NDIS Participant Rights: What Providers Must Ensure and Document

The Legal Framework for Participant Rights

Participant rights in the NDIS are not derived from a single document. They are woven through multiple layers of legislation, rules, and standards that collectively define what providers must uphold. Understanding where these rights come from is essential for providers — because auditors will expect you to demonstrate not just that you respect participant rights, but that you understand the legislative basis for doing so.

The NDIS Act 2013

The National Disability Insurance Scheme Act 2013 (Cth) is the foundational legislation. Section 4 sets out the general principles of the NDIS, which include that people with disability have the same rights as all Australians, that they should be supported to exercise choice and control, and that their individual strengths and capabilities should be recognised and built upon. Section 5 establishes that the role of the NDIS is to support the independence, social and economic participation of people with disability.

These principles are not aspirational statements — they are the legislative intent against which all provider conduct is measured. When an auditor asks how your organisation upholds participant rights, they are asking how you give effect to these principles in practice.

The NDIS Code of Conduct

The NDIS (Code of Conduct) Rules 2018 establish seven obligations that apply to all NDIS workers and providers. These include acting with respect for individual rights, acting with integrity, honesty, and transparency, providing supports in a safe and competent manner, and promptly raising and acting on concerns about matters that may affect the quality and safety of supports. The Code of Conduct is enforceable — breaches can result in compliance action by the NDIS Commission, including banning orders against individual workers.

The NDIS Practice Standards

The NDIS (Provider Registration and Practice Standards) Rules 2018 translate legislative rights into operational requirements. The Core Module of the Practice Standards — which applies to all registered providers regardless of the supports they deliver — contains four Outcome areas. The first, Outcome 1: Rights and Responsibilities of Participants, is entirely dedicated to participant rights. It contains five sub-outcomes:

Every registered NDIS provider is audited against these five outcomes. For providers seeking certification-level registration — which includes all SIL providers — the audit is conducted on-site by an NDIS Approved Quality Auditor, and participant rights documentation is one of the first things examined.

Core Participant Rights Under the NDIS

The following rights apply to every NDIS participant, regardless of their disability type, the supports they receive, or their level of communication capacity. Providers must understand these rights, communicate them to participants, and demonstrate through documentation and practice that they are upheld consistently.

The Right to Dignity and Respect

Every interaction between a provider (including all workers, contractors, and volunteers) and a participant must be conducted with dignity and respect. This is not limited to direct support delivery — it extends to how phone calls are handled, how correspondence is written, how meetings are conducted, and how the participant is spoken about in internal communications, including progress notes and handover documents.

For support workers writing shift notes and progress notes, this means using person-first or identity-first language consistent with the participant's preference, avoiding subjective judgements about the participant's behaviour or mood, and focusing on factual, respectful descriptions of support delivery.

The Right to Choice and Control

Participants have the right to choose who provides their supports, how those supports are delivered, when they are delivered, and where they are delivered. This right extends to choosing what goals they pursue, which activities they engage in, what food they eat, what clothes they wear, and how they spend their time. Providers must not make decisions on behalf of participants unless the participant has formally delegated that decision-making authority, or unless a guardian or nominee has been appointed under relevant state or territory legislation.

The Right to Information

Participants have the right to receive information about the supports they are receiving, the terms of their service agreement, the provider's policies and procedures, their rights under the NDIS, and how to make a complaint. This information must be provided in a format that the participant can understand — which may mean Easy Read documents, translated materials, Auslan interpretation, audio formats, or visual aids depending on the participant's communication needs.

The Right to Privacy

Personal information about participants must be collected, stored, used, and disclosed in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Participants have the right to know what information is held about them, why it is held, who it has been shared with, and how they can access or correct it. Providers must have a privacy policy that meets both the Privacy Act requirements and the NDIS Practice Standards (Outcome 1.3).

The Right to Safety

Participants must be protected from violence, abuse, neglect, exploitation, and discrimination (VANED). Providers must have safeguarding policies, staff training on recognising and responding to VANED, and systems for reporting concerns — including mandatory reporting of reportable incidents to the NDIS Commission under the National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018.

The Right to Complain

Participants (and their nominees, advocates, or family members) have the right to make complaints about any aspect of their supports, the provider's conduct, or the conduct of individual workers. They have the right to make complaints without facing retaliation, punishment, or a reduction in the quality of their supports. They also have the right to escalate complaints to the NDIS Quality and Safeguards Commission if they are not satisfied with the provider's response.

