NDIA Privacy Policy

A short Privacy Notice for prospective participants and participants in the NDIS can be accessed here.

The NDIA's more detailed Privacy Policy is set out below.

Part A – About this privacy policy

What is the National Disability Insurance Agency?

The National Disability Insurance Agency is responsible for delivering the National Disability Insurance Scheme.

The National Disability Insurance Scheme trial has commenced in:

Roll out of the full scheme will commence progressively from July 2016.

Find out more about where and when the National Disability Insurance Scheme is available.

You can learn more about the NDIS via:

  • the NDIS Helpline on 1800 800 110
  • Or email using the Contact form.

NDIS services are jointly funded by the Australian Government and participating state and territory governments.

What are National Disability Insurance Agency’s privacy obligations?

Our policy is to respect and protect the privacy of our users. This privacy policy tells you the kinds of personal information we collect and hold, how and why we collect and hold that information and how we use it. It also tells you how you can access and amend your personal information and how you may make a complaint if you think that we have breached our privacy obligations.

Your personal information is information about you which can identify you and includes your name, address, date of birth, and can include information about your illnesses, symptoms, disabilities and any information collected about you to provide a health service.

In dealing with personal information, the National Disability Insurance Agency abides by the obligations imposed on it under the Privacy Act 1988 (Cth) (Privacy Act) and any applicable State or Territory privacy laws.

The Privacy Act authorises the collection of personal information in order to facilitate your access to the National Disability Insurance Scheme and perform the National Disability Insurance Agency’s other functions.

The National Disability Insurance Agency is also bound by strict confidentiality and secrecy provisions in the National Disability Insurance Scheme Act 2013 (Cth) (NDIS Act). These provisions limit how the National Disability Insurance Agency collects and uses your information and when and to whom it can be released.

Part B – Our personal information handling practices

What kinds of personal information does the National Disability Insurance Agency collect and hold?

The kinds of information the National Disability Insurance Agency collects and holds includes (but is not limited to) personal information about users of its services, and about its employees and contractors.

Except where you lodge a request to become a participant in the National Disability Insurance Scheme and are subsequently in receipt of supports from the National Disability Insurance Scheme, you can choose to deal with the National Disability Insurance Agency anonymously, in which case your details are not subject to privacy laws because you cannot be identified as connected to the information. If you lodge a request to become a participant in the National Disability Insurance Scheme and subsequently receive supports, it is impracticable for the National Disability Insurance Agency to deal with you on an anonymous basis.

How will the National Disability Insurance Agency collect and hold your personal information?

The information you give the National Disability Insurance Agency and information collected from providers with your consent is the only information it collects and holds. If you identify yourself, the National Disability Insurance Agency will usually know your name, gender, contact details, some medical history, your symptoms, ethnic background and, if relevant to your health, sexual practice.

We may sometimes collect personal information from a third party if you have consented, been told of this practice or would reasonably expect us to collect the information in this way, for example from a healthcare service such as a residential care facility which is managing your care.

All calls to the National Disability Insurance Agency in relation to its health services are recorded and are retained for up to 25 years as is usual with health information.

What uses and disclosures of personal information may occur?

The National Disability Insurance Agency collects, holds, uses and discloses personal information for the purpose of providing its services, conducting its business, communicating with you, conducting research and evaluation on the National Disability Insurance Agency’s services and complying with its legal obligations.

The National Disability Insurance Agency uses recordings of all phone calls to ensure that the advice it gives meets the highest standards of safety and quality and is equal to best international practice.

The National Disability Insurance Agency will share relevant information with health services and/or Government bodies in the event of a national or local health disaster in order that an appropriate health response can be provided.

The National Disability Insurance Agency may use your personal information to make a follow up call to you for feedback on your level of satisfaction with the service you have received.

The National Disability Insurance Agency will not normally disclose your personal information to anyone outside the National Disability Insurance Agency except where you consent, or where the identifying data can be removed. In circumstances where you have not consented to the disclosure of your personal information, the National Disability Insurance Agency will ensure that it is otherwise authorised to disclose that information before it does so.

Where a patient is unconscious, incapacitated or a child, the National Disability Insurance Agency deals on their behalf with the person responsible for their welfare.

