MR25/02131 | FOI 25/26-0515 DOCUMENT 1
Your privacy and information
Quick summary: We have to collect information about you, when you deal with us. Your privacy is always important to us. We keep all your personal information safe, and only collect what we need. We need to follow federal laws about how we look at your personal information, how we use it, and give it to other people. This guideline explains how we collect, store, use and share information about you, including sharing information outside the National Disability Insurance Agency.
What’s on this page?
This page covers:
• What do we mean by privacy and information handling?
• Why do we ask you for information?
• What do we do with your information?
• Can you ask for the information we keep about you?
You might also be interested in:
• Nominees
• Child representatives
What do we mean by privacy and information handling?
When you deal with us, we need to collect certain information about you. This is so we know who you are and how we can help you.
If you’re an applicant or a participant, we also need to know how your disability affects you. We use this information to make sure you get the supports you need.
We take your privacy seriously. When we talk about privacy, we mean that we make sure we protect your personal information. We’re committed to keeping your information safe.
When we talk about your information, we mean the things (including facts or opinions) about you, or which could identify you, that:1
• you have told us
• others have told us about you (for example, your plan nominee)
28 October 2024 Your privacy and information Page 1 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 1 of 105
MR25/02131 | FOI 25/26-0515
• we have recorded about you, your plan, or your business with us.
The information we hold about you or someone else, is called personal information2 and is protected Agency information.3
We keep a record of our conversations with you. We keep copies of most documents or papers you give us.
Who do we hold information about?
When we say ‘you’, we mostly mean a participant or anyone applying to become a participant. But we also mean anyone we hold information about. For example, we might hold information about you if you’re:
• a family member, carer, nominee or child representative of a participant or applicant to the National Disability Insurance Scheme (NDIS)
• a service provider
• a person who works for us.
When we say ‘us’, ‘we’ or ‘our staff’, we mean:
• National Disability Insurance Agency (NDIA) staff
• National Contact Centre staff
• NDIA Board members
• NDIA contractors and organisations that do work for us
• local area coordinators
• early childhood partners.
How do we keep your information safe?
We store your information on our secure computer systems.
When we use email in our work, we’ll only use our NDIS email addresses. This includes when we send or receive your information.
We won’t look at the information we have about you, or tell anyone about it, unless we are required to. We can only give other people information about you under very special situations. Find out more about when we give your information to other people.
Learn more about privacy on the Office of the Australian Information Commissioner website.
28 October 2024 Your privacy and information Page 2 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 2 of 105
MR25/02131 | FOI 25/26-0515
How do we check your identity?
Checking your identity is one of the ways we protect your privacy.
We ask for evidence of identity documents and information the first time you contact us. We use these documents to complete identity confirmation. As part of this process, we will conduct a face-to-identity check to confirm you are the person on the identity documents.
We also ask for evidence of identity of your child representative or your nominee as well.
There may be times when we need to confirm the identity documents and information you give us. For example, we can confirm the details of your driver’s licence with the relevant state or territory authority.
Each time you visit us, or contact us by phone or online, we’ll ask you some questions to check we’re speaking to the right person. This is known as a security check or proof of record ownership. This is how we keep your information safe and private. We must not give your information to the wrong person, or someone pretending to be you.
If you change your legal name, we’ll ask you for evidence of your name change. We’ll need to confirm your identity for your new legal name. We’ll do this by asking for a linking document such as a Change of Name Certificate.
Why do we ask you for information?
If you’re a participant or applying to the NDIS, we’ll ask for evidence of identity and other information. This includes:
• your legal name, contact details, date of birth and age
• evidence of Australian citizenship or Australian residency status
• information and evidence about your health or disability
• the legal name, address and contact details of your guardian or nominee
• your Centrelink Customer Reference Number (CRN) if you consent to this
• bank account details, if you’d like to self-manage your NDIS funding
• details of any supports you get now.