Participant Rights Statement Requirements

A participant rights statement is a standalone document — separate from the service agreement, separate from the privacy notice, and separate from the complaints policy — that clearly and simply sets out the participant's rights under the NDIS framework. While the NDIS Practice Standards do not prescribe the exact format of this document, the NDIS Commission's guidance materials and auditor expectations make it clear that registered providers should have one.

What to Include in a Rights Statement

An effective participant rights statement should cover the following areas:

• The participant's right to be treated with dignity and respect at all times
• The right to make decisions about their own life and supports
• The right to privacy and confidentiality of personal information
• The right to receive supports that are safe, competent, and delivered by appropriately screened workers
• The right to access information about their supports in a format they can understand
• The right to choose and change their service provider
• The right to have an advocate or nominee involved in discussions about their supports
• The right to make a complaint without fear of retaliation
• The right to contact the NDIS Commission directly (1800 035 544)
• The right to dignity of risk — to make choices that involve reasonable risk

Accessibility Requirements

A rights statement that exists only as a PDF in 12-point font is not sufficient if your participants include people with intellectual disability, people who speak languages other than English, or people with visual impairment. The Practice Standards require that information provided to participants is accessible — which means you must be able to demonstrate that you have considered and addressed the communication needs of each participant.

For many providers, this means maintaining an Easy Read version of the rights statement alongside the standard version. Easy Read documents use short sentences, simple language, and visual supports (images or symbols) to convey information. Some providers also maintain audio or video versions, translated versions in community languages, or large-print versions.

When to Provide the Rights Statement

The rights statement should be provided to every participant at the point of onboarding — ideally before or at the same time as the service agreement. It should be discussed with the participant (not simply handed over) and the participant should be given the opportunity to ask questions. The provider should document that the rights statement was provided and discussed — for example, by including a signed acknowledgement or a case note recording the conversation.

Informed Consent and Decision-Making

Informed consent is the mechanism through which participant rights are exercised in practice. It is not a one-time event (signing a form at onboarding) but an ongoing process that applies to every significant decision about a participant's supports, their personal information, and their daily life.

What Makes Consent "Informed"?

For consent to be valid under the NDIS framework, the participant must:

1. Receive adequate information — about what they are consenting to, what the alternatives are, and what the consequences might be
2. Understand the information — which means it must be provided in a format and language they can comprehend
3. Give consent voluntarily — without coercion, pressure, or undue influence from the provider, family members, or others
4. Have the capacity to consent — meaning they can understand the information, weigh the options, and communicate a decision

If any of these elements is missing, the consent is not valid. Providers must assess each element for each consent situation — not assume that a participant who signed a service agreement has thereby consented to all future decisions about their support delivery.

Capacity to Consent

Capacity to consent is decision-specific and time-specific. A participant may have capacity to consent to some decisions (such as what to eat for dinner) but not others (such as a complex financial transaction). Capacity may also fluctuate — a participant may have capacity at some times and not others, depending on factors such as medication, fatigue, illness, or emotional state.

Providers must never assume that a participant lacks capacity simply because they have a particular diagnosis. The starting presumption under Australian law is that all adults have capacity unless there is evidence to the contrary. If a provider has concerns about a participant's capacity to consent to a specific decision, they should seek guidance from relevant professionals (such as a psychologist or speech pathologist) and consider whether supported decision-making arrangements could help the participant exercise their own choice.

Substitute Decision-Making

Where a participant does not have capacity to make a particular decision, and supported decision-making is not sufficient, a substitute decision-maker may be involved. This could be a guardian appointed under state or territory guardianship legislation, a nominee appointed under the NDIS Act 2013, or an attorney under an enduring power of attorney. Providers must verify the legal authority of any substitute decision-maker, document their involvement in decision-making, and ensure that the substitute decision-maker is acting in the participant's best interests and with regard to the participant's known wishes and preferences.

Dignity of Risk: Balancing Safety and Autonomy

Dignity of risk is one of the most challenging concepts for NDIS providers to implement in practice. It requires providers to accept that participants have the right to make choices that involve risk — including choices that the provider or their workers might consider unwise, unhealthy, or potentially harmful. The NDIS Practice Standards explicitly require providers to support this right under Outcome 1.4: Independence and Informed Choice.

What Dignity of Risk Looks Like in Practice

Dignity of risk does not mean ignoring safety concerns. It means ensuring that when a risk exists, the participant is informed about the risk, understands it, and makes a conscious choice to accept it. The provider's obligation is to inform — not to decide on behalf of the participant.

