Protect disclosers: keep identity confidential and prohibit victimisation
NDIS Provider Registration Rules Act ss 73ZBA and 73ZC, stated plainly and cited to the edition held, with the evidence an auditor or the regulator asks for, the common gaps, and a free worksheet to fill in.
NDIS Act ss 73ZBA and 73ZC
NDIS Quality and Safeguards Commission
NDIS (Provider Registration and Practice Standards) Rules 2018, Compilation No. 6 (F2026C00527), in force 1 July 2026, with NDIS Act 2013 Part 3A as in Compilation No. 27 (C2026C00401)
6 October 2026, Federal Register: latest version on 6 October 2026
Registered NDIS providers, every profession. Unregistered providers are not bound by these Rules.
The plan management changes made by the latest amending Act start on proclamation and are not in force. The provisions this product cites are in force.
Workers, contractors, participants, nominees, families, carers and advocates who report a suspected contravention of the NDIS Act to the Commissioner, the Agency or the provider's key personnel or partners on reasonable grounds are protected (s 73ZA). No one may disclose the discloser's identity or information likely to identify them except as s 73ZBA(2) authorises (Commissioner, Agency, police, legal advice, consent, serious threat to safety, courts, complaint handling) (civil penalty 30 penalty units), and no one may cause or threaten detriment because of a protected disclosure (s 73ZC; civil penalty up to 10,000 penalty units for a serious contravention by an NDIS provider, otherwise 500), with a right to compensation (s 73ZD).
- Whistleblower policy covering who is protected, recipients, confidentiality and anti-victimisation
- Restricted-access register of protected disclosures
- Training for key personnel who may receive disclosures
- Discloser identity shared with the manager being complained about
- Roster cuts or contract termination after a worker reports to the Commission
| Ref | Held (yes, partly, no, not applicable) | Where it is kept | Owner | Last reviewed | Next review |
|---|---|---|---|---|---|
| Act ss 73ZBA and 73ZC |
Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.
Related requirements
NDIS Provider Registration Rules
- Act ss 73Y and 73ZIncident management system and reportable incident notification
- Act s 73ZNA and s 73U(5A)Comply with banning orders and do not use banned people
- Act s 73WImplement and maintain a complaints management and resolution system
- Act ss 73Q and 73R and s 45BKeep prescribed records, including after registration ends
- Act s 73KApply for renewal within 6 months before registration expires
- Act ss 73F, 73G, 73H and 73JComply with every condition of registration
- Act ss 73C and 73DApply in the Commissioner's form and give no false or misleading information
- Act s 73B and Rules s 7Do not provide, or hold out as able to provide, a support that requires registration unless registered
- Every page of this instrument
The same topic in other instruments (registration, abuse and safeguarding)
- NDIS Practice Standards Core 7.1, Core 7.2, Core 7.3Core module: Freedom from abuse
- NDIS Code of Conduct s 6(1)(f)Prevent and respond to violence, exploitation, neglect and abuse
- NDIS Code of Conduct s 6(1)(g)Prevent and respond to sexual misconduct
- National Law s 75Non-practising registrants do not practise
- Common registration standards CH-1 to CH-6Criminal history registration standard
See every requirement for your practiceSee the specimen practice