Allied Health NDIS Audit Checklist: worksheet
Privacy Act: the Australian Privacy Principles and notifiable data breaches. Edition held: Privacy Act 1988 (Cth), Compilation No. 104 (C2026C00227), in force 4 June 2026, registered 17 June 2026 (Schedule 1, the Australian Privacy Principles; Part IIIC, notifiable data breaches); checked current on 6 October 2026 (Federal Register of Legislation Versions API: the latest and current compilation on 6 October 2026).
Under review, not in force: From 10 December 2026, APP 1.7 to 1.9 add automated-decision content to the privacy policy (Privacy and Other Legislation Amendment Act 2024, Schedule 1 items 87 and 88). Not in force yet.
Standards library: https://compliance.theartofservice.com/frameworks/australian-privacy-principles-apps. Page: https://allied-health-ndis-audit-checklist.theartofservice.com/rules/privacy-act/app-6-use-and-disclosure/
| Ref | Requirement (our statement of the clause) | Evidence an auditor or the regulator asks for | Common gap to check | Held (yes, partly, no, not applicable) | Where it is kept | Owner | Last reviewed | Next review |
|---|---|---|---|---|---|---|---|---|
| APP 6.1 | Use or disclose personal information only for the primary purpose it was collected for, unless the person consents or an exception in APP 6.2 applies. Source: https://www.legislation.gov.au/C2004A03712/latest/text | A record of the purpose of collection and of each disclosure made, with its basis | Reports sent to third parties with no recorded basis | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 6.2(a)(i) | For health and other sensitive information, a secondary use or disclosure without consent needs a purpose directly related to the primary purpose that the person would reasonably expect, such as a report to the referring doctor or another treating practitioner in the client's care team. Source: https://www.legislation.gov.au/C2004A03712/latest/text | Client consent or a recorded reasonable-expectation basis for reports to referrers and care teams | Information shared with schools, employers or family without consent or a recorded basis | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 6.2(b) | A use or disclosure required or authorised by or under an Australian law is permitted, for example notifying the NDIS Commission of a reportable incident under the NDIS incident rules, or a mandatory notification under the National Law. Source: https://www.legislation.gov.au/C2004A03712/latest/text | A list of disclosures the practice makes under a law, each with the law named | Staff unsure which disclosures the law requires, delaying a notice | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 6.2(c), (d) | A use or disclosure is also permitted where a permitted general situation (s 16A, for example lessening a serious threat to life, health or safety) or a permitted health situation (s 16B) exists. Source: https://www.legislation.gov.au/C2004A03712/latest/text | A procedure for disclosures in a serious threat situation, with who decides and how it is recorded | No record kept of an urgent disclosure made to protect someone | ☐ yes ☐ partly ☐ no ☐ n/a | ||||
| APP 6.5 | Where information is used or disclosed because it is reasonably necessary for an enforcement related activity (APP 6.2(e)), make a written note of it. Source: https://www.legislation.gov.au/C2004A03712/latest/text | Written notes of any disclosure to an enforcement body | Police requests answered with no written note | ☐ yes ☐ partly ☐ no ☐ n/a |
Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.