NDIS privacy policy and data breach response templates
Privacy, information security, monitoring, data breach response, records retention and collection notices.
In short
The Privacy and Data Pack is 12 documents covering how an NDIS provider collects, stores, shares and destroys personal and health information: a privacy and dignity policy, a privacy consent form, collection notices for families, job applicants and website enquiries, information security and workplace monitoring policies, a data breach response plan and register, and a records retention schedule. It costs $490 + GST.
Who it is for
For every NDIS provider that holds participant health information. The data breach response plan follows the Notifiable Data Breaches scheme in the Privacy Act 1988.
Updated . Sources: Privacy Act 1988; Notifiable Data Breaches scheme (OAIC); NDIS Practice Standards (NDIS Commission).
Every document in the Privacy and Data Pack
12 documents from 4 folders, plus the Start Here folder. Your organisation's details are filled in before you download.
Showing 12 of 12 documents
| Code | Title | Type |
|---|---|---|
FRM-GEN-012 | Data Breach Assessment and Notification Record | Form |
FRM-GEN-017 | Family and Representative Privacy Collection Notice | Form |
FRM-GEN-022 | Job Applicant Privacy Collection Notice | Form |
FRM-GEN-039 | Website and Enquiry Privacy Collection Notice | Form |
FRM-PRIV-001 | Privacy Consent Form | Form |
PLN-GOV-002 | Data Breach Response Plan | Plan |
POL-GOV-005 | Information Management Policy | Policy |
POL-GOV-006 | Information Security and Access Control Policy | Policy |
POL-GOV-011 | Workplace Monitoring and ICT Acceptable Use Policy | Policy |
POL-RTS-010 | Privacy and Dignity Policy | Policy |
REG-AUD-005 | Data Breach Register | Register |
SCH-GOV-001 | Records Retention and Destruction Schedule | Schedule |
Sample pages
Filled in for a sample provider. Yours arrive with your own details.
POL-RTS-007Incident Management and Reporting Policy
From first response to NDIS Commission notice, with every timeframe sourced.
FRM-GEN-029Show Cause Letter
A procedurally fair letter, ready for your decision-maker to send.
PLN-GOV-002Data Breach Response Plan
Contain, assess and notify under the Notifiable Data Breaches scheme.
AGR-OPS-001NDIS Services Agreement
The participant agreement, with your schedule of supports and the cancellation terms you choose.
Questions about the Privacy and Data Pack
Does a small NDIS provider need a privacy policy?
Yes. The small business exemption does not apply to an organisation that provides a health service and holds health information (Privacy Act 1988 s 6D(4)(b)), and health-related activities in the course of caring for a person with a disability are a health service (s 6FB(3)(b)). Turnover does not change that.
What does the data breach response plan cover?
How to contain a breach, assess whether it is likely to cause serious harm, and notify the people affected and the OAIC when it is an eligible data breach, with a record and a register to show each step.