We ask you, your child representative, nominee or authorised representative for this information. We need it to help us to:
• decide if you’re eligible for the National Disability Insurance Scheme (NDIS)
• check your identity
28 October 2024 Your privacy and information Page 3 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 3 of 105
MR25/02131 | FOI 25/26-0515
• create your plan
• decide what NDIS supports we should fund for you
• review your plan
• do other NDIS related business, such as report on the NDIS
• work on any feedback or complaints you make.
Sometimes we’ll need to ask your service providers or family for this information. Learn more about who we can ask for your information.
How will we ask you for your information?
When we ask you, or your nominee or your child representative, for your personal information, it could be:
• in person, for example in your planning meeting
• over the phone
• by post
• by email or other electronic communication, such as a video conference.
• in the Access Request Form when applying to become a participant of the NDIS
When we ask for your information, we’ll let you know:
• why we’re collecting it
• if we need to give it to another person or organisation
• what it will mean if you don’t give us the information
• how to make a complaint if you’re not happy with our service, and how we deal with complaints.
How much of your personal information will we need?
We only ask for the personal information we need to do our job. For example, if you’re a participant or applying to become one, we’ll only ask for the information we need.
This might be to check that you’re eligible for the NDIS, or to create, or review your plan.
When we’re checking your identity, we’ll record the type of document and keep a copy.
If you or someone else gives us information that isn’t relevant or needed, we might not record it.
This means if we don’t need a copy of a full document, we might:
28 October 2024 Your privacy and information Page 4 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 4 of 105
MR25/02131 | FOI 25/26-0515
• write down the information we need from a document
• copy the pages we need from a document
• blank out the parts of the document we don’t need when we copy it.
For example, we might ask for a report from your doctor about your support needs. If you give us a long report with other information we don’t need, we’ll just copy the pages about your support needs.
Do you have to give us the information we ask for?
Most of the time, you can choose how much information you want to give us. But if you don’t give us information we need, or let us get information about you from others, it might mean:
• we can’t decide if you can become a participant
• we can’t make other decisions, or it will take longer to make decisions
• we can’t approve your plan
• we can’t confirm your identity to support you
• we don’t have enough information to decide if the supports you need are NDIS supports.
• we can’t do NDIS related matters with you, if you are a provider or community partner, for example.
When do participants need to give us information?
If you’re a participant, or applying to the NDIS, sometimes the law says you must give us some types of information.
You must give us this information if we have reason to believe you have it, and we ask you to provide it.
The information we need includes:4
• how you are using your NDIS supports5
• if you’re using your NDIS funding in line with your plan6
• if you shouldn’t have received NDIS funding, because you or someone else gave us wrong or misleading information7
• if you get any other disability or early intervention supports outside the NDIS8
• if you get supports or funding through a statutory compensation scheme, or a care or support scheme.9 A statutory scheme is set up by government through legislation. For
28 October 2024 Your privacy and information Page 5 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 5 of 105
MR25/02131 | FOI 25/26-0515
example, there may be a statutory compensation scheme in your state or territory for workers’ compensation or transport accidents
• if you have changed your legal name.
If we ask for this information, we’ll write to you to let you know:10
• what information you need to give us11
• how you can give it to us12
• when you need to give it to us13 – we’ll tell you at least 14 days before.14
Sometimes another law may apply, which means you don’t have to give us the information we ask for.15
If you think this may be the case, you should let us know. Or you can ask a person who supports you, such as your support coordinator, or a family member. You can also ask a professional, such as a lawyer, if you’d like to. They’ll be able to tell you if you need to give us this information.
There are times you might need to give us information without us asking. This includes a change in your circumstances that might affect:
• your eligibility to the NDIS, or
• your plan.16
You’ll need to tell us as soon as the change has happened, or is likely to happen.17 You can tell us about these changes using the change in circumstances form. You can tell us on the NDIS website, by phone, or by visiting your local NDIA office.
You’ll also need to tell us as soon as you change your legal name. You can update your pronouns and information about your gender as well, if you’d like to. This is so we can give you a respectful and affirming experience.
