NDIS Code of Conduct explained: the seven obligations in practice

The NDIS Code of Conduct is a set of seven legally binding obligations in section 6 of the National Disability Insurance Scheme (Code of Conduct) Rules 2018. It binds every NDIS provider and everyone they employ or engage, registered or not, and covers rights, privacy, safe and competent supports, integrity, raising concerns, preventing violence, abuse, neglect and exploitation, and preventing sexual misconduct. Breaches can lead to Commission action, including banning orders and civil penalties.

This is general information current at September 2026; confirm your position with the NDIS Quality and Safeguards Commission and, for state-based duties such as mandatory reporting, your state or territory authority.

Who the Code applies to

Section 73V of the NDIS Act 2013 lets the NDIS rules set a code of conduct for NDIS providers and for people employed or otherwise engaged by them, including key personnel; section 5 of the Rules makes both groups "Code-covered persons" who must comply.

Under the Act, an NDIS provider includes anyone who receives NDIS amounts other than as a participant. Registered providers, unregistered providers and sole traders paid from plan-managed or self-managed funding are all covered, with their employees, contractors and volunteers. Registration changes what else you must do, not whether the Code applies.

The seven obligations

Quotes are from section 6(1) of the Rules.

1. Respect for rights and decision-making

"act with respect for individual rights to freedom of expression, self-determination and decision-making in accordance with applicable laws and conventions"

The participant directs their own life. Give information they can understand, allow time, and support the decision they make, even one you would not make. A breach looks like choosing a participant's meals or visitors for convenience, or asking a family member instead of the person using a communication device. Good practice is offering options, recording how a decision was supported, and involving a guardian for decisions their appointment covers.

2. Privacy

"respect the privacy of people with disability"

Collect only what you need, store it securely and share it only with consent or where the law requires it, such as a reportable incident. A breach looks like discussing one participant's diagnosis in front of another, or posting shift photos on social media without consent. Good practice is a privacy conversation at intake, locked storage or password-protected devices, and checking who is entitled to information before answering relatives' questions.

3. Safe and competent supports

"provide supports and services in a safe and competent manner, with care and skill"

Work within your training and competence, and decline tasks you are not equipped for. A breach looks like assisting with medication, PEG feeding or a hoist transfer without training, or skipping a manual handling plan to save time. Good practice is keeping training current, getting a competency sign-off before new tasks, checking the six rights before any medication support, and speaking up when a participant's needs exceed your skills.

4. Integrity, honesty and transparency

"act with integrity, honesty and transparency"

Be straight about what you deliver, what it costs and any interest you have. A breach looks like claiming for a shift that did not happen, or steering a participant to your business without saying so. Since December 2023 the Rules also prohibit charging a participant more for goods than a non-participant pays, without reasonable justification. Good practice is clear agreements, itemised invoices and a declared conflict of interest register.

5. Raising and acting on concerns

"promptly take steps to raise and act on concerns about matters that may impact the quality and safety of supports and services provided to people with disability"

If something could harm quality or safety, act rather than wait for someone else. A breach looks like watching a colleague handle a participant roughly and saying nothing, or noticing unexplained weight loss and never reporting it. Good practice is reporting through the incident system the same day, escalating if nothing happens, and going directly to the Commission if needed. For registered providers, see the timeframes in our reportable incidents guide.

6. Preventing violence, abuse, neglect and exploitation

"take all reasonable steps to prevent and respond to all forms of violence against, and exploitation, neglect and abuse of, people with disability"

Prevention and response are both required. A breach looks like using a participant's bank card for yourself, or leaving a person without meals or medication when a shift runs late. Good practice is worker screening, recognising the indicators of abuse and neglect, acting immediately to protect the person, reporting possible crimes to police, and following mandatory reporting laws for children. For registered providers, abuse or neglect is a reportable incident.

7. Preventing sexual misconduct

"take all reasonable steps to prevent and respond to sexual misconduct"

Sexual contact between a worker and a participant is never acceptable. Nor are sexual comments, sexual material, or grooming such as secret gifts and unrecorded contact outside shifts. Failing to act on a disclosure is also a breach. Good practice is a boundaries policy, a second worker for intimate personal care where practicable, and an immediate, documented response to any allegation. For registered providers, sexual misconduct is a 24-hour reportable incident.

