The NDIS Code of Conduct is a set of eight rules that every NDIS provider, its key personnel and its workers must follow. It applies to registered and unregistered providers alike. It sits in section 6 of the NDIS (Code of Conduct) Rules 2018, and the NDIS Quality and Safeguards Commission enforces it. The Commission publishes a one-page summary, Know your obligations (PDF).
Most guides stop at what the Code asks of a support worker on shift. This one looks at another place it applies: what you publish about participants. That means the testimonial on your home page, the success story on your blog and the photo on your Facebook page.
On 19 October 2026 we read 856 pages on 208 NDIS provider websites in New South Wales. 48 of them published words from participants or their families. 22 put a name next to ‘NDIS participant’ or a diagnosis. Four said anywhere near the text that the person had agreed.
In brief
- The Code binds registered and unregistered providers, key personnel and workers. Its privacy rule covers your website and social media, not only the shift.
- A first name next to ‘NDIS participant’ tells strangers that a named person has a disability. Under the Privacy Act that is health information. That is our reading, and we explain it below.
- Health information is sensitive information. To publish it in your marketing, you need the person’s consent. The OAIC sets four tests for that consent.
- Reviews must be real and not edited to change their meaning (ACCC). Physios, OTs and psychologists cannot use reviews that praise clinical results (Ahpra).
- Since 9 April 2026 the Commissioner can issue anti-promotion orders. The rules that switch the power on had not been found when we checked on 19 October 2026.
What does the NDIS Code of Conduct say?
The Commission’s NDIS Code of Conduct page states that the Code requires people who deliver NDIS supports and services to:
- ‘Act with respect for individual rights to freedom of expression, self-determination, and decision-making in accordance with relevant laws and conventions.’
- ‘Respect the privacy of people with disability.’
- ‘Provide supports and services in a safe and competent manner with care and skill.’
- ‘Act with integrity, honesty, and transparency.’
- ‘Promptly take steps to raise and act on concerns about matters that might have an impact on the quality and safety of supports provided to people with disability.’
- ‘Take all reasonable steps to prevent and respond to all forms of violence against, exploitation, neglect, and abuse of people with disability.’
- ‘Take all reasonable steps to prevent and respond to sexual misconduct.’
- ‘Not charge or represent higher prices for the supply of goods for NDIS participants without a reasonable justification.’
Several guides in the search results still count seven elements. The eighth, fair pricing, sits in s 6(2) of the Rules. If you publish prices, our NDIS price guide for 2026-27 covers how to show them.
Who the NDIS Code of Conduct applies to, and what a breach costs
The Code applies to everyone who delivers supports under the National Disability Insurance Scheme. That means registered and unregistered providers, their key personnel and their workers. It also covers ILC (information, linkages and capacity building) providers and some Commonwealth Continuity of Support services.
NDIS providers and workers follow the same eight elements of the Code, and NDIS-funded supports of every kind are covered. For support workers, the Commission explains them in its worker guidance and in its free NDIS Worker Orientation Module. The Code is about behaviour on shift, but also about what a business says and shows in public.
A breach of the Code has a cost. The Commission says it can impose sanctions if workers, key personnel or providers breach the Code. Its fact sheet lists bans from working with people with disability, fines, infringement notices and other sanctions. Banning orders and cancelled registration are its most serious actions. Anyone can make a complaint to the NDIS Commission about a provider or worker, and the fact sheet gives the number: 1800 035 544.
What each element of the Code means for a story, photo or review
Four of the eight rules bear directly on what you publish about participants. The other four rarely touch a website.
| Rule of the Code | What it means for a testimonial, story or photo |
|---|---|
| 1. Rights to expression and decision-making | Participant rights come first. People have the right to make their own choices about whether their story is told, how and where. A family member’s wish does not replace theirs when they can decide. |
| 2. Privacy | Name, face, diagnosis and the fact of being a participant are all personal information. The Commission’s guidance gives ‘details about their health or disability’ as an example. |
| 4. Integrity, honesty and transparency | The story is real, unedited in meaning, and the photo is who you say it is. The fact sheet says you must not ‘make false or make misleading claims about services you can provide’. |
| 6. Prevent exploitation and abuse | Never ask a participant to act grateful for your marketing. Content that shames or exposes them is out, even with a signature. |
| 3, 5, 7, 8 | Rarely relevant to a testimonial. Rule 8 matters if your page shows prices. |
For privacy, the Commission’s guidance for providers gets specific. You should tell people what you collect about them, and it names ‘audio and visual material’. So photos and video are covered by the guidance itself.
