Privacy

Privacy explained

Privacy means things we know about you and what we do with what we know. There are laws to protect your personal information.

Personal information could be about:

• your name
• where you live
• your date of birth
• your health or disability information.

We will keep your information private and will not tell people about it unless we have to.

What information we keep

We keep personal information about different people. For example people who use the NDIS, our staff and disability service providers.

The personal information we keep is your name, your bank account, information about your disability, what supports you get.

We will not tell anyone about your personal information.

How we get personal information

We get personal information from you or someone who helps you with the NDIS. For example a carer, disability service providers, or other government departments.

You can give consent for other people to give us your information. Consent means you say yes.

You do not have to give us all your personal information. If you do not consent we might not give you an NDIS plan or supports you need.

We might ask you for your information by phone, by email, in person.

If you are not sure the person you speak to is from the NDIS you can:

• ask them to say your NDIS reference number
• call the NDIS and ask for the person.

If you think you spoke to someone who is not from the NDIS:

• do not tell them your personal information
• email [email protected]
• call 1800 800 110.

How we use personal information

We use personal information to help us give you services, manage the NDIS, and contact you.

We might need to tell other people about you because they help with your NDIS plan or give you supports you need.

When you get an NDIS plan you consent for us to tell service providers about you.

How we keep personal information safe

We keep paper records safe in our offices. Our offices have secure access where you need a special pass to get in the building.

We keep information on our computers safe and we only tell people your information if the law says they can know.

About our website and social media

We might find out your personal information from our:

• website
• myplace or my NDIS portal or my NDIS app
• social media.

We get information about how people use our website. For example:

• what website pages people look at
• what documents people look at online
• what people search for online.

You can see the personal information we have about you on the myplace or my NDIS portal or app.

You can tell us if the personal information we have about you is wrong.

We can tell other service providers about changes to your personal information for you.

NDIA privacy policy

The National Disability Insurance Agency (NDIA) privacy policy sets out in detail how the NDIA handles your personal information, including:

• when we collect information about you
• how we use your personal information
• who your personal information may be shared with
• your choices about the way that we use your information.

The NDIA privacy policy is relevant to individuals who interact with, or are considering interacting with, the NDIA or the NDIS.

You can download the NDIA privacy policy below:

You can read the NDIA Privacy Policy in full below: 

• Privacy Policy (PDF 296KB)
• Privacy Policy (DOCX 350KB)

You can also view it in easy read.

• Privacy Policy Easy Read (PDF 328KB)
• Privacy Policy Easy Read (DOCX 207KB)

Privacy collection notices

In addition to the Privacy Policy, a Privacy Collection Notice may be provided by the NDIA that contains important information about a specific collection of personal information, such as when you download the my NDIS app.

Our Privacy Collection Notices are available here:

• participant portals and app
• provider portals

Protecting your personal information after a data breach

The NDIA takes the protection of individuals’ data and information security extremely seriously. We have systems and processes in place to protect participants’ and other stakeholders’ information.

You can be a target of identity theft and fraud if your personal information is exposed in a data breach.

A data breach is when personal information is accessed, disclosed or used without authorisation. Identity theft and fraud can have serious implications. This can include financial loss and emotional harm.

Previous large data breaches

For information on specific large data breaches, you can visit:

• Optus cyberattack
• Medibank Private and AHM cyberattack .

How you can protect your personal information after a data breach

There are actions you can take to reduce the risk of harm if your personal information was accessed after a data breach. You can:

1. Stay alert to increased scam activity, particularly email and SMS or telephone phishing scams. These scams look like they come from an organisation you know but are fake.
2. Do not click on any suspicious links or provide your passwords or any personal information. Always refuse any unprompted request from an individual to access your computer even if they say they are from a credible organisation.
3. Change your online account passwords. Always use strong passwords. The Australian Cyber Security Centre has guides on good password practices.
4. Enable multi-factor authentication for your accounts where possible. This means using extra checks to prove your identity.
5. Install up-to-date anti-virus software on any devices you use to access your online accounts.
6. Monitor your bank account transactions and check your credit report to see if it has any unauthorised loans or applications.

For information on protecting your myGov, Centrelink, Medicare and Child Support accounts, visit the Services Australia website.

How the NDIA protects your personal information after a data breach

When a data breach happens, we take extra steps to protect your personal information and NDIS account.

These steps include:

• We will try to identify if you are affected by the data breach so that we can take appropriate actions.
• If you are affected, we may contact you with information about protecting yourself and supports available to you.
• We actively monitor your accounts for irregular activity.
• If we identify unauthorised activity on your account, we’ll review it and take appropriate actions.
• We may take extra steps to verify your identity when you contact us. This is to make sure we are speaking with the right person.

How can I make a complaint about privacy at the NDIA?

To make a complaint, you can get in touch by:

• calling us on 1800 800 110
• emailing [email protected]
• submitting your complaint through our service hub
• visiting your local office in person.

Privacy Impact Assessment Register

The Privacy (Australian Government Agencies – Governance) Australian Privacy Principles Code 2017 (Cth) (the Code) requires the NDIA to conduct a Privacy Impact Assessment (PIA) for all projects that involve personal information.

This Register lists PIAs completed since the Code came into effect on 1 July 2018.

Reference list

For further information, please email [email protected].

Last updated: April 2026

Common questions about privacy 

Learn about the answers to common questions about our privacy policy in this video.