Skip to Content
Policy & Procedure v.1.2 Ref: 01-POL-02 NDIS Registered Provider

Privacy & Confidentiality Policy

Complex Care & Support Services Pty Ltd ("the Company") is committed to protecting the privacy and confidentiality of our participants, employees, and stakeholders in accordance with the Privacy Act 1988 (Cth), the NDIS Act 2013, and the Queensland Information Privacy Act 2009.

Authorised By: Managing Director – Elaine Diphoorn • Date Approved: July 2026 • Review Date: July 2027
Policy Highlights

Core Commitments & Principles

Ensuring individual rights to privacy are respected while maintaining the high-quality data necessary for safe NDIS service delivery.

Confidential Information

Includes all personal information of participants and employees, locations, support schedules, NDIS plans, and internal business intelligence.

Specified Purpose

Data is collected and processed exclusively for the delivery of authorised NDIS supports and services defined in a participant’s Service Agreement.

13 Privacy Principles

Full adherence to the Australian Privacy Principles (APPs), requiring informed consent, limited collection, and strict boundaries on disclosures.

Permanent Protection

Non-disclosure duties are permanent and survive termination of employment. Records are securely retained for at least 7 years.

Table of Contents
Governance & Enquiries

For inquiries or to request records under this policy, contact management directly.

Phone: 1800 860 050

Email: info@complexcss.com.au

1.0 Overview & 2.0 Purpose

1.0 Overview

Complex Care & Support Services Pty Ltd ("the Company") is committed to protecting the privacy and confidentiality of our participants, employees, and stakeholders. This policy ensures that personal and sensitive information is handled in accordance with the Privacy Act 1988 (Cth), the NDIS Act 2013, and the Queensland Information Privacy Act 2009.

2.0 Purpose

To provide a framework for the collection, use, storage, and disclosure of personal and sensitive information, ensuring that individual rights to privacy are respected while maintaining the high-quality data necessary for safe NDIS service delivery.

3.0 Scope

This policy applies to all the Company’s employees, contractors, students, and volunteers. It covers all "personal information" and "sensitive information" handled by the organisation across all service locations and administration environments.

4.0 Definitions

Confidential Information Includes all personal information of participants and employees, their locations, support schedules, NDIS plans, and any of the Company’s business intelligence not in the public domain.
Specified Purpose The delivery of authorised NDIS supports and services as defined in a participant’s Service Agreement.
Sensitive Information Information about an individual's racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, or health/disability status.

5.0 Policy Standards (Australian Privacy Principles)

The Company adheres strictly to the thirteen (13) Australian Privacy Principles (APPs). Key standards include:

  • Collection: We only collect information necessary for the Specified Purpose. This includes health status, support goals, and NDIS plan details.
  • Consent: Informed consent must be obtained before collecting or sharing information. Participants have the right to withdraw consent at any time.
  • Use & Disclosure: Information is only used for its primary purpose. Disclosure to third parties requires explicit consent unless required by law to prevent a serious threat to safety.

6.0 Data Security & Retention

  • Storage: Digital records must be password-protected and encrypted. Hard copies must be stored in locked cabinets within secure facilities.
  • Access: Access to participant data is restricted to authorised personnel on a "need-to-know" basis.
  • Retention: Records must be maintained for at least seven (7) years after the last service. When no longer required, data must be securely destroyed or de-identified.

7.0 Notifiable Data Breaches (NDB)

In accordance with the Privacy Amendment (Notifiable Data Breaches) Act 2017, the Company will:

  1. Identify and contain any suspected data breach immediately.
  2. Assess the risk of "serious harm" to affected individuals.
  3. Notify affected individuals and the Office of the Australian Information Commissioner (OAIC) within 30 days if a breach is likely to result in serious harm.

8.0 Non-Disclosure & Confidentiality Framework

All of the Company’s personnel are bound by strict non-disclosure obligations regarding Confidential Information:

  • Prevention of Disclosure: Personnel must not share Confidential Information with any third party, firm, or company without express written consent from the Director.
  • Prohibition on Reproduction: Staff may not copy, memorise, or reproduce Client Information for any reason outside of their official duties.
  • Survival of Obligations: The duty of non-disclosure and the protection of Confidential Information is permanent. This duty survives the termination of employment or the conclusion of any service contract with the Company.
  • Return of Information: Upon termination of employment, all Confidential Information (including copies, notes, or digital files) must be returned to the Company or destroyed immediately.

9.0 Procedure

9.1 Onboarding

All new staff must sign the Privacy and Confidentiality Agreement (01-ACK-01) before accessing any participant data.

9.2 Reporting

Any suspected privacy breach or unauthorised disclosure must be reported to the Managing Director or Service Manager immediately as a Reportable Incident.

9.3 CCTV & Surveillance Systems (SIL & Service Environments)

The Company may operate CCTV and/or surveillance systems within and around Supported Independent Living (SIL) homes and other service environments, including internal common areas and external areas of the property, for the purposes of participant safety, staff safety, incident prevention, quality assurance, compliance, and the investigation of incidents, allegations, complaints, or reportable events.

All surveillance records, CCTV footage, and associated audio recordings are classified as highly sensitive Confidential Information. These records will be managed, securely stored, and disposed of in strict accordance with the Privacy Act 1988 (Cth), NDIS Privacy and Dignity obligations, and organisational data retention schedules. Access is strictly limited to authorised management personnel for safety, compliance, and investigative purposes, and remains the sole property of the Company.

Questions Regarding This Policy?

For further information on this policy and procedure, please contact our Managing Director or Service Manager.

Email Managing Director Call: 1800 860 050 Contact Us