The NDIS Practice Standards are the quality standards a registered provider gets audited against, and most first audits go reasonably well until the auditor reaches information management. That is the point where policies stop helping. The section asks what your systems actually do with participant information, and the auditor tests it against records rather than intentions.
This is a walk through that one section: what it asks, what the wording means in a small organisation, and what an auditor will accept as proof.
What are the NDIS Practice Standards?
The NDIS Practice Standards are the quality requirements that registered providers must meet, set out in the National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018, which are in force and administered by the Department of Health, Disability and Ageing. They are not guidance. An approved quality auditor assesses you against them, and your registration depends on the result.
The NDIS Quality and Safeguards Commission publishes them in three kinds of module. A core module applies to providers delivering higher-risk supports. Supplementary modules attach to particular supports, such as specialist behaviour support or supported independent living. A verification module applies to providers delivering lower-risk, lower-complexity supports, and it covers four areas only: human resource management, risk management, complaints management and resolution, and incident management.
Each module is built the same way. Outcomes are written from the participant’s point of view. Underneath each outcome sit quality indicators, which the Commission describes as what auditors use to assess compliance and how providers may show it. The indicators are the operative part. An auditor will not ask whether you agree with an outcome, or whether your intentions toward participants are sound, because neither of those is assessable and both are assumed; what they ask is which indicator you can evidence, and with which document.
What are the 4 NDIS Practice Standards in the core module?
The core module has four parts: rights and responsibility for participants, provider governance and operational management, provision of supports, and provision of supports environments. Information management sits inside the second one, alongside eight other outcome areas.
Those nine areas are governance and operational management, risk management, quality management, information management, feedback and complaints management, incident management, human resource management, continuity of supports, and emergency and disaster management. Information management is one ninth of one of four parts, which is roughly the attention it tends to get in preparation. It is not the share it gets in an audit, because it is the area where a small provider is least likely to have anything to show.
What the information management standard actually asks
The outcome is one sentence, and every word in it is a separate test. The Commission words it this way:
Management of each participant’s information ensures that it is identifiable, accurately recorded, current and confidential. Each participant’s information is easily accessible to the participant and appropriately utilised by relevant workers.
Underneath it sit four quality indicators. The table below gives each one in the Commission’s wording, from the core module on provider governance and operational management, with what the auditor is actually testing.
| # | Quality indicator | What is being tested |
|---|---|---|
| 1 | Each participant’s consent is obtained to collect, use and retain their information or to disclose their information (including assessments) to other parties, including details of the purpose of collection, use and disclosure. Each participant is informed in what circumstances the information could be disclosed, including that the information could be provided without their consent if required or authorised by law. | Whether consent was informed and specific, and whether the file shows what the participant was told. A signature on an intake form with no record of the conversation is thin. |
| 2 | Each participant is informed of how their information is stored and used, and when and how each participant can access or correct their information, and withdraw or amend their prior consent. | Whether a participant could actually exercise that right. If nobody can describe how a correction request would be handled, it has not been implemented. |
| 3 | An information management system is maintained that is relevant and proportionate to the size and scale of the organisation and records each participant’s information in an accurate and timely manner. | Whether there is a system rather than a habit. Timeliness is testable: the gap between a support being delivered and the note appearing. |
| 4 | Documents are stored with appropriate use, access, transfer, storage, security, retrieval, retention, destruction and disposal processes relevant and proportionate to the scope and complexity of supports delivered. | Nine named processes, each one separately assessable. Destruction and disposal are the two most often missing entirely. |
Read indicator 4 again and count. Use, access, transfer, storage, security, retrieval, retention, destruction, disposal. Most providers can speak to the first five. Retention and destruction usually turn out to mean that nothing has ever been deleted, which is a decision nobody made on purpose.
If you want a picture of where your technical controls sit before you map any of this, the free Essential Eight Maturity Level 1 assessment covers the access, security and backup side in about five minutes.
What “relevant and proportionate to the size and scale” really means
It means a four person provider is not held to the same system as a two hundred person one, and it is the most misread phrase in the standards. The wording appears ten times in the governance and operational management module alone. It is a genuine concession, and it is not a way out.
Proportionate describes the size of the system, not whether you need one. A small provider can meet indicator 3 with a single well-structured participant record in a system that controls who opens it, and a written note of who reviewed it and when. What a small provider cannot do is skip the indicator because it is small.
The practical test is whether you can explain the design. If you can say why access is arranged the way it is, why records are kept for the period you keep them, and what happens to a file when a participant leaves, then the system is proportionate and deliberate. If the answer is that it grew that way, the auditor is looking at a habit.
