A support worker leaves her phone on the 7:40 bus. The app is still logged in. On it are the home addresses of 12 participants, two behaviour support plans and a medication list.
What happens next depends almost entirely on your software. Can you sign her out remotely? Can you see whether anyone opened those records after 7:40? If the answer to either is “I’m not sure”, this article is for you.
Is NDIS software secure?
NDIS software is only as secure as its hosting, access controls, encryption, audit logs and backups. Before you trust a platform with participant data, ask where data is hosted, who can see what, whether multi-factor authentication and encryption are used, whether every view and edit is logged, how backups are restored, how breaches are handled, and whether you can export and delete your data.
This guide covers the laws that apply to NDIS data in Australia, the 8 questions to ask any vendor (with good and bad answers), and what to do if a breach happens.
What is NDIS software data security?
NDIS software data security is the set of controls that protect participant and worker information held in NDIS software from loss, misuse and unauthorised access. It covers where data is hosted, who can access it, how it’s encrypted, how activity is logged and backed up, and how breaches are handled.
NDIS data includes disability and health details, home addresses, behaviour support plans and bank details, which makes it some of the most sensitive information a small business can hold.
Which laws apply to NDIS data in Australia?
There isn’t a single “NDIS cyber security law”. Several rules overlap:
Rule | What it means for your data | Who it applies to |
|---|---|---|
Privacy Act 1988 and the Australian Privacy Principles | APP 11 requires reasonable steps to protect personal information and to destroy or de-identify it when no longer needed | Most NDIS providers. The $3 million small business exemption doesn’t apply to private sector health service providers, and many disability supports fall within that definition |
Notifiable Data Breaches scheme | Breaches likely to cause serious harm must be reported to the OAIC and affected people | Organisations covered by the Privacy Act |
NDIS Practice Standards (information management) | Participant information must be accurate, current, confidential and accessible to the participant | Registered NDIS providers |
Securing the NDIS Act | Records must be kept for 7 years, from 27 August 2026 | NDIS providers |
Cyber Security Act 2024 | Ransomware payments must be reported to the Australian Signals Directorate within 72 hours | Businesses with turnover above $3 million |
If you’re unsure whether the Privacy Act covers your business, get advice. Most providers find it does. More on what to keep, and for how long, in our guide to NDIS record keeping requirements.
8 NDIS software data security questions to ask
Use this as your NDIS software security checklist. Ask every vendor, including us, and get the answers in writing.
Question | A good answer | A red flag |
|---|---|---|
1. Where is the data hosted? | A named Australian region, including backups | “In the cloud” with no location |
2. Who can see what? | Role-based access, set by you | Everyone sees everything |
3. Is multi-factor authentication available? | Yes, and you can make it compulsory | “Coming soon” |
4. Is data encrypted? | In transit and at rest, stated plainly | “Our servers are secure” |
5. Is every view and edit logged? | A time-stamped audit trail per record | Only the latest version is kept |
6. How are backups restored? | A tested process and a stated recovery time | “We back up regularly” and nothing more |
7. What happens if there’s a breach? | A written plan, including how fast you’re told | No plan, or “it won’t happen” |
8. Can you export and delete your data? | Full export in a standard format, deletion on request | Export fees or partial exports |
1. Where is the data hosted, and does it ever leave Australia?
Ask for the hosting region by name, including where backups are kept. Australian hosting isn’t legally required for most providers, but it keeps you clear of the cross-border rules in APP 8 and it’s the simplest answer for participants and auditors.
2. Who can see what?
Good NDIS provider software uses role-based access controls. A finance officer needs claims, not behaviour support plans. When a worker leaves, their access should end the same day. Our guide to staff credential tracking covers offboarding checks.
3. Is multi-factor authentication available, and can you enforce it?
Multi-factor authentication (MFA) means a stolen password alone isn’t enough to log in. Ask whether you can make it compulsory for admin and coordinator accounts.
4. Is data encrypted in transit and at rest?
“In transit” means while data travels between a phone and the server. “At rest” means while it’s stored. You want both, stated in one plain sentence.
5. Is there an audit trail of who viewed or changed each record?
An audit trail does two jobs. It’s your evidence when NDIS auditors check who wrote a progress note and who edited it. It’s also how you investigate a breach. Without it, you can’t tell whether anyone opened those 12 records after 7:40.
6. How are backups done, and how fast can you restore?
Ask two plain questions: how much data could we lose, and how long until we’re working again? The Australian Signals Directorate’s Essential Eight lists regular, tested backups and multi-factor authentication among its core mitigation strategies. A vendor who knows the framework should be able to talk about it.
