Privacy

Privacy explained

Privacy means things we know about you and what we do with what we know. There are laws to protect your personal information.

Personal information could be about:

• your name
• where you live
• your date of birth
• your health or disability information.

We’ll keep your information private and won’t tell people about it unless we have to. 

What information we keep

We keep personal information about different people. For example, people who use the NDIS, our staff and disability service providers.

The personal information we keep is your name, your bank account, information about your disability, what supports you get.

We won't tell anyone about your personal information.

How we get personal information

We get personal information from you or someone who helps you with the NDIS. For example, a carer, disability service providers, or other government departments.

You can give consent for other people to give us your information. Consent means you say yes.

You don't have to give us all your personal information. If you don't consent we might not give you an NDIS plan or supports you need.

We might ask you for your information by phone, by email, in person.

If you aren't sure the person you speak to is from the NDIS you can:

• ask them to say your NDIS reference number
• call the NDIS and ask for the person.

If you think you spoke to someone who isn't from the NDIS:

• don't tell them your personal information
• email [email protected]
• call 1800 800 110.

How we use personal information

We use personal information to help us give you services, manage the NDIS and contact you.

We might need to tell other people about you because they help with your NDIS plan or give you supports you need.

When you get an NDIS plan you consent for us to tell service providers about you.

How we keep personal information safe

We keep paper records safe in our offices. Our offices have secure access where you need a special pass to get in the building.

We keep information on our computers safe and we only tell people your information if the law says they can know.

About our website and social media

We might find out your personal information from our:

• website
• myplace or my NDIS portal or my NDIS app
• social media.

We get information about how people use our website. For example:

• what website pages people look at
• what documents people look at online
• what people search for online.

You can see the personal information we have about you on your participant portal or the my NDIS app. 

You can tell us if the personal information we have about you is wrong.

We can tell other service providers about changes to your personal information for you.

NDIA privacy policy

The NDIA privacy policy sets out in detail how we handle your personal information, including:

• when we collect information about you
• how we use your personal information
• who your personal information may be shared with
• your choices about the way that we use your information.

The NDIA privacy policy is relevant to individuals who interact with, or are considering interacting with, the NDIA or the NDIS.

Download the NDIA privacy policy :

• Privacy policy (PDF 296KB)
• Privacy policy (DOCX 350KB)

Download the NDIA privacy policy in easy read:

• Privacy policy (PDF 328KB)
• Privacy policy (DOCX 207KB)

Privacy collection notices

In addition to the privacy policy, we may provide a Privacy Collection Notice that contains important information about a specific collection of personal information, such as when you download the my NDIS app.

You can download our privacy collection notices in the participant and provider portals and in the my NDIS app.  

Protecting your personal information after a data breach

We take the protection of individuals’ data and information security extremely seriously. We have systems and processes in place to protect participants’ and other stakeholders’ information.

You can be a target of identity theft and fraud if your personal information is exposed in a data breach.

A data breach is when personal information is accessed, disclosed or used without authorisation. Identity theft and fraud can have serious implications. This can include financial loss and emotional harm.

Previous large data breaches

For information on specific large data breaches, you can visit:

• Optus cyberattack
• Medibank Private and AHM cyberattack .

How you can protect your personal information after a data breach

There are actions you can take to reduce the risk of harm if your personal information was accessed after a data breach. You can:

1. Stay alert to increased scam activity, particularly email and SMS or telephone phishing scams. These scams look like they come from an organisation you know but are fake.
2. Do not click on any suspicious links or provide your passwords or any personal information. Always refuse any unprompted request from an individual to access your computer even if they say they're from a credible organisation.
3. Change your online account passwords. Always use strong passwords. The Australian Cyber Security Centre has guides on good password practices.
4. Enable multi-factor authentication for your accounts where possible. This means using extra checks to prove your identity.
5. Install up-to-date anti-virus software on any devices you use to access your online accounts.
6. Monitor your bank account transactions and check your credit report to see if it has any unauthorised loans or applications.

Learn more about protecting your myGov, Centrelink, Medicare and Child Support accounts on the Services Australia website.

How the NDIA protects your personal information after a data breach

When a data breach happens, we take extra steps to protect your personal information and NDIS account.

These steps include:

• We'll try to identify if you're affected by the data breach so that we can take appropriate actions.
• If you're affected, we may contact you with information about protecting yourself and supports available to you.
• We actively monitor your accounts for irregular activity.
• If we identify unauthorised activity on your account, we’ll review it and take appropriate actions.
• We may take extra steps to verify your identity when you contact us. This is to make sure we are speaking with the right person.

How can I make a complaint about privacy at the NDIA?

To make a complaint, you can get in touch by:

• calling us on 1800 800 110
• emailing [email protected]
• submitting your complaint through our service hub
• visiting your local office in person.

Privacy Impact Assessment Register

The Privacy (Australian Government Agencies – Governance) Australian Privacy Principles Code 2017 (Cth) (the Code) requires the NDIA to conduct a Privacy Impact Assessment (PIA) for all projects that involve personal information.

This register lists PIAs completed since the Code came into effect on 1 July 2018.

Reference list

For further information, please email [email protected].

Last updated: September 2026

Video

Common questions about privacy

Learn about the answers to common questions about our privacy policy in this video.