Other rules a provider must comply with on the same page
The Code is not the only rule your testimonial page answers to. Three more sources reach the same paragraph.
NDIS Practice Standards. If you are registered and your audit uses the core module, privacy and dignity is on the list. One line an auditor checks is this. ‘Each participant understands and agrees to what personal information will be collected and why, including recorded material in audio and/or visual format.’ Another says each participant is told how to ‘withdraw or amend their prior consent’. Auditors read your website too, and our NDIS audit checklist covers section by section.
The Privacy Act 1988. Small businesses that turn over $3 million or less are often exempt. Not if the business ‘provides a health service to another individual and holds any health information’ (s 6D(4)(b)). The OAIC lists ‘a disability service provider (where they handle health information)’ among those covered.
The Commission’s own alert. In September 2026 the Commission put out a Provider Alert: Respectful conduct online. It says the Privacy Act applies when you collect, use or share health information online, not only on paper. And it says providers must ‘only share sensitive information when authorised’.
The alert also points to a recent case. The Commission banned the owner of Diversity Models and cancelled the business’s registration. Its investigation found bullying on social media, privacy breaches and a lack of choice and control for participants (media release, 29 May 2026).
How 208 NDIS provider websites write about participants
We checked how providers handle this in practice. The sample started as 229 NSW NDIS provider websites from Google Maps, collected in September 2026 across 12 search points. We removed an agency, consultants, directories and advocacy bodies, which left 221. 208 opened on 19 October 2026. For each site we read the home page and up to eight more. We picked pages that looked like reviews, stories, galleries, about pages or privacy policies, 856 pages in total.
Method and sample size
A Python script collected quoted passages, consent wording, review widgets and privacy policy text. It cannot tell a participant’s words from a slogan, so a person read every candidate passage. Each site went on one step of a ladder, by the most identifying thing it published. The evidence quote for each site is kept with the data, and we name no provider.
Step 0. No participant words at all: 160 sites. Some of these are quietly the safest pages in the sample. Others simply have not built a reviews section yet.
Step 1. Feedback with no name: 5 sites. ‘My daughter has been attending’ or ‘On behalf of my family’. Nobody outside the family can tell who wrote it.
Step 2. A name, but no disability detail: 21 sites. A first name, or a first name and initial, under general praise. Often the text says ‘my son’ or ‘our daughter’, which still points at a family.
Step 3. A name next to ‘NDIS participant’, supported living or a plan: 17 sites. The typical caption is a first name, a comma and ‘NDIS participant’. Some stories open with the person’s name and age.
Step 4. A name next to a diagnosis or condition: 5 sites. Anxiety, dementia, a mental health condition or gender dysphoria, attached to a first name. One case study page listed age, condition and goal for each person.
Beyond the ladder, the numbers that worried us most: only 4 of the 48 sites with participant words said near the text that names were changed or the people had agreed. Two sites ran reviews copied from a theme demo, naming Canadian cities or another business. And 28 sites embedded a Google reviews widget, which brings Ahpra rules into play for therapy practices.
Privacy policies were thin. 76 of the 208 sites linked a privacy policy from the pages we read. Four of those still carried the default WordPress text. Nine policies mentioned photos, video or testimonials at all.
What the check cannot see matters as much. Consent forms live in a provider’s files, not on its website. A missing note does not mean a missing signature, and we name no provider here. The ladder shows what a stranger can learn from the page, and that is what the Privacy Act cares about.
Why is ‘Jane, NDIS participant’ already health information?
Health information is anything said about a person’s health. The Privacy Act, in s 6FA, includes ‘the health, including an illness, disability or injury, (at any time) of an individual’. Sensitive information is a smaller group with stricter rules. Health information is part of it (s 6(1)).
Our reading is this. People join the NDIS because of a disability or, for young children, a developmental delay. So ‘NDIS participant’ under a name says something about that person’s health. Add a suburb, a face or a support type, and the person is easy to identify. At that point the caption is sensitive information, even though no diagnosis appears.
This is our interpretation as website builders, not a ruling by the OAIC or the Commission. It is still the cautious reading, and step 4 of the ladder needs no interpretation at all.