You can tell us this information using the Update your name, pronouns, and information about your gender form. You can tell us on the NDIS website, by phone, or visit your local NDIA office. Learn more about Updating your name, pronouns and information about your gender.
What if you owe us money?
In rare situations, you might owe us money.
This happens if you’ve received or used funding you weren’t supposed to.18 For example, you might owe us money if:
• we accidentally paid you due to a mistake or a computer error19
28 October 2024 Your privacy and information Page 6 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 6 of 105
MR25/02131 | FOI 25/26-0515
• you used your NDIS funding incorrectly20. – learn more about using your plan
• you or someone else gave us wrong information, which means we shouldn’t have paid the funding.21
We may also be owed money if a payment is made after a participant dies.22 For example, payments to a bank account may have continued after the death of a participant, such as periodic transport payments or other funding. Or a service provider was not notified of the death in time to cancel service bookings and continued to claim payment. Learn more in what to do when someone dies on the NDIS website.
If you owe us money, you might need to:
• give us information about your financial situation, like a bank statement23
• tell us within 14 days if you move house or change your postal address.24
We might need someone else to give us information about your financial situation.25 We might also need them to give us information that could help us contact you. For example, if you changed your address or phone number.26
If we ask you for this information, we’ll write to you to let you know:27
• what information you need to give us28
• how you can give it to us29
• when you need to give it to us30 – we’ll tell you at least 14 days before31
• what could happen if you don’t give us the information.
We might also need to meet with you, your child representative or nominee to ask questions about your financial situation.32 If so, we’ll let you know in writing when and where you need to meet us. This will be at least 14 days after we write to you.33
It can be against the law not to give us this information if we ask,34 unless there is a certain reason not to give it to us.35 For example, you might have a reasonable excuse if this information might make you look guilty of a crime.36
The law says there are penalties if you don’t respond when we ask you for this information, unless a legal exception applies.37
What if you update your name, pronouns or information about your gender?
If you update your name, pronouns or information about your gender, you can let us know when you speak to us or you can use the Update your name, pronouns, and information about your gender form.
28 October 2024 Your privacy and information Page 7 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 7 of 105
MR25/02131 | FOI 25/26-0515
What if you update your legal name?
If you update your legal name, you will need to let us know. We’ll ask for evidence of your updated name. We’ll do this so that we can check you are who you say you are. We call this confirming your identity. We must confirm your identity for your new legal name, and we’ll ask you for a linking document.
What if you have a preferred name that is different from your legal name?
If you aren’t updating your legal name, you can still tell us your preferred name at any time. We need to know what name you use, so that we can be respectful by using your preferred name when we speak with you.
It is important to know there are times when we’ll still use your legal name. We’ll use your legal name when we: • confirm your identity
• complete a security check to make sure we are speaking with the right person.
We’ll do our best to make sure your preferred name is printed on your plan and any letters that we send you. If you’ve received a plan or letter using your legal name, please let our staff know so we can make sure this mistake doesn’t happen again.
What if you update information about your gender or pronouns?
We’ll update information about your gender or pronouns in our records if requested. We’ll make sure we treat you with respect and in a way that maintains your dignity. We’ll use your correct pronouns and gender when we speak with you. If you ask us to update your name, pronouns, or information about your gender, we must respond within 30 days.38
These updates will not impact your eligibility for the NDIS or your NDIS plan.
To learn more about updating your name, pronouns or information about your gender check out our Fact sheet - Updating your name, pronouns and information about your gender.
Do we need your consent to ask other people for your information?
We sometimes need to get your personal information from other people. For example, we might need to ask a healthcare service or residential care facility for your information.
We won’t do this without your agreement, unless one of a few exceptions applies. When you, your child representative or nominee agree we can ask other people for your information, we call this consent.
If you give us consent, this may help us create your new plan sooner. Or it could help us to make sure your plan includes the support you need.
28 October 2024 Your privacy and information Page 8 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 8 of 105
MR25/02131 | FOI 25/26-0515
How can you give us consent?