Common examples in SIL and daily support include:

• A participant who chooses to eat foods that are not aligned with dietary advice from their GP
• A participant who chooses to go out at night without a support worker
• A participant who declines to take prescribed medication
• A participant who wants to manage their own money despite previous difficulties with budgeting
• A participant who chooses to engage in a relationship that others in their life consider unsuitable
• A participant who wants to try a new activity that involves physical risk (such as swimming or cycling)

In each of these situations, the provider's role is to ensure the participant has the information they need, to discuss the risks openly, to document the conversation and the participant's decision, and to continue providing supports without withdrawing or reducing them as a consequence of the participant's choice.

Documenting Dignity of Risk Decisions

Documentation is critical when dignity of risk decisions are made. A Dignity of Risk Assessment (Document 37 in the SIL Rescue Kit) should record:

• The decision the participant is making
• The risks that have been identified and discussed
• How the information was communicated (verbally, in writing, with visual supports, etc.)
• The participant's understanding of the risks (including evidence that they understood)
• The participant's decision and their reasons (if shared)
• Any risk mitigation strategies that can be put in place while still respecting the participant's choice
• The signatures of the participant (or their nominee) and the staff member
• A review date to revisit the decision

This documentation protects both the participant and the provider. It demonstrates that the participant was informed, that their autonomy was respected, and that the provider did not simply abdicate their duty of care.

Accessible Information Obligations

Under NDIS Practice Standard Outcome 1.2 and 1.4, providers must ensure that information is accessible to participants. This is not limited to the rights statement — it applies to all information the provider gives to participants, including service agreements, support plans, complaints processes, privacy notices, and day-to-day communications.

Easy Read Documents

Easy Read is a format that uses simple language, short sentences, and images to convey information. It is particularly important for participants with intellectual disability, cognitive impairment, or limited literacy. The NDIS Commission has published Easy Read versions of key documents (including the NDIS Code of Conduct) and expects providers to do the same for their own participant-facing documents.

At minimum, providers should have Easy Read versions of:

• The participant rights statement
• The complaints process (how to make a complaint)
• Key terms of the service agreement
• Information about the NDIS Commission (including the complaints phone number: 1800 035 544)

Translated Materials

For participants from culturally and linguistically diverse (CALD) backgrounds, providers may need to provide translated versions of key documents or arrange interpreter services. The Translating and Interpreting Service (TIS National) on 131 450 provides free interpreting services for non-English speakers communicating with Australian organisations. Providers should document when interpreter services are used and record that information was communicated in the participant's preferred language.

Communication Supports

Some participants use augmentative and alternative communication (AAC) systems — such as communication boards, speech-generating devices, or sign language. Providers must ensure that information is provided in a format compatible with the participant's communication system, and that support workers are trained to communicate effectively using these systems.

The Right to Complain Without Retaliation

The right to complain is one of the most critical participant rights — and one of the most frequently cited areas of concern by the NDIS Commission. Participants must be able to raise concerns, make complaints, and provide feedback about any aspect of their supports without fear that doing so will result in negative consequences.

Provider Obligations

Under NDIS Practice Standard Outcome 1.5, providers must:

• Have an accessible complaints and feedback process that is communicated to all participants
• Provide multiple channels for making complaints (verbal, written, anonymous, through an advocate)
• Acknowledge complaints promptly (within 2 business days per NDIS Commission guidance)
• Resolve complaints within a reasonable timeframe (30 calendar days per NDIS Commission guidance)
• Inform complainants of the outcome and any actions taken
• Inform participants of their right to escalate to the NDIS Commission (1800 035 544)
• Maintain a complaints register that tracks all complaints from receipt to resolution
• Use complaints data for continuous improvement

Anti-Retaliation Obligations

Providers must take active steps to ensure that participants who make complaints do not experience any form of retaliation. This includes changes to support delivery, changes to rostering (such as assigning a different worker without explanation), reduced communication, or any other change that could reasonably be perceived as a consequence of the complaint. Staff training should cover anti-retaliation obligations explicitly, and managers should monitor for any retaliatory behaviour after a complaint is made.

The NDIS Commission takes retaliation against complainants extremely seriously. In its compliance and enforcement activity reports, the Commission has identified retaliation as one of the most harmful behaviours a provider can engage in — because it discourages participants from reporting legitimate concerns, which can allow unsafe practices to continue undetected.

Privacy and Confidentiality Rights

Participant privacy rights operate at two levels: the Privacy Act 1988 (which applies to all organisations with an annual turnover of $3 million or more, and to all health service providers including NDIS providers) and the NDIS Practice Standards (Outcome 1.3), which set sector-specific expectations.