There may be other disclosures where:

  • you would expect the disclosure to occur (for example, quality assurance purposes, training and the purpose of enhancing the National Disability Insurance Agency service);
  • it will assist your Commonwealth, State or Territory health services or department of health to provide you with a health service or to address issues you may raise with them;
  • the National Disability Insurance Agency is required or authorised by law to disclose;
  • it will prevent or lessen a serious and imminent threat to someone's life or health or a threat to public health or safety;
  • it is required for public health surveillance where symptoms are mapped geographically to see if patterns arise as an early warning system identifying epidemics;
  • it is a necessary part of an investigation following a complaint;
  • the National Disability Insurance Agency uses a contractor to provide some services and the contractor needs participant, provider, carer or other person’s details; or
  • the National Disability Insurance Agency arranges for another person or organisation to conduct research or evaluation activity to check on or improve our services or for the purposes of our legislation, although your consent will usually be sought if your information is likely to be disclosed.

The National Disability Insurance Agency uses an Australian Government computer system to store personal information. Users of the system other than staff of the National Disability Insurance Agency may at times be able to see your name if you are a participant, provider of supports, nominee or other person known to the National Disability Insurance Agency, when performing duties for their own programs, but are not permitted to record, use or disclose that information and they will not be aware that you are a participant with the National Disability Insurance Agency.

A State or Territory government official will also have access to your information as part of the agreement between governments. This is because the States and Territories contribute to funding the National Disability Insurance Scheme and need to evaluate aspects of the operation of the scheme.

The National Disability Insurance Agency will not sell or rent your personal information to anyone and will not transfer your information overseas unless you agree to the National Disability Insurance Agency doing so.

When the National Disability Insurance Agency uses contractors to perform services, such as disposal of confidential documents, they are required to work according to the provisions of the Privacy Act applicable to the National Disability Insurance Agency as well as the provisions already applicable to the contractor. The contractor is also required to treat personal information they may see with care and confidentiality. In most cases, any breach of these requirements would be a breach of our contract with them.

How does the National Disability Insurance Agency deal with Tax File Numbers?

If you give us your Tax File Number (TFN), we have an obligation to keep that information secure. Due to the sensitivity the National Disability Insurance Agency places on TFNs and the legal restraints on their use and disclosure, if you lose your TFN the National Disability Insurance Agency will not be able to provide it to you. In these circumstances you will have to ask the Australian Taxation Office for a copy of it. The National Disability Insurance Agency can only provide TFNs to third parties under strict conditions as authorised or required by law. In limited circumstances, the Australian Taxation Commissioner can be required by law to provide your TFN to the National Disability Insurance Agency.

How does the National Disability Insurance Agency protect your personal information?

The National Disability Insurance Agency acts to ensure that no other organisation or person can access your personal information without your consent while the National Disability Insurance Agency holds it. In addition to those organisations and persons that you have provided your consent to access your information, the National Disability Insurance Agency permits only its authorised personnel and contractors to access your information.

The National Disability Insurance Agency has systems and procedures in place to protect your personal information from misuse and loss, and from unauthorised access, modification or disclosure.

Part C – Our website

This part of our Privacy Policy explains the kinds of information that is collected by the National Disability Insurance Agency in managing and operating its website, how such information is used and under what circumstances and to whom it may be disclosed.

What are the National Disability Insurance Agency’s web-based services?

The National Disability Insurance Agency web-based services are included on the National Disability Insurance Scheme website. This also includes participant and provider portals.

The National Disability Insurance Agency web-based services have been tested to an advanced level of site security. However, users are advised that there are inherent risks in transmitting information across the internet, including the risk that information sent to or from a website may be intercepted, corrupted or modified by third parties. If you have any security concerns, or if you wish to provide personal information by other means (eg by telephone or paper), you may contact the National Disability Insurance Agency using the contact details set out at the bottom of this email.

What personal information does the National Disability Insurance Agency collect and hold from website users?

The National Disability Insurance Agency does not collect your personal information when you only browse our website.

The National Disability Insurance Agency may collect your personal information if you transmit personal information to us through our website or by e-mail. To the extent that your e-mail address contains personal information, the National Disability Insurance Agency will only record your email address in the event that you send us an e-mail or you register for our email newsletter or notification services.

You can unsubscribe to our newsletter and notification services at any time by following the prompts on our website or by contacting us on the contact details set out at the bottom of this statement.

What uses and disclosures occur of personal information collected from our website?

The National Disability Insurance Agency will only use personal information collected via its website for the purposes for which you provided the information.

Your e-mail address will only be used for the purpose for which you have provided it and will not be added to any mailing lists without your prior consent. We will not use or disclose your e-mail address for any other purpose without your consent, unless it is otherwise in accordance with the Privacy Act.

We do not share your personal information with other organisations unless one of the limited circumstances set out in Part B of this Privacy Policy applies (see Part B, 'What uses and disclosures of personal information may apply').

Does the National Disability Insurance Agency use cookies?