You, your child representative or nominee can tell us in writing, in person or over the phone that you consent. We can accept consent both written and verbal with the use of a translation service. If you tell us in person or on the phone, we’ll write it down to record your consent.
We have a consent form you can use to give us your consent, to share your information. But you don’t have to use the form as long as you provide the information we need.
If you give consent for us to ask other people for information, we’ll check:
• you understand what you’re agreeing to and why
• you know which people or organisations we’ll talk to or share your information with
• that no one is pressuring you to agree
• what information you consent for us to get from other people.
You can choose how long you give consent for us to ask other people for information. For example, you can choose to give consent for just one time only, or for any time we need to ask for information in the future.
You can also take away your consent at any time. You can let us know by post, email, in person, over the phone or web chat that you no longer consent.
When do other people need to give us information about participants by law?
The law says that sometimes other people must give us certain information about participants, or people applying to the NDIS, when we request it. If we do need to ask for certain information and the law applies,39 we don’t need your consent.
This means that other people will need to give us the information we need about you. This is if we ask for it and have good reason to believe they have the information.
If we ask someone else for this information about you, we’ll let them know in writing:40
• what information they need to give us41
• how they can give it to us42
• when they need to give it to us43 – we’ll tell them at least 14 days before.44
We may also ask the person to meet with us and answer questions about your information.45 We’ll write to them at least 14 days before46 to let them know when and where to meet us.
It can be against the law if they don’t give us the information we ask for. Unless they have a reasonable excuse not to give it to us.47 For example, they might have a reasonable excuse if this information might make them look guilty of a crime.
28 October 2024 Your privacy and information Page 9 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 9 of 105
MR25/02131 | FOI 25/26-0515
The law says there are penalties if they don’t respond when we ask them for this information.48
What information may other people need to give us about participants when required by law?
The information we might need from other people could include what they know about:49
• if you’re eligible for the NDIS, or you’re still eligible50
• if another person is allowed to make decisions for you51
• information to help us create or review your plan52
• how you’re using your NDIS supports53
• if you’re using your NDIS funding in line with your plan54
• if you get any other disability supports outside the NDIS55
• our statutory functions, including things that help us make decisions or do our job as a government Agency56
• if you get supports or funding through a statutory compensation scheme, or a care or support scheme.57 A statutory scheme is set up by government through legislation. For example, there may be a statutory compensation scheme in your state or territory for workers’ compensation or transport accidents.
What do we do with your information?
Once we have your information, we’ll record it in our system as soon as possible. This keeps your information secure.
We’ll make sure your information is accurate, up to date and complete. We’ll record information relevant to us or a decision we make.
We can only record, use or give your information to other people as part of our job. Either with your consent or if the law says that we can or must do so.
When do our staff use your information?
We use your information when we need it to do our job.58 This will help us connect you to the supports you need. We’ll only access your information if we need to.
For example, if you call us just to check your address is up to date, we’ll do a security check to make sure we’re talking to the right person, and then only look at your address. We won’t look at any other personal information.
28 October 2024 Your privacy and information Page 10 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 10 of 105
MR25/02131 | FOI 25/26-0515
We try to avoid staff working with you if they know you personally. This is because it might mean they have a conflict of interest.
Sometimes we can’t avoid conflicts of interest, for example if you live in a small town. If we can’t avoid it, we’ll make sure we work with you just like we work with everyone else.
Sometimes, we also collect and use information about you to help us:59
• research about the NDIS
• check how the NDIS is going, such as in our quarterly reports
• make NDIS policies.
This can help us understand how people use the NDIS, so we can continue to make it better for you and other participants. When we use your information for research and policy, we remove details that might identify you. We won’t include your name or anything that says who you are when we publish research externally.
We have a policy about what information we will share, and how we make decisions about releasing that information. Learn more about our Public Data Sharing Policy.
When do we give your information to other people?
Sometimes we have to give your information to other people. We only give out your information if there’s a good reason to, or you want us to, and the law allows us to. For example, to help you connect to the supports you need.
We take steps to keep your information secure, even after we give it to other people.
