TL;DR:
- All NDIS providers and workers must comply with the Code of Conduct, which emphasizes respecting participant rights and ensuring safe, competent support. Breaches can lead to enforcement actions ranging from education to civil penalties or bans, with a six-year window for enforcement. Embedding the Code into daily practice through training, supervision, and documentation is essential for ongoing compliance.
Every NDIS provider and worker must meet the Code of Conduct obligations set by the NDIS Quality and Safeguards Commission: act with respect for participant rights, deliver safe and competent supports, and raise concerns promptly. Three actions to take now:
- Confirm every worker has completed the worker orientation module (mandatory for registered providers).
- Check that supervision records are current and reflect competency assessments.
- Verify your complaints and incident management process is documented and accessible to participants.
What is the NDIS Code of Conduct and why does it carry legal weight?
The NDIS Code of Conduct is made under section 73V of the National Disability Insurance Scheme Act 2013 and given effect through the National Disability Insurance Scheme (Code of Conduct) Rules 2018. It sits within the NDIS Quality and Safeguarding Framework alongside the NDIS Practice Standards, and it applies regardless of whether a provider is registered.
Compliance is a civil penalty provision, a regulatory aspect well outlined in resources like Healthcare Startup Regulatory Basics Explained for Founders. A contravention carries a maximum penalty of 250 penalty units. The NDIS Commission's Code page and the provider guidance PDF are the primary references for day-to-day interpretation.
Who must follow the Code?
The Code applies broadly. Both registered and unregistered NDIS providers, their key personnel, and all workers employed or otherwise engaged by them are captured. "Workers" includes support workers, allied health practitioners, administrative staff, and volunteers. It also covers contractors and agency staff delivering supports on a provider's behalf.
The Code applies to providers delivering ILC activities and Commonwealth Continuity of Support services for people over the age of 65 — its reach extends well beyond core funded supports.
Workers who hold professional registration (nurses, psychologists, social workers) must comply with both their professional code and the NDIS Code. Where a breach overlaps with a professional regulatory obligation, the Commission may work with the relevant professional body. Privacy law and anti-discrimination legislation also run alongside the Code; compliance with one does not substitute for the other.
What each element of the Code requires in practice
The Code consists of eight elements that apply to all providers, key personnel, and workers. Here is what each requires and what it looks like on the ground.
-
Respect individual rights to freedom of expression, self-determination and decision-making. Participants choose who supports them and how. A worker who overrides a participant's preference about daily routines without documented clinical justification is non-compliant, even when well-intentioned.
-
Respect the privacy of people with disability. Privacy extends beyond handling personal information carefully. Discussing a participant's health details in a shared space, or sharing information with family members without consent, breaches this element. Workers must follow both Commonwealth and state/territory privacy laws and their provider's privacy policy.
-
Provide supports and services in a safe and competent manner, with care and skill. Competence means holding and maintaining the expertise the role requires, keeping accurate records, and following safe work procedures. Record keeping supports continuity of support and is a factor the Commission considers in compliance assessments.
-
Act with integrity, honesty and transparency. Workers must not mislead participants, withhold information that affects decision-making, or accept inducements. Undisclosed conflicts of interest sit squarely here.
-
Promptly raise and act on concerns about quality and safety. A worker who observes a colleague behaving unsafely and says nothing has breached the Code, not just failed a professional norm.
-
Prevent and respond to all forms of violence, exploitation, neglect and abuse. This is an active obligation. Providers must have documented processes; workers must know them and use them.
-
Prevent and respond to sexual misconduct. Any sexual contact with a participant is prohibited. Providers must make this expectation explicit in induction and policy.
-
Not engage in unfair pricing when supplying goods to participants. Providers cannot charge participants more than they charge non-participants for the same goods without reasonable justification.
Anonymised practice example: A medium-sized community services provider discovered during an internal audit that three support workers had been sharing participant progress notes via a personal messaging app. The notes included health and behavioural information. The provider immediately suspended the practice, retrained the workers, updated its privacy policy, and reported the incident to the Commission. The Commission's response focused on the provider's remediation steps rather than punitive action, consistent with its proportionate approach.