What a breach looks like and what can happen

Failing to comply with the Code contravenes section 73V of the NDIS Act, a civil penalty provision carrying up to 10,000 penalty units for a serious contravention by an NDIS provider and 250 in any other case. Penalty units are indexed.

The response is scaled to the breach. The Act gives the Commissioner compliance notices, infringement notices, enforceable undertakings, court-ordered civil penalties, revocation of registration and banning orders. Banning orders can be made against providers, individual workers and key personnel, including on suitability grounds.

Anyone can complain to the Commission orally, in writing or by any other appropriate means, and anonymously (section 15 of the NDIS (Complaints Management and Resolution) Rules 2018).

How providers show they meet the Code

Auditors look for the Code embedded in practice, not printed on a wall.

• Induction. Cover the Code before a worker's first shift. The Commission's free online module, Quality, Safety and You, covers it from the participant's perspective, and the Core Module quality indicators for human resource management refer to completing the mandatory NDIS worker orientation program, so file each certificate.
• Signed acknowledgement. A worker-facing code and a signed declaration that the worker has read and understood it.
• Training records. Initial and refresher training, dated.
• Supervision. Conduct and boundaries discussed in supervision and performance reviews.
• Complaints and incident systems. Registered providers must maintain both (see our complaints management guide); workers use them and participants know how to complain, including to the Commission.
• Boundaries policy. Gifts, social media, relationships, contact outside shifts and what happens when a line is crossed.

Sole traders and the Code

An independent support worker is an NDIS provider and bound by all seven obligations. Unregistered sole traders are not audited, but the Commission can still investigate complaints and ban individuals. A sole trader registered through the verification pathway is assessed against the Verification Module, whose indicators expect completion of the mandatory NDIS orientation module.

Practical minimum: complete the module and keep the certificate, sign a Code of Conduct acknowledgement, write a boundaries statement, and tell participants how to complain to you and the Commission. See our guides on becoming an independent support worker and the verification audit.

Templates that support the Code

The Code of Conduct Policy and Procedure covers adopting the Code, inducting workers and responding to breaches. The worker-facing Code of Conduct is what workers sign, paired with the Code of Conduct Worker Declaration Form. Sole traders use the VER-10 NDIS Code of Conduct Acknowledgement. The Professional and Participant Boundaries Policy covers gifts, relationships and social media, and the Rights, responsibilities and ethics collection adds participant rights, VANED and whistleblower policies.

These are editable Word files and a starting point. They must be customised to your service and put into practice; audit outcomes and Commission decisions depend on what you actually do.

Frequently asked questions

How many elements does the NDIS Code of Conduct have?

Seven, in section 6(1) of the NDIS (Code of Conduct) Rules 2018, covering rights, privacy, competence, integrity, raising concerns, violence and abuse, and sexual misconduct. Since December 2023, section 6(2) also prohibits charging a participant more for goods than a non-participant pays, without reasonable justification.

Does the NDIS Code of Conduct apply to unregistered providers and independent support workers?

Yes. The Code applies to all NDIS providers and everyone they employ or engage, regardless of registration. An independent support worker paid from plan-managed or self-managed funding is an NDIS provider. The Commission can investigate complaints about unregistered providers and can ban individuals.

Is NDIS Code of Conduct training mandatory?

The Code does not prescribe a course. For registered providers, the Commission's quality indicators refer to completing the mandatory NDIS worker orientation program, so auditors expect a certificate. The Commission's module, Quality, Safety and You, is free online. For unregistered providers it is good practice, not a requirement.

Sources: National Disability Insurance Scheme (Code of Conduct) Rules 2018 (F2024C00048); National Disability Insurance Scheme Act 2013 (C2026C00366), sections 10C, 73P, 73V, 73ZK to 73ZP; National Disability Insurance Scheme (Complaints Management and Resolution) Rules 2018 (F2026C00165), section 15; National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018 (F2026C00528), sections 17 and 74; NDIS Quality and Safeguards Commission, NDIS Code of Conduct: Guidance for NDIS Providers; SafeWork NSW, Work health and safety guidance for NDIS providers; accessed September 2026.