Allied Health NDIS Audit Checklist: worksheet
Privacy Act: the Australian Privacy Principles and notifiable data breaches. Edition held: Privacy Act 1988 (Cth), Compilation No. 104 (C2026C00227), in force 4 June 2026, registered 17 June 2026 (Schedule 1, the Australian Privacy Principles; Part IIIC, notifiable data breaches); checked current on 6 October 2026 (Federal Register of Legislation Versions API: the latest and current compilation on 6 October 2026).
Under review, not in force: From 10 December 2026, APP 1.7 to 1.9 add automated-decision content to the privacy policy (Privacy and Other Legislation Amendment Act 2024, Schedule 1 items 87 and 88). Not in force yet.
Standards library: https://compliance.theartofservice.com/frameworks/australian-privacy-principles-apps. Page: https://allied-health-ndis-audit-checklist.theartofservice.com/rules/privacy-act/app-5-collection-notice/
| Ref | Requirement (our statement of the clause) | Evidence an auditor or the regulator asks for | Common gap to check | Held (yes, partly, no, not applicable) | Where it is kept | Owner | Last reviewed | Next review |
|---|---|---|---|---|---|---|---|---|
| APP 5.1 | At or before the time of collection, or as soon as practicable after, take reasonable steps to notify the person of the APP 5.2 matters or otherwise make them aware. Source: https://www.legislation.gov.au/C2004A03712/latest/text | The collection notice in the intake pack or online booking flow, with when it is given | Notice given only after the first session; No notice when information comes from a referrer | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 5.2(a), (b), (c) | The notice covers the practice's identity and contact details, the fact and circumstances of collection where information comes from someone else, and any Australian law that requires or authorises the collection. Source: https://www.legislation.gov.au/C2004A03712/latest/text | Collection notice text checked against 5.2(a) to (c) | NDIS or Medicare collection requirements not named where they apply | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 5.2(d), (e), (f) | The notice covers the purposes of collection, the main consequences if information is not collected, and the bodies or kinds of bodies the practice usually discloses to (for example referrers, other treating practitioners, plan managers, the NDIA or the NDIS Commission). Source: https://www.legislation.gov.au/C2004A03712/latest/text | Collection notice text checked against 5.2(d) to (f) | Usual disclosures (plan managers, NDIA reports) missing from the notice | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 5.2(g) to (j) | The notice says the privacy policy explains access, correction and complaints, and whether information is likely to go overseas and, where practicable, to which countries. Source: https://www.legislation.gov.au/C2004A03712/latest/text | Collection notice text checked against 5.2(g) to (j) | Overseas storage by practice software not mentioned | ☐ yes ☐ partly ☐ no ☐ n/a |
Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.