When we give out your information, we’ll keep a record of this. We’ll note what information we gave out, when we gave it out and why. We’ll also note who we gave your information to.
In very rare situations, we may use the services of an organisation overseas to store your information electronically. If so, we’ll let you know which country it may be stored in.
We may give your information to:
• your nominee, child representative, guardian, or other authorised representative
• other people when you ask us to
• other government agencies
• other people if it’s in the public interest to give this information when requested
• other people if there’s a threat to your or someone else’s health or safety.
Can we give your information to your nominee or child representative?
28 October 2024 Your privacy and information Page 11 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 11 of 105
MR25/02131 | FOI 25/26-0515
We can give your child representative or nominee any information we have about you.60 We do this so they can help you as a participant. A nominee is someone who makes decisions for you that relate to your support under the NDIS. Learn more about nominees and child representatives.
What if you want us to give your information to other people?
We can give your personal information to other people if you agree or ask us to.61 For example, you, your child representative or nominee might want us to give your information to a provider. We could discuss your needs with the provider to help us decide if your supports are reasonable and necessary.
When we give your information to other people, they need to follow the same rules as we do. They also can’t use or give out your information outside these rules.62
When you agree for us to share your information, we call this consent.
If you don’t consent for us to give your information to other people, we’ll only give out your information if it’s allowed or required under the law. This may happen for some of the reasons described below.
When might we give your information to other government bodies?
Sometimes we need to give your information to other government bodies. We only do this either with your consent or where this is allowed by law.63
For example, we might need to give your information to your state or territory government as part of the in-kind program.
If we do this, we’ll record what information we gave to the government body, and why.64
When do we share your information in the public interest?
Sometimes, we might need to give out your information to someone else if it’s in the public interest.65 This may happen if sharing your personal information would be for the common good.
Some of the reasons for this could be:
• to help enforce laws, or stop something that could waste government money66
• to give authorities information about a crime or threat against our staff, or about an incident at our offices67
• to correct a mistake that affects our reputation.68 For example, there might be a news story about your experience with us that isn’t true
• to let a government minister know about something69
28 October 2024 Your privacy and information Page 12 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 12 of 105
MR25/02131 | FOI 25/26-0515
• if you’re missing, or if you die 70
• if there’s an issue about child welfare.71
We only give out this information to people and agencies who have a genuine and legitimate interest in the information. This means the person or agency actually needs to know the information and needs it for a good reason.72
For example, a child protection agency may ask us for information about a participant who is a child, to make sure the child is being cared for properly. We would only give out the information the child protection agency needs for this purpose. We wouldn’t give out the other personal information we hold about that child.
We only give out your information in the public interest if the person can’t reasonably find the information from anyone else but us.73
What if there’s a threat to health or safety?
We may need to give out your information if there are reasonable grounds to believe there’s a risk to life, health or safety.74 This might be to your health and safety, or to someone else’s. We’ll only do this if, based on what we know, giving out your information could stop or reduce this threat.
For example, we might need to give your information to emergency services or other authorities. This might be if we find out:
• you, or someone else you’re involved with, may not be safe, or your life may be in danger
• you, or someone else you’re involved with, may be being harmed, abused or neglected
• you’re at risk of harm, abuse or neglect
• someone else is physically or emotionally threatening you
• you, or someone else you’re involved with, may be harming, abusing or neglecting others.
• you made a threat to someone else, including our staff.
What happens if we don’t follow these rules when we deal with your information?
We take your privacy seriously. All our staff are trained in managing your personal information and need to always follow these rules.
28 October 2024 Your privacy and information Page 13 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 13 of 105
MR25/02131 | FOI 25/26-0515
There can be serious consequences for people who don’t follow these rules when they handle protected Agency information. This includes when they:
• access your information75
• use your information, or give it to other people76
• offer to give your information to someone else.77
People who don’t follow the rules could lose their job. They could also get a large fine or go to prison for up to 2 years.