How breaches are handled and what sanctions can follow
The Commission's approach moves from education through to enforcement depending on severity and pattern. The pathway typically runs: complaint or notification received, assessment, investigation, then one or more outcomes.
| Outcome | When applied | Notes |
|---|---|---|
| Education and guidance | Minor, first-time, or inadvertent breach | No formal penalty; provider expected to remediate |
| Enforceable undertaking | Systemic issue where provider commits to change | Legally binding; breach of undertaking escalates |
| Civil penalty order | Serious or repeated breach | Court-ordered; maximum 250 penalty units per contravention |
| Banning order | Person poses ongoing risk to participants | Can restrict or prohibit work with people with disability |
The Commissioner has a six-year window from an alleged contravention to apply for a civil penalty order. That long enforcement window makes durable, auditable record keeping non-optional.
Banning orders can apply to providers, key personnel, and individual workers. They persist beyond employment with a specific provider and can be general or limited in scope. The Commissioner must give the person an opportunity to make submissions before issuing an order, except where specific grounds apply.
Practical steps to meet your Code obligations
Embedding the Code operationally, not just in policy documents, is what the Commission looks for. The provider guidance is explicit: providers are expected to support workers to meet obligations, not merely enforce them through paperwork.
- Induction and training: Include the Code in every worker's induction. Registered providers must ensure workers complete the worker orientation module. Record completion dates and keep them accessible for audit.
- HR processes: Embed Code expectations in position descriptions, performance reviews, and disciplinary procedures. Reference the Code explicitly, not generically.
- Supervision: Conduct regular, documented supervision that includes competency checks. Supervision logs are audit evidence; keep them for at least the six-year civil penalty window.
- Incident and complaints management: Operate a documented complaints process that participants can access without fear of retaliation. Providers must foster an environment where complaints can be raised safely.
- Conflict of interest: Require written declarations. Where a conflict exists, offer participants an alternative provider or worker and document the outcome.
- Policy folder headings to maintain: Complaints management, incident reporting, conflict of interest, privacy, worker competency and supervision, and Code of Conduct acknowledgement.
When Code obligations conflict with an organisational policy, the Code takes precedence. Workers should raise the conflict with their supervisor; providers should review the policy immediately.
For guidance on NDIS policy and procedure development, the approach matters as much as the document itself.
Governance checklist for boards and CEOs
Boards carry accountability for the culture the Code requires. A compact assurance checklist:
- Governance ownership: Assign a named executive responsible for Code compliance reporting to the board.
- Risk-based evidence: Review compliance evidence at least annually, not just at audit time. Look for training completion rates, incident closure times, and conflict of interest declarations logged.
- Workforce competence: Confirm that recruitment processes include banning-order checks via the Commission's worker screening system. Banning orders persist after employment ends; due diligence must cover contractors and agency staff.
- Incident reporting oversight: Board receives a regular summary of incident types, volumes, and closure status. Patterns matter more than individual events.
- Record retention: Confirm records are retained for at least six years and that security procedures are documented and followed.
Anonymised governance example: A disability services board received its first Code compliance report and found a significant portion of workers had no recorded supervision in the prior quarter. The CEO commissioned a supervision audit, introduced a monthly completion dashboard, and reported remediation progress to the board at each subsequent meeting. Within a few months, recorded supervision coverage substantially improved. The board's early visibility of the gap was the critical factor.
Suggested assurance metrics: percentage of workforce with orientation module complete, average incident closure time in days, and number of conflict of interest declarations logged per quarter.
For a fuller treatment of board responsibilities, the NDIS registered provider governance guide covers the structural requirements in detail.
Where to find official guidance, training and templates
- NDIS Commission Code of Conduct page: The primary reference for both providers and workers. Includes links to the worker orientation module and the Code Rules.
- Code of Conduct Provider Guidance PDF: Detailed guidance on each element, with scenarios, templates and reporting forms. Updated October 2024.
- Worker orientation module: Mandatory for staff of registered providers. Hosted on the Commission's website and covers each Code element with practical scenarios.
