NDIS privacy policy generator
Most independent support workers need a privacy policy and do not have one. The Privacy Act small business exemption does not apply to an entity that provides a health service and holds health information, so turnover is usually beside the point. Enter your details below and download a Word policy written around the Australian Privacy Principles.
Output
DOCX
Or print to PDF
Structure
APP 1.4
A section per requirement
Your data
Stays here
Built in your browser
Cost
Free
No sign-up
Why turnover does not get you out of it
The small business exemption in the Privacy Act applies to businesses with an annual turnover of $3 million or less. It does not apply to an entity that provides a health service to another individual and holds health information other than in an employee record.
Personal care and support notes about someone's health usually put a support worker in that second category. Whether your particular work is a health service is a question for the OAIC or your own adviser, not for us.
What this is not
A starting draft, not legal advice and not a guarantee of compliance. The OAIC, the NDIA and the NDIS Commission have not approved it. Read every line and change anything that does not describe what you actually do. A policy that misdescribes your practice is worse than none.
Common questions
Do NDIS support workers need a privacy policy?
Usually yes. The small business exemption covers businesses turning over $3 million or less, but it does not apply to an entity that provides a health service to another individual and holds health information other than in an employee record. A support worker delivering personal care and keeping health-related notes generally falls outside the exemption whatever they earn. Australian Privacy Principle 1 then requires a clearly expressed and up-to-date privacy policy.
What must an Australian privacy policy contain?
APP 1.4 sets the minimum: the kinds of personal information you collect and hold, how you collect and hold it, why you collect it, how someone can access and correct it, how someone can complain and how you will handle that complaint, and whether you are likely to disclose information overseas and to which countries. The generator writes a section for each.
Is health information treated differently?
Yes. Health information is sensitive information under the Privacy Act and attracts higher protection. It generally cannot be collected without consent unless an exception applies, and holding it is the reason most support workers cannot rely on the small business exemption.
Where do I publish it?
APP 1.5 requires you to make it available free of charge and in an appropriate form. In practice that means on your website if you have one, and in another format on request. Give a copy to each participant when you start working together and note that you did.
Does Carevo check or approve my policy?
No. Carevo is a connection platform. It does not review, approve or endorse your privacy policy, and it does not provide legal advice. The document is yours and the obligations under the Privacy Act are yours.
Looking for more participants to support?
Carevo connects participants and families with providers and independent support workers who have capacity in their area. Your privacy obligations stay between you and the people you support.
See how matching worksFind support workers near you
Compare providers in areas with current provider supply.