It might also be a criminal offence for other people to ask us for your personal information, when they’re not allowed to know.78
We also have policies for how we respond when we find out that someone’s privacy has been breached. For more information about privacy breaches and how we respond, check out our Privacy Policy.
What happens if there’s a notifiable data breach?
We also need to follow the Notifiable Data Breaches scheme. This means we have to follow certain steps if:79
• we lose your personal information, or someone uses your information when they’re not allowed to
• this is likely to cause serious harm to you, or someone else affected by it
• we couldn’t stop this harm.
If this happens, we’ll:
• make sure your information doesn’t get shared further
• investigate and work out what happened
• tell you, and anyone else affected by the breach
• report it to the Office of the Australian Information Commissioner.
Find out more about the Notifiable Data Breaches scheme on the Office of the Australian Information Commissioner website.
Can we remove or delete your information?
We keep your information so we can access it later if needed. This means we have all the information we need to assess your eligibility and create your plan. And you don’t need to repeat the same information.
28 October 2024 Your privacy and information Page 14 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 14 of 105
MR25/02131 | FOI 25/26-0515
The law says we can’t delete your information.80 For example, we can’t delete information from your application form to become a participant, even if you ask us to.
But you can always give us new information, for example to tell us one of your documents is wrong. Learn more about what happens if your information is wrong, outdated or incomplete.
We need to keep your information even if you leave the NDIS.
What if you need extra privacy protections (restricted access)?
Although we already have controls in place to protect your information, there are some situations where your records with us need more privacy protection than usual. We call this restricted access. It means only a limited number of staff with special permissions can access your information.
You, your representative, your nominee or a child representative can request restricted access at any time you engage with us. This could be pre-access or once you become a participant.
Who needs restricted access?
We can approve restricted access if one of these applies to you:
• you’re a prominent public figure, for example, a politician, judge, high profile sports person, media personality or actor
• you’re an immediate family member of a prominent public figure
• you’re an NDIA employee, NDIA contractor, NDIS National Contact Centre staff member, NDIA Board member, local area coordinator or early childhood partner
• you’re an immediate family member of an NDIA employee, contractor or other staff member, Board member, local area coordinator or early childhood partner
• you’re under police protection
• you’re under an active legal order, for example, your address is protected due to family violence.
When we say immediate family member, we mean a:
• husband or wife
• ex-husband or ex-wife
• de facto partner or former de facto partner
• child, parent, grandparent, grandchild or sibling
• child, parent, grandparent, grandchild or sibling of a spouse or de facto partner
28 October 2024 Your privacy and information Page 15 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 15 of 105
MR25/02131 | FOI 25/26-0515
• step-relatives, such as stepparents and stepchildren
• adopted immediate family member.
In very limited situations, you might still need restricted access even if none of the above applies to you. We’ll look at your situation when we decide whether to give you restricted access.
How do you get restricted access?
You can request restricted access at any time using our request for extra privacy protections (restricted access) form. Alternatively, you can contact us and ask for restricted access in person or over the phone.
We’ll write to you with our decision within 14 days of your request.
If we approve your request, you’ll have 2 restricted access officers. They’ll be responsible for most of your contact with us. They’ll also work with you on anything about your plan. There are also restricted access officers in our National Call Centre. They can assist if you call our contact centre. From time-to-time other people may need to access your records. This could be to arrange a payment or manage a complaint.
We’ll make sure they don’t have a conflict of interest working with you. For example, we make sure they don’t know you personally. We’ll write to tell you who your restricted access officers will be.
Having restricted access means that your providers can’t view your details or create service bookings. This means that you will need to create service bookings for your providers through the myplace portal. Then the provider will then be able to manage the booking. You will also need to tell your provider when you have restricted access.
Can we remove restricted access?
We’ll stop your restricted access if you ask us to. You can ask for restricted access to be removed at any time.
We may stop your restricted access if you no longer meet the criteria. For example, you might not be an NDIA employee anymore.
We’ll let you know if we’re going to end your restricted access. This gives you the opportunity to tell us if there are reasons why your restricted access should continue. We’ll consider this information when deciding whether to continue your restricted access.