A "cookie" is a small file supplied by the National Disability Insurance Agency and stored by the web browser software on your computer when you access the National Disability Insurance Agency. (An explanation of cookies can be found at the website of the Australian Privacy Commissioner.)

The National Disability Insurance Agency uses a session cookie for maintaining contact with a user throughout a web browsing session. At the end of your session, you may choose to manually logoff and the cookie is immediately deleted. If you do not logoff at the end of your session, the National Disability Insurance Agency will automatically log you off after about 20 minutes. This will ensure that no other person has access to information personalised for you.

If you wish to use the features of the National Disability Insurance Agency that enable us to personalise the site for you, you must use a browser which is enabled to accept cookies.

The National Disability Insurance Agency analyses non-identifiable website traffic data (including through the use of third party service providers) to improve our services and for statistical purposes.

No attempt will be made to identify anonymous users (including users logging on using a pseudonym) or their browsing activities except, in the unlikely event of an investigation, where a law enforcement agency may exercise a warrant to inspect the Internet Service Provider's log files.

Are any parts of the National Disability Insurance Agency website run by third parties?

Yes, some functionality of this website is not run by the National Disability Insurance Agency and third parties may capture and/or store the above information about you outside of Australia. These third parties include FaceBook, YouTube, MailChimp, Twitter and Google and may not be subject to the Privacy Act. Some third parties who are bound by the Privacy Act are also responsible for some of the functionality of the National Disability Insurance Agency’s website, such as the Department of Social Services. The National Disability Insurance Agency is not responsible for the privacy practices of these third parties and encourages you to examine each website's privacy policies and make your own decisions regarding their reliability.

This website also contains links to other websites. The National Disability Insurance Agency is not responsible for the content and privacy practices of other websites and encourages you to examine each website's privacy policies and make your own decisions regarding the reliability and correctness of material and information found.

Part D – Queries, concerns and further information

How does the National Disability Insurance Agency ensure that the personal information it holds is accurate & how can I access the information held about me?

The National Disability Insurance Agency seeks to ensure that the information it holds about you is accurate, up to date, complete and relevant before acting on it. If you learn that personal information the National Disability Insurance Agency holds about you is inaccurate, not up to date, incomplete, irrelevant or misleading you should contact the National Disability Insurance Agency so that your information can be promptly corrected.

If you make a request for the Agency to correct personal information it holds about you, the National Disability Insurance Agency must respond to you within 30 days of your request. If the National Disability Insurance Agency decides to correct your personal information, you can request that we notify that change to any other agencies or organisations that we have previously disclosed the personal information to.

If the National Disability Insurance Agency refuses to correct your personal information, we will give you written notice of the decision, setting out our reasons for refusing your request and the options available to you to complain about the decision. You can also request that we associate a statement with the personal information that you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

If you wish to see what information the National Disability Insurance Agency holds about you, you can check the Participant’s Portal or Provider’s Portal as a first step. This will contain almost all the information the National Disability Insurance Agency has about you. Regardless of that, or if you think we may have additional personal information, you can ask to access that information (see our Accessing Information page). The National Disability Insurance Agency is required to respond to your request within 30 days of your request. Sometimes it may not be possible to give you a copy of the information, if it contains details about other people, or if it would be unsafe to provide the information in that it may lead to harm being done to another person.

If we refuse your request for access to personal information, we will take reasonable steps to give you access to the information in a way that meets your needs and the needs of the National Disability Insurance Agency. We will also provide you with a written notice setting out the reasons for refusal, and the options available to you to complain about the decision.

What if I have a complaint?

If you wish to complain about the service you have received from the National Disability Insurance Agency, especially if you think we have breached our privacy obligations, you should contact the National Disability Insurance Agency as detailed below for an examination of your complaint. If after that you are still unhappy you can complain about a privacy matter to the Office of the Australian Information Commissioner. See the Office of the Australian Information Commissioner website for how to make a complaint.

The Office of the Australian Information Commissioner is independent of the National Disability Insurance Agency and has the power to investigate complaints about possible interferences with your privacy. Please note that it is usually best to contact the National Disability Insurance Agency first. While it is possible for the first contact to be with the Office of the Australian Information Commissioner, they will generally ask the National Disability Insurance Agency to conduct its own inquiry first and pass any findings on to the Office of the Australian Information Commissioner.

Does the National Disability Insurance Agency change its policies on privacy from time to time?

The National Disability Insurance Agency may update this Privacy Policy from time to time. To see the most current Privacy Policy, please look at the National Disability Insurance Scheme website or contact the National Disability Insurance Agency.

How can you contact us?

You can contact us by visiting the contact us page.