Frequently asked questions

Find answers to some of our most commonly asked questions about privacy

Personal information includes a broad range of information, or an opinion, that could identify a person.
Sometimes, whether information is 'personal information' depends on the context or circumstances.
For example, personal information may include a person’s:

name, signature, address, phone number or date of birth
sensitive information
credit information
employee record
photograph
internet protocol (IP) address
voice print and facial recognition biometrics (because they collect characteristics that make an individual’s voice or face unique)
location information from a mobile device (because it can reveal user activity patterns and habits).

The Privacy Act 1988 doesn’t cover the personal information of someone who has died.

Sensitive information is personal information that includes information or an opinion about a person’s:

racial or ethnic origin
political opinions or associations
religious or philosophical beliefs
trade union membership or associations
sexual orientation or practices
criminal record
health or genetic information
some aspects of biometric information.

Generally, sensitive information has a higher level of privacy protection than other personal information.

You can get access to the personal information we have about you. More information is available on the Access to Information page.

We keep personal information about different people. For example,

people who use the NDIS
our staff
disability service providers.

The personal information we keep includes:

name
address
date and place of birth
contact details
gender
bank account details
financial information or suspicious transactions, international transactions, and large transactions
Centrelink Customer Reference Number (CRN)
Court documents, such as parenting orders, compensation determinations, statements and medical reports
information about your disability, health and support requirements
any other information you or your provider or representative provides to us, including contact details for those other people
information about your use of our digital services.

You don’t have to give us all the information we ask you to provide, but if you do not provide us with some or all of the personal information required, you may not be able to access some of our services.

While you do not have to provide us with all information requested, not providing this information to us may mean that we may not be able to make decisions about you.

The NDIA often gets requests for information from:

NDIS participants
child representatives
nominees
prospective participants or the person who helped them request information
other people, such as lawyers or representatives, who have consent from a participant for the NDIA to share their information.

The NDIA takes privacy seriously.

The NDIA must see proof that the person has your consent to see your information. You can give consent to someone by using one of our consent forms on the NDIS website.

Consent is a record of the permission you have given. More information is available on the Understanding Consent page .

You can give consent by using one of our consent forms on the NDIS website. Or you can give your consent on the phone, in person, in writing, or the way you want to communicate.

You can contact us to change or take away your consent at any time.

We won’t share your information unless we have your consent, except where required by law.

If you want to provide consent, you can do so using a consent form.

For more details about the consent form, and how it is used, see the Consent form page. To find out more about how the NDIA shares information with state and territory agencies, see the

Sharing participant information page.

You can get access to the personal information we have about you. More information is available on the Access to Information page.

You can also access your own information by making a request on the Participant Information Access Request page.

Participant information cannot be destroyed in line with our legislative obligations under the Archives Act 1983 (Cth) (Archives Act).

This is because the NDIA has obligations under the Archives Act to retain information it receives in a Commonwealth record and one of the provisions makes it an offence to delete or change a Commonwealth record unless an exception applies. A request to delete a record if you do not wish to become a participant is not a valid exception.

The NDIA take privacy seriously and is bound by strict legal obligations in relation to the collecting, recording, using and disclosing of personal information.

Our policy is to respect and protect the privacy of all people connected with the NDIS and we take steps to ensure that no-one outside the NDIA can access information we hold about a participant without their consent, unless that access is authorised or required under law.

If we need to disclose personal information outside the NDIA, we will de-identify the information prior to disclosure, wherever possible. We will only disclose personal information where:

it is done in accordance with the Privacy Policy;
the person consents; or
the disclosure is authorised or required under law.

The Privacy Policy tells you the kinds of organisations or people that your information might be shared with.

Registered providers need to follow the NDIS Code of Conduct and meet quality standards , which show they provide quality, safe supports to participants. The standards also help participants to know what they should expect from their registered providers.

If you have a concern about your current NDIS supports or services and you don’t feel able to complain to your provider or if you are unhappy with the provider’s response to your complaint, you can contact the NDIS Quality and Safeguards Commission.

More information is available on their website: Complaints Management and resolution guidance | NDIS Quality and Safeguards Commission (ndiscommission.gov.au)

A child representative is usually a person or persons who have parental responsibility for a child under the laws for the NDIS.

They do things and make decisions about the NDIS on behalf of a child. In most cases, a child’s parents or guardian will automatically be their representative.

More information is available on the website at Child representatives | NDIS .

If you think the NDIA may have breached our privacy obligations in relation to the handling of your personal information, you may make a complaint by contacting us using the contact details in the NDIA Privacy Policy.

Your complaint should be made in writing and include contact details for communicating with you, and all relevant details to enable us to understand, investigate and assess the matter.

We will respond to your complaint within a reasonable timeframe. We are committed to quick and fair resolution of any complaints and will ensure your complaint is taken seriously. You will not be victimised or suffer negative treatment if you make a complaint.

If you are not satisfied with the outcome of the complaint or the way it was handled by us, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC). Further information about how to do this is available on the OAIC website .

The OAIC is independent of the NDIA and has the power to investigate complaints about possible interferences with a person’s privacy. It is usually best to contact us first about any privacy concerns. This is because the OAIC will generally ask us to investigate the matter first and provide it with our findings concerning the matter.

We comply with the Privacy Act in handling privacy breaches and will notify affected individuals and the OAIC of serious data breaches where appropriate.

Contact us

Call 1800 800 110 weekdays 8am to 8pm

Email [email protected]

If you have a complaint visit this page.

Indicates required field

Was this page useful?

Yes

Why?

It was easy to understand

The layout or style made it easy to read

The information was easy to find

Why not?

It was too hard to understand

I couldn’t find the information

The layout or style made it hard to read

The information wasn’t what I was looking for

Tell us more (optional)