Restrictive practice: NDIS notification timeframes

Why notification timeframes matter for SIL providers

For providers delivering Supported Independent Living (SIL), the use of regulated restrictive practices is one of the most tightly governed areas of NDIS compliance. The NDIS Commission does not treat restrictive practice notifications as optional paperwork — they are a core mechanism for protecting participants from harm and ensuring that any restriction on a person's rights is proportionate, time-limited, and properly authorised.

The strengthened NDIS Practice Standards, which have progressively come into effect from 2024 through 2026, place even greater emphasis on timely reporting and evidence of reduction planning. SIL providers, in particular, face heightened scrutiny because restrictive practices are more likely to arise in residential settings where support is intensive and continuous.

This explainer covers who is required to notify, what must be reported, when, and what happens if deadlines are missed.

What counts as a regulated restrictive practice

Under the National Disability Insurance Scheme (Restrictive Practices and Behaviour Support) Rules 2018, a regulated restrictive practice is any practice or intervention that limits the rights or freedom of movement of an NDIS participant. The five categories are:

• Seclusion — confining a participant to a space alone
• Chemical restraint — using medication to control behaviour (not for a diagnosed condition)
• Mechanical restraint — using a device to limit movement
• Physical restraint — using physical force to restrict movement
• Environmental restraint — restricting access to areas, objects, or activities

If your SIL service uses any of these — even as a de-escalation measure — you are subject to the full reporting framework.

The core notification obligations

Registered NDIS providers who use regulated restrictive practices have three distinct notification obligations to the NDIS Commission:

1. Behaviour support plan authorisation before use

Before a regulated restrictive practice can lawfully be used, a behaviour support plan developed by a registered NDIS behaviour support practitioner must be in place. The plan must be approved through the relevant state or territory authorisation process. Providers must not use a regulated restrictive practice without this plan — there is no grace period for emergency use without a plan already in place, except in narrow circumstances defined by state/territory law where immediate safety risk exists.

2. Notification of use within five business days

The NDIS Restrictive Practices and Behaviour Support Rules require registered providers to notify the NDIS Commission of the use of a regulated restrictive practice. The standard timeframe is within five business days of the use occurring. This applies each time a regulated restrictive practice is used, not just the first time it is implemented.

The notification must be submitted through the NDIS Commission's online portal (the provider portal). It is not sufficient to simply record the event in your internal incident management system — the Commission must be notified directly and separately.

3. Ongoing three-monthly reporting

Providers are also required to report to the NDIS Commission on the use of regulated restrictive practices on at least a three-monthly basis. These reports must include data on frequency, type, and duration of each practice used, as well as evidence of progress toward reduction. The three-monthly report is not a substitute for the five-business-day notification — both are required.

What the notification must contain

A compliant notification to the NDIS Commission for the use of a regulated restrictive practice must include, at minimum:

• The participant's NDIS number
• The date and time the restrictive practice was used
• The type of regulated restrictive practice used
• The duration of the practice
• The reason the practice was used (the behaviour or risk that triggered it)
• Whether a behaviour support plan was in place at the time
• Whether state or territory authorisation was in place
• Whether the event also constitutes a reportable incident under the incident management rules

Incomplete notifications are treated as non-compliant and may prompt a compliance inquiry. Providers should have a standard internal form or system that captures all required fields at the point of the event, so that the portal notification can be completed accurately within the five-business-day window.

Interaction with reportable incident obligations

Some uses of regulated restrictive practices will also trigger the NDIS Commission's reportable incident notification obligations. Under the NDIS (Incident Management and Reportable Incidents) Rules 2018, the use of a restrictive practice that causes serious injury or harm, or that was used without an authorised behaviour support plan, may be a reportable incident requiring notification within 24 hours (for priority incidents) or five business days (for other reportable incidents).

SIL providers need to assess each event against both the restrictive practice notification rules and the reportable incident rules. Where both obligations apply, both notifications must be submitted. The reportable incident notification does not replace the restrictive practice notification, and vice versa.

Consequences of missing notification timeframes

The NDIS Commission takes non-compliance with restrictive practice notification timeframes seriously. The consequences range along a spectrum of severity:

• Written notice and required corrective action plan — the most common initial response to a missed notification
• Compliance audit — the Commission may trigger an unscheduled audit of your organisation's restrictive practice and behaviour support documentation
• Conditions on registration — the Commission can impose conditions that limit which supports you can deliver or require enhanced oversight
• Banning orders — individuals whose conduct contributed to systemic notification failures can be banned from working in the NDIS
• Civil penalties — under the National Disability Insurance Scheme Act 2013, registered providers who fail to notify as required are exposed to civil penalty provisions
• Suspension or revocation of registration — in serious or repeated cases, registration may be suspended or revoked

It is worth noting that the strengthened 2026 Practice Standards have tightened the linkage between restrictive practice governance and the broader Quality Management System requirements. Auditors now assess whether providers have systemic controls — not just whether individual notifications were submitted — so a pattern of late notifications is likely to be treated as a systemic quality failure, not just an administrative slip.

Building a compliant internal process

Proactive SIL providers treat the five-business-day window not as a deadline to race toward, but as a prompt to build a reliable same-day or next-business-day internal capture process. A practical internal workflow should include:

1. Immediate incident log entry — support workers record the event in your incident management system at the time it occurs or at handover
2. Supervisor review within 24 hours — the team leader or practice lead reviews the log entry, determines whether it meets the threshold for a regulated restrictive practice, and flags for notification
3. Portal notification submitted by day two — submitting by day two provides a buffer against system issues or staff leave
4. Notification reference number saved — the Commission portal generates a reference number; this must be saved against the participant's file
5. Behaviour support practitioner notified — the practitioner who authored the behaviour support plan should be informed so they can review whether plan adjustments are needed
6. Three-monthly report calendar entry — ensure the quarterly aggregate report is scheduled and assigned to a specific staff member

If your organisation is approaching the 2026 mandatory registration deadline and needs to bring restrictive practice documentation into shape quickly, ndiscompliant.com.au offers a 74-document audit-ready SIL compliance kit that includes notification templates, behaviour support plan checklists, and a restrictive practice register — purpose-built for SIL providers navigating the strengthened framework.

State and territory authorisation still applies

NDIS Commission notification obligations sit alongside — not instead of — state and territory authorisation requirements. Each jurisdiction has its own process for authorising the use of regulated restrictive practices, and the relevant authorising body (such as the Senior Practitioner in Victoria or the equivalent body in other states) must approve the practice before it is used. Providers operating in multiple states need compliance processes for each jurisdiction's authorisation pathway in addition to the national Commission notification obligations.