7. What happens if there’s a data breach?
Ask how quickly the vendor will tell you and what logs they’ll give you. Under the Notifiable Data Breaches scheme, the obligation to assess and notify stays with you, even if the breach happened on their side.
8. Can you export your data, and what gets deleted when you leave?
You should be able to take a full copy of your records in a standard format at no cost. Because NDIS records must be kept for 7 years, delete from an old system only once you hold a complete archive. See how to switch NDIS software.
What should you do if NDIS participant data is breached?
Contain it. Sign the user out, reset passwords, revoke access.
Assess it. Work out what was exposed and whether serious harm is likely. Under the scheme, you have 30 days to complete a reasonable assessment of a suspected breach.
Notify. If serious harm is likely, notify the affected people and the OAIC. The OAIC explains the process in its guide to the Notifiable Data Breaches scheme.
Review. Record what happened and what you changed. Your auditor may ask, and it belongs in your continuous improvement register.
The audit trail decides how fast steps 1 and 2 go. With one, you can see exactly which records were opened. Without one, you may have to treat every record as exposed.
Common NDIS data security mistakes providers make
Emailing participant lists as spreadsheet attachments.
Sharing one login between several workers, which makes the audit trail useless.
Keeping access live for workers who left months ago.
Storing signed service agreements and plans in a personal Google Drive.
Running rosters through group chats with participant names and addresses in them.
Most happen because the main system doesn’t make the safe option easy. A good NDIS app for support workers gives workers what they need on shift, so they don’t fall back on text messages.
How CareVisor protects NDIS participant data
Here’s what CareVisor can tell you today:
Australian hosting. CareVisor runs on AWS Sydney (ap-southeast-2). Participant, worker and billing data stays on Australian infrastructure.
Audit trail by default. Every action produces a time-stamped record, so you can see who did what, and when.
Verified e-signatures. Service agreements are signed through an authenticated account with email verification and a time stamp.
Your data, your exit. If you leave, we’ll export your data in a standard format at no cost.
For anything not listed here, ask us the same 8 questions and judge our answers the way you’d judge anyone else’s. See how it fits with the rest of our NDIS provider software.
Key takeaways
NDIS software data security covers hosting, access controls, MFA, encryption, audit trails, backups, breach response and data export.
Most NDIS providers are covered by the Privacy Act, even under $3 million turnover.
Breaches likely to cause serious harm must be reported to the OAIC and the people affected.
An audit trail is both your NDIS audit evidence and your breach investigation tool.
Ask every vendor the 8 questions, in writing, before you move participant data.
Frequently asked questions
How do I keep NDIS participant data safe?
Use software with Australian hosting, role-based access, multi-factor authentication and a full audit trail. Stop emailing participant data, give every worker their own login, and remove access the day someone leaves.
Can NDIS providers safely use cloud software?
Yes. Cloud software is usually safer than files on a laptop, as long as you know where it’s hosted, who can access it and how it’s backed up.
Does NDIS software need ISO 27001 certification?
No law requires it. ISO 27001 or a SOC 2 report is useful independent evidence of a vendor’s security practices, but it doesn’t replace the 8 questions. Ask for the certificate and its scope if a vendor claims one.
What are the legal requirements for NDIS data storage?
You must protect personal information under the Privacy Act, keep NDIS records for 7 years, and destroy or de-identify information once you no longer need it and the retention period has passed. Australian hosting isn’t mandatory for most providers, but it’s the simplest option.
How can I prevent NDIS invoice fraud?
Link every claim to a rostered shift, a clock-in record and a progress note, and keep an audit trail of edits. Fake or padded shifts are much harder to hide when each claim traces back to one record. Our NDIS claiming guide explains the checks.
Can small NDIS providers afford secure software?
Yes. Hosting, access controls and audit trails should be in the base product, not an add-on. CareVisor starts at $96 a month for up to 4 participants. See NDIS software pricing.
Ask us the 8 questions
It sounds like you want to trust your software with participant data but you’ve never been given a straight answer about where it lives or who can see it. That’s a fair thing to want. Send us the 8 questions through our contact page, or start a 7-day free trial and check the audit trail yourself.
About CareVisor
CareVisor is an Australian NDIS operating system for disability service providers. It brings participant management, rostering, SCHADS payroll calculations, progress notes, incident reporting, worker compliance and NDIS claiming into one platform, with a mobile app for support workers on iOS and Android. Pricing scales with participant numbers, every plan includes unlimited staff, and data is hosted in Australia on AWS Sydney. Compare platforms in our NDIS software comparison.