How to complete a self-assessment against the NDIS Practice Standards
The self-assessment is part of the registration application itself, submitted through the NDIS Commission Applications Portal, and it must include evidence supporting what you claim. You complete it against the standards that apply to your registration groups, before an auditor is engaged.
The Commission is unusually direct about buying this work in. Its guidance on applying for registration expects that you were substantially involved in preparing the application, that you can explain the content if asked, and that your responses are specific to your organisation and not a direct copy of purchased documents.
Then it says what happens when they are not. Consultants providing the same or very similar information to multiple providers may indicate a lack of understanding on the part of the organisation, may subvert the quality audit process, and increase the risk that the application contains false or misleading information. The Commission can refuse the application. It can also impose a condition requiring an entirely new certification audit, both stages, with a fresh self-assessment.
The stakes sit in legislation rather than policy. Providing false or misleading information in a registration application contravenes section 73D of the National Disability Insurance Scheme Act 2013, which carries a civil penalty, and is a criminal offence under section 137.1 of the Criminal Code Act 1995. An existing provider can have its registration suspended or revoked.
None of that makes outside help improper. It makes a purchased policy pack that nobody in the organisation can explain a liability rather than a shortcut. Buy the structure if it helps. Write the answers yourself.
How the standards get tested in an audit
Which audit you get depends on the risk of the supports you deliver, not on your size. The Commission runs a verification audit for lower risk and lower complexity supports, and a certification audit for higher risk ones, and it publishes the types of audits and when each applies.
A certification audit runs in two stages. Stage 1 is a desktop audit, usually off-site, where the auditor asks for information and evidence. Stage 2 is onsite, where they look at how the policies are actually implemented, which can include viewing records, interviewing staff and participants, and observation. Stage 2 should happen within three months of Stage 1 finishing.
Registration generally runs three years. Providers who did a certification audit also get a mid-term audit at the 18 month mark, so the gap between proving something and proving it again is shorter than most plans assume. The documents you assemble now get looked at twice.
Preparing the evidence rather than the policy is the part that takes time, and the systems and records an NDIS auditor asks for covers what to have ready.
Where the Privacy Act sits alongside this
The Practice Standards are an NDIS obligation and the Privacy Act is a separate one, and meeting the first does not discharge the second. Which parts of the Privacy Act apply depends on what your organisation does, not on your NDIS registration.
Where a provider is also a health service provider, and the OAIC defines that as providing services in relation to physical, emotional, psychological and mental health, the Privacy Act applies regardless of annual turnover. The three million dollar small business threshold does not help there. Therapeutic supports, personal care and allied health delivered under a plan will generally put an organisation in that category, and a provider delivering only transport or garden maintenance may sit outside it. It is worth establishing which you are rather than assuming.
If it applies, so does Australian Privacy Principle 11. The OAIC’s guidance on APP 11 requires reasonable steps to protect personal information from misuse, interference and loss, as well as unauthorised access, modification or disclosure, and states those steps include technical and organisational measures. Practice Standards indicator 4 and APP 11 are asking related questions from different directions. Work done once can answer both, which is the argument for treating this as one piece of work rather than two. The same holds for what happens when something goes wrong: the Notifiable Data Breaches scheme runs on its own clock, and it is not the 72 hours most people assume.
What to do this week
Take indicator 4 and write the nine words down the side of a page. Use, access, transfer, storage, security, retrieval, retention, destruction, disposal. Against each one, write what actually happens now rather than what the policy claims, and be unkind about the difference, because the blanks you are left with are your audit findings arriving early and in private.
Then deal with the two that come back blank for almost everyone. Decide how long participant records are kept, decide what happens to them at the end of that period, and write both decisions down with a date and a name against them. That page is evidence. It did not exist yesterday.
Ask one worker to describe how a participant would correct something in their own record. If the answer takes longer than a sentence, indicator 2 is not implemented, whatever the policy says.
Where the gap is structural rather than a missing document, mapping obligations to controls and producing evidence an auditor accepts is what our governance and risk work does. The technical half of indicator 4 is covered in the Essential 8 checklist for Maturity Level One, which is the same access and backup ground approached from the security side.
And if you would rather walk into that conversation with a number than a blank page, the free Essential Eight Maturity Level 1 assessment scores the controls sitting underneath indicator 4 and returns something you can hand to a board.
Last reviewed: 27 September 2026.
This article is general information about the NDIS Practice Standards and Australian privacy obligations. It is not legal advice. Confirm your own obligations with the NDIS Quality and Safeguards Commission, the OAIC, or your own adviser, before acting on it.