Consent comes in through two rules. APP 3.3 says a business ‘must not collect sensitive information about an individual unless’ a listed condition applies. The first is the person’s consent. APP 6.1 adds that information collected to deliver a service cannot be reused for marketing without consent or an exception. The OAIC’s page on taking photos of patients adds that a photo showing health information is sensitive too.
What makes consent hold up?
A signature on page nine of the service agreement is weak evidence. The OAIC’s APP Guidelines, Chapter B sets four elements of consent. In plain words:
- The person knows what they are agreeing to before they agree.
- They agree freely.
- The consent is current and covers this use.
- They can understand the choice and tell you their answer.
Each one turns into something your form has to do.
Informed. Show the exact text, photo and caption before publishing. Say where it goes: the website, Facebook, a printed brochure or a paid ad.
Voluntary. Support never depends on saying yes. Ask through someone other than the worker who delivers the person’s care.
Current and specific. The OAIC says consent ‘cannot be assumed to endure indefinitely’. Ask per channel and set a review date, such as once a year.
Capacity. The OAIC says age and ‘physical or mental disability’ can affect a person’s ability to consent. It also says to think about support that helps the person decide. That fits Code rule 1. Support the person to decide first. Use a nominee or guardian only when the law calls for it.
Children need their own line. The OAIC says that where case-by-case assessment is impractical, a person under 15 is presumed not to have capacity. For a child, the parent or guardian decides, and the child’s own view still counts.
Withdrawal has to be easy. The OAIC says a person ‘may withdraw their consent at any time, and this should be an easy and accessible process’. Put the contact for removal on the consent form. When someone withdraws, take the page down and replace the photo in any template that reuses it.
One naming trap catches families. The ‘NDIS consent form’ people search for is the NDIA’s form for sharing a participant’s information with the Agency. It has nothing to do with a photo or testimonial on your website. Keep your own marketing consent separate.
Which reviews can you show? ACCC and Ahpra
Reviews answer to two more regulators.
The ACCC applies to every provider. Its guidance on online reviews says it is against the law to ‘create fake or misleading reviews’. Reviews can mislead if they are ‘edited or changed by someone else after being created’. Businesses may also mislead if they ‘suppress or edit negative reviews’. The two theme demo reviews in our sample are the kind of text this rule targets: they name other businesses and Canadian cities.
The Code points the same way. The Commission’s guidance says misleading conduct can breach other laws as well, and it names the Australian Consumer Law.
Ahpra applies if you run a regulated health service. Physios, OTs and psychologists are all regulated by Ahpra. Its testimonial guidance says the National Law ‘does not allow the use of testimonials or purported testimonials to advertise regulated health services’.
A testimonial, in Ahpra’s sense, is praise for the clinical side of care: the symptom, the diagnosis or treatment, or the result. ‘Anxiety symptoms significantly decreased’ under a client’s name is exactly that. A comment about punctuality or friendly staff is not a testimonial and may be used.
The widget matters too. Ahpra asks whether you use the reviews to promote the service. A Google reviews feed on a therapy practice’s own site does exactly that. For social media pages, Ahpra suggests ‘disabling the reviews/testimonials functions’.
Photos: real, posed and stock
A photo can disclose more than any caption. The OAIC says images are personal information ‘where the person’s identity is clear or can reasonably be worked out from that image’. It adds that ‘it is good practice to seek their express consent’ before publishing on the web.
Each of these options suits a different job:
- Real participants, with consent per photo. The strongest proof that you are local and real. It costs a consent record and an annual review.
- Posed photos with staff or models. Shows what a support looks like without exposing anyone. Say so in a short line such as ‘Images are illustrative’. One provider in our sample did exactly that.
- Hands, backs and activity shots. A way through for group activities: the activity without the person’s face, school uniform or name.
Stock photos are allowed, but do not caption a stock image with a participant’s story. That pairs a real story with a face that is not theirs, and integrity rule 4 is about exactly that.
The website can carry part of the load. A testimonial block can hold a consent date and a review date, so nobody has to remember. Photo alt text can describe the activity without naming the participant. Our page on NDIS website design covers what else an auditor sees.
Anti-promotion orders: a new power before its rules
An anti-promotion order is a written order from the NDIS Commissioner that limits how a person may promote or advertise. The NDIS Amendment (Integrity and Safeguarding) Act 2026 added the power as s 73ZOA. It has been in force since 9 April 2026.
