentiality and information management. The Privacy Act 1988 applies to most disability providers regardless of size, because a disability service that handles health information is treated as a health service provider. Cyber security is how you keep both promises once your records are digital. This guide sets out what each source requires, with links so you can check every point.

What the NDIS Practice Standards require

Two Core Module outcomes carry most of the privacy obligations. Both are set out in the NDIS (Quality Indicators for NDIS Practice Standards) Guidelines 2018, the instrument that holds the quality indicators.

Privacy and Dignity

The outcome is that "each participant accesses supports that respect and protect their dignity and right to privacy". The indicators ask for three things:

• Consistent processes and practices that respect and protect each participant's privacy and dignity. A policy alone does not show consistency; records of the practice do.
• Each participant is advised of your confidentiality policies in the language, mode of communication and terms they are most likely to understand.
• Each participant understands and agrees to what personal information will be collected and why, including audio and visual recordings.

Information Management

The outcome is that each participant's information is "identifiable, accurately recorded, current and confidential", easily accessible to the participant and appropriately used by relevant workers. The four indicators are more specific:

• Consent is obtained to collect, use, retain and disclose information, with the purpose explained, and the participant is told when information could be disclosed without consent because the law requires or authorises it.
• Each participant is told how their information is stored and used, how to access or correct it, and how to withdraw or amend consent.
• An information management system is maintained that is proportionate to the size and scale of the organisation and records information accurately and on time.
• Documents have defined processes for use, access, transfer, storage, security, retrieval, retention, destruction and disposal, proportionate to the supports you deliver.

That last indicator is where cyber security enters the Standards. "Security" sits in the same list as storage and disposal: the Standards expect you to have decided how records are protected, not just where they live. For how outcomes and indicators fit together across the modules, see our guide to the NDIS Practice Standards explained.

The Code of Conduct applies to everyone

Registered or not, every worker and provider is bound by the NDIS Code of Conduct, which requires them to "respect the privacy of people with disability". Compliance with the Code is a civil penalty provision under section 73V of the NDIS Act.

Why the Privacy Act applies even to small providers

Most businesses with an annual turnover of $3 million or less are exempt from the Privacy Act. That exemption does not help most NDIS providers. The Office of the Australian Information Commissioner (OAIC) lists "a disability service provider (where they handle health information)" as a health service provider, and says such an organisation is covered by the Privacy Act even if it is a small business.

In practice almost every disability provider handles health information: support plans, medication records, behaviour support information, diagnoses on intake forms. If you do, the Australian Privacy Principles apply to you, along with the Notifiable Data Breaches scheme below. The OAIC's guidance for small businesses sets out the exemption and its exceptions in full.

When a data breach must be reported

The Notifiable Data Breaches scheme applies to organisations covered by the Privacy Act. A breach is an eligible data breach when all three of these hold:

1. There is unauthorised access to, unauthorised disclosure of, or loss of personal information you hold.
2. It is likely to result in serious harm to one or more individuals.
3. You have not been able to prevent the likely risk of serious harm with remedial action.

If you suspect an eligible breach, you must take all reasonable steps to complete an assessment within 30 calendar days (section 26WH). The OAIC says to treat 30 days as a maximum, not a target. Once you believe an eligible breach has happened, you must notify the OAIC and the affected individuals as soon as practicable. If remedial action means serious harm is no longer likely, the breach is not an eligible data breach and does not need to be notified.

A data breach involving participant information is also an incident affecting participants. Record it and manage it through your incident management system like any other incident, so the response, the review and the lessons learned are on file. Our guide to NDIS incident management covers what that system needs to show.

A newer risk: the statutory privacy tort

Since 10 June 2025, individuals have been able to sue for a serious invasion of privacy under a new statutory tort, introduced by the Privacy and Other Legislation Amendment Act 2024 and set out in Schedule 2 of the Privacy Act. A claim needs an intrusion on seclusion or a misuse of information, a reasonable expectation of privacy, and an invasion that was intentional or reckless and serious.

The OAIC does not run the tort; it is pursued in the courts. For providers it changes the stakes of everyday practice: a worker who shares a participant's photos or records without consent is now a legal exposure for the person, not only a Code of Conduct matter.

Cyber security: a practical baseline

The Practice Standards do not name a cyber framework. The Australian Signals Directorate's Essential Eight is the national baseline, and three of its strategies cover most of the risk for a small provider:

• Multi-factor authentication on email, rostering and client management systems. Most participant information now sits behind those three logins.
• Patching applications and operating systems, including the phones and tablets workers use on shift.
• Regular backups that are stored securely and tested by actually restoring from them.

Beyond the Essential Eight, the controls that matter most map straight onto the Information Management indicators:

• Role-based access. Workers see the participants they support, not the whole client list. Remove access the day someone leaves.
• No participant information on personal accounts. Personal email, personal cloud drives and messaging apps outside your control break the "transfer" and "storage" processes the Standards ask you to define.
• A retention and disposal rule. Decide how long each record type is kept, and how it is destroyed, then follow it.
• Staff training with a record. Privacy and confidentiality in induction, refreshed periodically, with attendance kept.

Checklist: what to have in place

• A privacy policy that reflects the Australian Privacy Principles and the Practice Standards, available in formats participants can understand.
• Consent records showing what each participant agreed to collect, use, keep and disclose, and when consent was last reviewed.
• A documented information lifecycle: where records are stored, who can access them, how they are transferred, kept and disposed of.
• A data breach response plan that names who assesses a suspected breach, how the 30-day assessment is run, and who notifies the OAIC and participants.
• Multi-factor authentication, patching and tested backups on every system that holds participant information.
• Training records for privacy and confidentiality.

Our NDIS compliance checklist covers privacy, dignity and information management alongside every other Core Module division, with the evidence for each.

How Compliance Care helps

We write privacy, information management and data breach policies that match how your organisation actually works, then build the consent forms, registers and training records that show the practice is consistent. See our policy development services, or book a discovery call to talk through where you stand.