Collection of Personal Information

Providers must only collect personal information that is reasonably necessary for providing NDIS supports. They must inform participants about what information is being collected, why it is being collected, and who it may be shared with. Consent to collect information should be obtained using a dedicated consent form (Document 29 in the SIL Rescue Kit) — not buried in the fine print of a service agreement.

Use and Disclosure

Personal information must only be used for the purpose for which it was collected, unless the participant has consented to a different use or disclosure is required by law (such as mandatory reporting of reportable incidents to the NDIS Commission). Providers must have clear policies about information sharing — including who within the organisation can access participant information, how information is shared with other service providers, and how requests for information from third parties (including family members) are handled.

Storage and Security

Participant records must be stored securely, with access limited to authorised personnel. For paper records, this means locked cabinets in a secure location. For electronic records, this means password-protected systems with role-based access controls. Providers must also have a data breach response plan (Document 59 in the SIL Rescue Kit) that outlines how they will respond if personal information is compromised.

Access and Correction

Participants have the right to access the personal information held about them and to request corrections if the information is inaccurate. Providers must respond to access requests within a reasonable timeframe (30 days under the Privacy Act) and must not charge excessive fees for providing access.

What Auditors Check for Participant Rights

During a certification audit, the NDIS Approved Quality Auditor will assess your compliance with Outcome 1 (Rights and Responsibilities) through a combination of document review, staff interviews, and participant interviews. Understanding what they look for helps you prepare effectively.

Document Review

Auditors will request copies of the following documents related to participant rights:

• Participant Rights Statement (provided to all participants)
• Service agreements (signed by both parties)
• Consent forms (consent to collect information, consent to share information)
• Privacy policy and privacy notice
• Complaints and feedback policy
• Complaints register (with evidence of resolution and continuous improvement)
• Dignity of risk assessments (where applicable)
• Easy Read or translated versions of key documents (where applicable)
• Staff training records showing training on participant rights, the NDIS Code of Conduct, and complaints handling

Staff Interviews

Auditors will interview frontline staff to assess whether they understand participant rights in practice — not just whether the organisation has the right policies. Common questions include:

• "How do you ensure participants are involved in decisions about their supports?"
• "Can you give an example of when a participant made a decision that involved risk? How did you handle it?"
• "How would a participant make a complaint? What would happen after they complained?"
• "How do you protect participant privacy in a shared living environment?"

Staff who cannot answer these questions — regardless of how comprehensive the provider's written policies are — indicate a gap between policy and practice that auditors will flag as a non-conformance.

Participant Interviews

Auditors will also speak directly with participants (with their consent) to verify that they are aware of their rights, know how to make a complaint, feel that their choices are respected, and feel safe in their support environment. Participant feedback that contradicts the provider's documented systems is a significant audit risk.

Implementing a Rights-Based Culture

Having the right documents is necessary but not sufficient. Auditors — and more importantly, participants — need to see that participant rights are embedded in your organisation's culture, not just its filing system. Here are practical steps to move from compliance-on-paper to compliance-in-practice.

Staff Induction

Every new staff member should receive training on participant rights as part of their induction (Document 32 in the SIL Rescue Kit includes a 26-item Staff Induction Checklist with specific rights-related items). This training should cover the NDIS Code of Conduct, the organisation's rights statement, dignity of risk principles, and the complaints process. Training should be documented in the Training Register (Document 45).

Ongoing Training

Rights training should not be a one-off event. Schedule annual refresher training that includes case studies, scenario-based discussions, and reviews of any complaints or incidents that involved participant rights. Use real (de-identified) examples from your own organisation to make the training relevant and practical.

Supervision Conversations

Include participant rights as a standing agenda item in supervision sessions. Ask staff about recent situations where they had to balance duty of care with dignity of risk, or where they encountered a communication challenge in obtaining informed consent. These conversations help identify gaps in understanding before they become audit non-conformances.

Participant Feedback

Regularly seek feedback from participants about whether they feel their rights are upheld. This can be done through formal surveys, informal conversations, or structured feedback sessions. The key is to make it easy for participants to provide honest feedback — which means using accessible formats, offering anonymity where possible, and demonstrating that feedback leads to action.

Continuous Improvement

Your Continuous Improvement Register (Document 43 in the SIL Rescue Kit) should include entries related to participant rights — for example, improvements made in response to complaints, changes to accessible information formats based on participant feedback, or new training initiatives prompted by audit findings. Auditors specifically look for evidence that the organisation learns from participant rights issues and takes corrective action.

Writing accurate, respectful NDIS progress notes is one of the most practical ways support workers can uphold participant rights on a daily basis. Every shift note that uses person-first language, documents participant choices, and links support delivery to participant goals is evidence of a rights-based culture in action.