Rights to Consent & Privacy in NDIS (Practical Guide)

Consent basics: what must be asked and what can’t be assumed

In the NDIS, consent means you actively agree to supports, not just “being told” or “going along with it”. Staff and providers must ask you before anything changes, including changes to how supports are delivered, who is involved, or where and how personal information is used. Consent should be specific (for that support and that situation), informed (you understand what will happen), and ongoing (you can change your mind as needs change).

You must be asked for consent for things like: receiving services, sharing your information with other parties (for example, family members, health professionals, or other providers), taking photos or recordings, using telehealth/video, home visits by different staff, and any support that involves risk (manual handling, personal care, medication prompting). You also should not be assumed to consent just because you signed paperwork at the start. If something is unclear, or it’s a new worker, a new activity, or a different plan of support, ask again.

Some providers use templates, but templates don’t replace your choice. If you want to withdraw consent for part of a service, you can. Providers should explain what happens if you say no (for example, alternative supports or reduced service). If you use plan management, check how your provider bills and shares information. When you’re managing through MyMoney NDIS (www.planmanager.net.au), ask how invoices and service documentation are handled and who can view them.

Key takeaway: Always ask “What exactly is being done, who is involved, and what information will be used or shared?” If you’re not sure, you’re allowed to say “not yet” and get clear.

If you’re comparing providers, My Care Finders can help you look at how different organisations handle consent and privacy in real-world ways. Use that as a guide, then ask the same questions to your chosen provider: “How do you get my consent?”, “Do you reassess it if my needs change?”, and “How do you protect my information?”

• Do ask: “Can I choose who supports me?” “Will you record/store my info?” “What do you share and with whom?”
• Don’t assume: that written consent once covers every future support or every staff member.
• Do check: whether privacy practices include secure storage, limited access, and clear reasons for sharing.