After we remove restricted access, any of our staff can see your record if they need to for their work. We’ll still protect your privacy and information in the normal way.
Can you ask for a review of a restricted access decision?
28 October 2024 Your privacy and information Page 16 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 16 of 105
MR25/02131 | FOI 25/26-0515
No. Restricted access is not a reviewable decision. Learn more about what decisions you can review.
If you’re not happy with our decision, you can discuss it with us. You can also make a complaint.
Can you ask for the information we keep about you?
Yes. In most cases, you’ll be able to get any information we hold about you.
We recommend checking your myplace participant portal first. This will have the basic information we hold about you.
Learn more about the myplace participant portal.
If you can’t find the information you’re looking for in myplace, you can request it through our Participant Information Access process.
How can you get more of your information (Participant Information Access)?
Participant Information Access is a quick and easy way for you to get most of the information we hold about you, including:
• your application to the NDIS
• your current or previous NDIS plan
• medical and other documents that you’ve given us.
You, your nominee or child representative can use Participant Information Access to ask for your information. Some other people can make a request on your behalf. For example, someone who helped you apply for the NDIS, or someone you give consent to, can ask on your behalf.
If we can give you the information, we’ll do it as soon as possible. In most cases within 14 days, and we’ll always give it to you within 28 days.
There is no cost to make a request.
Read more about how to use Participant Information Access.
What information can’t we give you?
Sometimes we can’t give you all the information we hold about you. This might be because it contains personal information about other people, or giving it to you might put someone else at risk.
28 October 2024 Your privacy and information Page 17 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 17 of 105
MR25/02131 | FOI 25/26-0515
We’ll tell you the reasons why we can’t give you the information. We’ll also let you know if you can request it through Freedom of Information.
How do you make a Freedom of Information request?
You can also make a Freedom of Information request for information we hold, including your personal information.
If your request is for your personal information, you might like to make a request through Participant Information Access first. This is often quicker and easier than making a Freedom of Information request.
If your request is for other information, such as about our policies or processes, we’ll:
• try to give you access outside of the formal Freedom of Information process wherever we can
• help you make your Freedom of Information request, including to help narrow your request if it’s too large or vague
• keep in contact with you, especially if there’s any delay in making a decision
• process all requests as soon as we can
• clearly explain our decisions.
It’s a good idea to contact us first, to see if we can give you information directly. You may not need to make a Freedom of Information request.
Learn more about Freedom of Information.
What if your information is wrong, outdated or incomplete?
If you believe the information we hold about you is wrong, outdated, incomplete, irrelevant or misleading, you can contact us to correct it. If we don’t agree to change our records, we’ll write to you to tell you why.
You can also ask if we can let other organisations or government agencies know about any changes to your information.
What if you’re not happy with our response?
You can always give us feedback or make a complaint about the service we’ve given you. This includes if you think we haven’t followed these rules about your privacy and information. You can contact the Privacy team by email privacy@ndis.gov.au with any specific privacy concerns or complaints. Or for more information, check out feedback and complaints.
28 October 2024 Your privacy and information Page 18 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 18 of 105
MR25/02131 | FOI 25/26-0515
If you have questions about your request for information, you can contact our Participant Information Access team by email information.access@ndis.gov.au, or our Freedom of Information by email foi@ndis.gov.au.
If you’re not happy with how we’ve looked into your information, you can also make a complaint to the Office of the Australian Information Commissioner.
They’re separate to us and can investigate complaints about your privacy and information. It’s best to talk to us first before you contact them. This is because they might ask us to look into it further before they investigate the complaint.
Check out the Office of the Australian Information Commissioner website for more information.