- NDIS Workforce Capability Framework: Supports providers in mapping worker competencies to Code obligations and structuring ongoing training.
Key takeaways
The NDIS Code of Conduct obligations require providers and workers to embed eight conduct elements into daily practice, with governance, training, and record keeping that can withstand a six-year enforcement window.
| Point | Details |
|---|---|
| Eight conduct elements | The Code covers rights, privacy, competence, integrity, raising concerns, abuse prevention, sexual misconduct, and fair pricing. |
| Civil penalty exposure | A contravention carries a maximum of 250 penalty units; the Commission has six years to apply for a penalty order. |
| Banning orders persist | Orders can outlast employment and apply to key personnel and contractors — include checks in every recruitment process. |
| Culture over documents | Training records, supervision logs, and incident data are the evidence the Commission looks for, not policy headings alone. |
| The Planning and Practice Hub | Supports boards and executives to build compliance frameworks, governance structures, and workforce systems that meet Commission expectations. |
The gap between policy and practice
Most providers I work with have a Code of Conduct policy. Fewer have the operational infrastructure to back it up. The Commission is not looking for a well-formatted document; it is looking for evidence that the Code is alive in your organisation's day-to-day decisions.
The single most useful thing a CEO can do is make it genuinely safe for workers and participants to raise concerns. Not just in writing. In practice. That means a supervisor who responds without defensiveness, a complaints process that is visible and accessible, and a board that treats incident data as intelligence rather than liability. When that culture is present, the documents follow naturally. When it is absent, no policy folder will protect you.
The governance checklist in this article is a starting point, not a destination. The question worth asking at your next board meeting: "How do we know our workers feel safe raising concerns?"
How The Planning and Practice Hub can help
The Planning and Practice Hub works with NDIS providers, boards, and executive teams to build compliance frameworks that hold up under scrutiny, not just on paper.
Rachel Willis and the team bring close to three decades of human services experience to governance reviews, Code compliance gap analyses, policy development, and board advisory. Whether you need a full compliance audit or targeted support for a specific gap, the work is grounded in what the Commission actually looks for.
To discuss your organisation's needs, visit the human services consulting page or review the full services overview.
Useful sources
- NDIS Code of Conduct — NDIS Commission: Primary reference page for the Code, worker orientation module, and Workforce Capability Framework links.
- Code of Conduct Provider Guidance PDF (October 2024): Detailed element-by-element guidance with scenarios, templates, and reporting forms for providers.
- National Disability Insurance Scheme (Code of Conduct) Rules 2018: The legislative instrument establishing the Code and its civil penalty status.
- NDIS Act — section 73V (civil penalties): Sets the 250 penalty unit maximum for Code contraventions.
- NDIS Act — section 73ZN (banning orders): Full legislative text on banning order powers, scope, and process.
- Civil Penalties Policy (NDIS Commission): Sets out the Commission's approach to civil penalty applications, including the six-year enforcement window.
- NDIS provider responsibilities — conflict of interest: Guidance on declaring and managing conflicts, including offering participants alternatives.
FAQ
What are the eight elements of the NDIS Code of Conduct?
The Code requires providers and workers to: respect individual rights and decision-making; respect privacy; deliver safe and competent supports; act with integrity, honesty and transparency; promptly raise concerns; prevent and respond to violence, exploitation, neglect and abuse; prevent and respond to sexual misconduct; and not engage in unfair pricing for goods supplied to participants.
Who does the NDIS Code of Conduct apply to?
The Code applies to all NDIS providers (registered and unregistered), their key personnel, and all workers employed or otherwise engaged by them, including contractors, volunteers, and agency staff delivering NDIS supports.
What are your obligations as a disability support worker under the Code?
Workers must follow all eight Code elements in their day-to-day practice, complete the worker orientation module if employed by a registered provider, raise concerns promptly, and comply with their provider's policies on privacy, incidents, and complaints.
What happens if you breach the NDIS Code of Conduct?
The Commission may respond with education, an enforceable undertaking, a civil penalty order (up to 250 penalty units), or a banning order restricting or prohibiting work with people with disability. The Commission has six years from an alleged contravention to apply for a civil penalty order.