NDIS privacy and confidentiality policy: what auditors look for

Why privacy and confidentiality is a core audit focus

For SIL providers and registered NDIS organisations, privacy is not a box-ticking exercise. The NDIS Commission treats the handling of participant information as a direct indicator of participant safety and dignity. During a certification or verification audit, an approved quality auditor will examine your privacy and confidentiality framework closely — not only whether a policy document exists, but whether it is implemented, understood by staff, and reflected in your day-to-day practices.

The obligations stem from multiple sources that auditors hold together: the NDIS Practice Standards (in particular the Rights and Responsibilities module), the NDIS Code of Conduct, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and — from 2026 — the strengthened Practice Standards framework that places greater weight on governance, transparency, and participant-centred documentation.

What an approved quality auditor actually checks

Auditors are trained to look beyond the existence of a policy. They use a triangulation approach: document review, staff interviews, and participant feedback. The following areas are the most commonly examined during a privacy audit.

1. The policy document itself

Auditors will read your privacy and confidentiality policy and expect it to cover, at minimum:

• The types of personal and sensitive information your organisation collects (including health information, disability-related records, financial details, and family circumstances)
• The lawful basis for collecting each category of information
• How information is stored, including physical and electronic security controls
• Who can access participant records and under what circumstances
• Procedures for sharing information with third parties, including other service providers, families, and government agencies
• How participants can access, correct, or request deletion of their own information
• How the organisation responds to a privacy breach or suspected breach
• Reference to the Privacy Act 1988 and Australian Privacy Principles
• A review schedule (typically annual or following a significant incident)

A policy that is generic, undated, or clearly copied from a template without adaptation to your service type will attract scrutiny. Auditors note when the policy does not reflect the realities of the service — for example, a SIL provider whose policy makes no mention of support worker access to in-home records.

2. Consent and information collection procedures

Under the Australian Privacy Principles, organisations must generally collect personal information directly from the individual and only with their knowledge. For NDIS participants, this means your intake process must include a clearly worded consent form that:

• Explains what information is being collected and why
• Identifies who the information may be shared with
• Gives the participant a genuine choice to withhold consent for non-essential disclosures
• Is accessible — written in plain English, available in alternative formats where needed

Auditors will ask to see a sample consent form and may compare it against what participants report they were told during intake.

3. Staff training and awareness

A policy is only as strong as the staff who follow it. Auditors will ask workers directly: "What do you do if a family member calls asking about a participant's support schedule?" or "Where do you store case notes?" Common non-conformances arise when staff cannot articulate the organisation's privacy rules or when training records show privacy has not been covered in induction or refreshers.

Your training evidence should include:

• Induction checklists that include privacy training
• Sign-off records for annual privacy refreshers
• Scenario-based training materials that reflect real situations in your service type

4. Information security controls

Under the NDIS Practice Standards, providers must take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. Auditors will ask about:

• Password policies and multi-factor authentication for electronic records
• Physical document security (locked filing, clean-desk practices)
• Procedures for disposing of records containing personal information
• Controls on personal devices used by support workers
• Cloud storage and third-party software — are data processing agreements in place?

5. Breach identification and response

The Notifiable Data Breaches (NDB) scheme under the Privacy Act requires eligible organisations to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals when a data breach is likely to result in serious harm. NDIS providers holding health information are squarely in scope.

Auditors want to see a documented breach response procedure that includes:

1. How a potential breach is identified and escalated internally
2. The assessment process for determining whether notification is required
3. Template notifications for the OAIC and affected participants
4. A breach register (even if it contains no entries — a blank register demonstrates the system exists)

6. Participant access and complaints

Participants have the right under the APPs to request access to their own personal information and to have inaccurate information corrected. Auditors check whether your policy and procedures explain how a participant makes such a request, your response timeframe, and the process for managing disagreements about access.

Separately, the NDIS Code of Conduct requires providers to have a complaints management system. Auditors will check that privacy complaints can be lodged through this system and are handled appropriately, including referral to the OAIC where relevant.

Common non-conformances auditors find

The 2026 strengthened framework: what is changing

The NDIS Commission's strengthened Practice Standards, progressively taking effect through 2026, place greater emphasis on governance and operational management. For privacy, this means auditors will probe more deeply into whether privacy obligations are embedded in governance structures — not just documented in a standalone policy. Expect questions about board or leadership oversight of privacy risk, how privacy considerations feature in new service design decisions, and whether your organisation has a named privacy officer or equivalent accountability role.

The strengthened framework also reinforces the link between privacy and participant dignity and autonomy. Auditors will look at whether participants are genuinely informed and in control of their own information, not simply processed through a consent form at intake.

How to prepare: a practical audit-readiness checklist

1. Pull your current privacy and confidentiality policy and check the version date and review log.
2. Map every category of personal information you hold against the purpose for collection and the APP that applies.
3. Review your intake consent form — does it name all third parties you share information with?
4. Check training records: has every current staff member completed privacy training in the last 12 months?
5. Locate your breach register and confirm the response procedure is documented and tested.
6. Obtain or renew data processing agreements with any cloud software vendors.
7. Confirm your complaints procedure explicitly covers privacy complaints and references the OAIC as an external avenue.
8. Brief your management team on how privacy risk is reported and overseen at a governance level.

If you are working through a full registration or re-registration audit, privacy policy gaps rarely appear in isolation — they tend to sit alongside gaps in incident management documentation, complaints records, and participant rights procedures. The ndiscompliant.com.au 74-document SIL compliance kit includes a fully drafted privacy and confidentiality policy, breach register template, consent form, and staff training acknowledgement forms, aligned to the current Practice Standards and the 2026 strengthened framework — useful if you are building your document set from scratch or conducting a gap review before your audit date.