28 October 2024 Your privacy and information Page 19 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 19 of 105
MR25/02131 | FOI 25/26-0515
Reference list
1 Privacy Act 1988 s 6. 2 Privacy Act 1988 s 6. 3 NDIS Act s 9. 4 NDIS Act s 53(1). 5 NDIS Act s 53(2)(a). 6 NDIS Act ss 53(2)(b), (d). 7 NDIS Act s 53(2)(c). 8 NDIS Act s 53(2)(e)(ii). 9 NDIS Act s 53(2)(e)(i). 10 NDIS Act s 54(1). 11 NDIS Act s 54(2)(a). 12 NDIS Act s 54(2)(b),(d). 13 NDIS Act s 54(2)(c). 14 NDIS Act s 54(3). 15 NDIS Act ss 58-59. 16 NDIS Act s 51(1). 17 NDIS Act s 51(2). 18 NDIS Act s 182(1). 19 NDIS Act s 182(2)(a). 20 NDIS Act s 182(2)(b)(i). 21 NDIS Act s 182(2)(b)(ii). 22 NDIS Act s 182(2)(c). 23 NDIS Act ss 186(a)-(b). 24 NDIS Act s 186(c). 25 NDIS Act s 187(b). 26 NDIS Act s 187(a). 27 NDIS Act s 188(1). 28 NDIS Act s 188(2)(a). 29 NDIS Act ss 188(2)(b), (d). 30 NDIS Act s 188(2)(c). 31 NDIS Act s 188(3). 32 NDIS Act s 188(4). 33 NDIS Act s 188(5). 34 NDIS Act s 189(1). 35 NDIS Act s 189(2). 36 NDIS Act s 189(3). 37 NDIS Act s 189. 38 Australian Government Guidelines on the Recognition of Sex and Gender s 23, cl 13.5(a)(i) of Schedule 1 to the Privacy Act 1988 (Cth) 39 NDIS Act s 55 (1) 40 NDIS Act s 56(1). 41 NDIS Act s 56(2)(a). 42 NDIS Act ss 56(2)(b),(d). 43 NDIS Act s 56(2)(c). 44 NDIS Act s 56(3). 45 NDIS Act s 56(4). 46 NDIS Act ss 56(1), 56(5) 47 NDIS Act s 57.
28 October 2024 Your privacy and information Page 20 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 20 of 105
MR25/02131 | FOI 25/26-0515
48 NDIS Act s 57(1). 49 NDIS Act s 55(1). 50 NDIS Act ss 55(2)(a)-(b). 51 NDIS Act s 55(2)(c). 52 NDIS Act s 55(2)(d). 53 NDIS Act ss 55(2)(e). 54 NDIS Act ss 55(2)(f)-(g). 55 NDIS Act s 55(2)(h)(ii). 56 NDIS Act ss 55(2)(k); 118. 57 NDIS Act s 55(2)(h)(i). 58 NDIS Act s 60(1). 59 NDIS Act s 60(3). 60 NDIS Act ss 66(3), 74(1). 61 NDIS Act s 60(2)(d)(iii). 62 NDIS Act ss 62, 42. 63 NDIS Act s 66. 64 NDIS (Protection and Disclosure of Information) Rules r 5.5. 65 NDIS Act s 66(1)(a). 66 NDIS (Protection and Disclosure of Information) Rules r 4.6(a). 67 NDIS (Protection and Disclosure of Information) Rules r 4.6(b). 68 NDIS (Protection and Disclosure of Information) Rules r 4.7. 69 NDIS (Protection and Disclosure of Information) Rules r 4.8. 70 NDIS (Protection and Disclosure of Information) Rules r 4.9. 71 NDIS (Protection and Disclosure of Information) Rules rr 4.10-4.11. 72 NDIS (Protection and Disclosure of Information) Rules rr 4.3(b), 4.4. 73 NDIS (Protection and Disclosure of Information) Rules r 4.3(a). 74 NDIS Act s 60(2)(e). 75 NDIS Act s 61. 76 NDIS Act s 62. 77 NDIS Act s 64 78 NDIS Act s 63. 79 Privacy Act 1988 (Cth) pt IIIC. 80 Archives Act 1983 (Cth) s 24.
28 October 2024 Your privacy and information Page 21 of 21
This document is correct at the date of publication.
Always visit ourguidelines.ndis.gov.au for the latest version.
Page 21 of 105