What counts as regulated promotional conduct is left to NDIS rules. Those rules may cover the marketing of supports and of NDIS providers. The Minister must first be satisfied that the conduct ‘undermines the objects of this Act’. Breaking an order carries a civil penalty of 250 penalty units (s 73ZOB).
When we searched on 19 October 2026, we found no rules prescribing that conduct. So the power exists and is waiting for its definition. The sensible move is to make your testimonial page defensible now, while it is your choice and not an order’s.
Before you publish: a 10-point check to comply with the Code
Run this list on every testimonial, story, photo and post that mentions a participant.
- The person agreed in writing to this exact text and image, with support if they wanted it, or a lawful representative did.
- The consent names each channel: website, social media, print, paid ads.
- The consent has a date and a review date no more than a year away.
- The person knows how to withdraw, and removal takes days, not months.
- The caption shows only what the story needs. No surname, suburb, age or diagnosis by default.
- ‘NDIS participant’ appears under a name only when the person chose that wording.
- The words are theirs. Edits for length keep the meaning, and the person saw the final version.
- For a therapy practice, the text says nothing about symptoms, diagnosis, treatment or outcome.
- Photos are of the person named, or marked as illustrative, and alt text names no participant.
- Your privacy policy says how you collect and use photos, video and testimonials.
3 rewrites, before and after
The examples are made up, built from patterns we saw in the check. Each pair keeps the warmth of the original and removes what the reader did not need.
A support coordination testimonial.
Before: ‘Thanks to Sam I finally understand my plan. Jane T., NDIS participant, Blacktown.’
After: ‘Thanks to Sam I finally understand my plan.’ Signed ‘Jane’, shared with her written consent for this website, reviewed March 2026.
A therapy practice review.
Before: ‘My son’s anxiety and meltdowns have nearly stopped since starting OT here. Sarah, mum of Liam, 7.’
After: ‘The team always explains what they are doing and calls back the same day.’ Signed ‘A parent’. The clinical result is gone, because Ahpra does not allow it in advertising.
A supported living photo caption.
Before: ‘Tom settling into his new SIL home in Penrith.’
After: ‘A Saturday cooking session in one of our homes.’ The photo shows hands and a bench, or a resident who chose to be pictured under a caption they approved.
Frequently asked questions
Does each state have its own NDIS Code of Conduct?
No. The NDIS Code of Conduct is one national rule made under the NDIS Act, and it applies the same way in every state and territory. What differs by state are other laws, such as state privacy and health records laws, which the Commission’s guidance says providers must also follow.
Does the Code of Conduct apply to unregistered NDIS providers?
Yes. The Commission says unregistered providers, their key people and their workers must follow it. The Practice Standards apply only to registered providers. The Code applies to everyone who delivers NDIS supports.
Is the NDIS consent form the same as consent for photos?
No. The NDIS consent form is the NDIA’s form for sharing a participant’s details with the Agency. Consent to publish a review or photo on your website is a separate choice. Record it on your own form.
Can I use first names only?
Often, yes. A first name under general praise is the low-risk end of the ladder. Add ‘NDIS participant’, a suburb or a diagnosis and the person becomes identifiable as someone with a disability. Get consent for that exact wording or leave it out.
What if a participant asks me to remove their story?
Remove it, quickly and everywhere you control: the page, social posts, cached copies in your site builder and any printed stock you can still change. The OAIC says withdrawal should be easy, and the Practice Standards expect participants to be able to withdraw consent.
Fixing the testimonial page you already have
You rarely need to delete your reviews. They need the captions trimmed, consent matched to each one and a privacy policy that mentions photos. Then the page proves you are real without exposing anyone.
Not sure about the stories on your current site? We can review those pages and rebuild the testimonial blocks with consent and review dates built in. We design websites for NDIS providers with this in mind.
Talk to us about fixing your current website
If you are still setting up, our guide on how to become a registered NDIS provider covers what has to be live on your site before an audit. For the accessibility side, see what the law requires on an NDIS website.
Web Ways Tech builds websites. This article is general information about the NDIS Code of Conduct and related rules as at 19 October 2026, written from a website builder’s view. It is not legal advice. Check the NDIS Commission, OAIC, ACCC and Ahpra for current guidance, and get legal advice for your own situation.
