Who should see my NDIS plan (and who should not)

Start with the work and the participant's choice

The NDIA's plan-sharing guide puts participant choice at the centre. For a copy you send yourself, ask what the person needs to do, what information helps and whether they need to keep the document or simply discuss it with you. You may choose the whole current plan, an extract or summary, or decline this request.

Ask who in the organisation will use it, how it will be stored and whether it will go to another person or service. A job title alone does not tell you how much information the work needs. Nor does being a relative mean someone automatically receives a copy.

Use the communication and decision support the participant wants: an interpreter, an accessible explanation, time to consider the request or a chosen supporter. Helping someone understand and express a choice is different from deciding for them.

Where a nominee, child representative or another representative is involved, check the authority that applies to this particular decision. The NDIA's nominee guidance explains different nominee roles and their limits. An NDIS appointment should not be treated as blanket authority over every provider's records. A Kinovo Team leader's software role does not confer representative authority.

A copy, portal access and authority to act are different

A copy you show or send: you can provide your own plan or selected information directly. You do not need the NDIA to send that copy for you. The recipient may retain a downloaded or emailed copy; changing a portal setting does not recall it.

NDIA information sharing: the plan-sharing guide explains how provider access is recorded and checked in the participant portals or with your NDIS contact. Portal access follows the available provider roles and settings; it is not the same as attaching a PDF or choosing individual PDF pages.

Permission to act: NDIA consent guidance separates access to information from permission to make specified requests or changes on your behalf. Sending someone a plan does not, by itself, give them that authority. Use the relevant NDIA process for the task, scope and duration you intend.

If you are preparing for adulthood, read about turning 18 with the NDIS, consent and chosen support to plan the separate conversations about NDIA arrangements, provider sharing and workspace access.

Check what provider portal access actually allows

In the my NDIS provider portal, access depends on the provider relationship, role and relevant consent. The NDIA's provider-portal guide explains basic information and additional information available to different roles. Do not assume you can select any combination of individual pages.

Plan managers have a specific arrangement. The NDIA plan-manager connection guide says consent for plan and budget information is automatically applied when you choose the manager and it is recorded as your my provider. This is separate from whether you send your own full plan PDF.

Also check the organisation, not just your usual contact. The provider-portal guide says employees in the provider organisation who have portal access can access participant plan information. Naming a contact does not restrict it to that person. Ask your NDIS contact to confirm the access available in your circumstances, particularly if you use myplace rather than my NDIS.

Use the proper access routes rather than giving someone your login. The NDIA's plan-protection guidance says providers do not need your myGov login or your my NDIS app or portal login details to process claims or service agreements.

If the different apps and portals are confusing, our my NDIS app and care-team apps comparison explains which system helps with which question.

If the request is unclear, delayed or time-sensitive

Try: 'What information do you need for this work, who will use it, and would selected pages or a discussion be enough?' If the provider says the whole plan is essential, ask which task cannot proceed without it and why an alternative will not meet that need.

If there is little time, explain what you can provide now and ask what can proceed while a question or record is being clarified. Give any known appointment or service date. Do not assume declining a copy has no consequences, or that it automatically means the service must stop. Ask the provider to explain the practical effect and available alternatives.

If nobody replies, keep the unanswered request visible and contact the service's usual booking or coordination contact about the work that is waiting. A chosen supporter or coordinator may help if they agree; a family member should not be expected to prepare every extract or chase every response.

Where an organisation relies on consent, the OAIC's consent guidance explains that it should be informed, voluntary, current and specific, with the consequences explained. Ask for separate explanations of different purposes rather than feeling you must accept a vague permission for every future use.

These are practical sending checks. The OAIC's information-security guide explains organisational safeguards, including checking destinations and protecting information in transit.

For the technical point about hiding text, the Federal Court's electronic-redaction guide explains why covering text with shapes can leave it searchable or copyable. Keep the original and check the copy you intend to send.

If the person wants support exploring a choice, use the decision-preparation note.

Review access and older copies when things change

When a plan, provider or sharing preference changes, review NDIA access in the applicable participant portal or with your NDIS contact. The NDIA plan-sharing guide explains changing or withdrawing consent. Ask how a change affects any active provider relationship, particularly a plan-manager arrangement; do not assume one setting completes every transition step.

Contact people holding copies separately. Identify the old version, explain the change and ask them to confirm who can still access it and what will happen to retained copies. Changing portal or Kinovo access cannot recall files already downloaded, emailed or forwarded.

The OAIC's consent guidance says an organisation cannot rely on withdrawn consent for future use or disclosure. Withdrawal does not automatically require all held records to be erased. Ask what must be retained, why, and how further access or use will be limited.

There can be other lawful reasons to use, disclose or retain information. The OAIC's use and disclosure guidance explains the main rules and exceptions; its security guide covers retention obligations. If a provider cannot follow a restriction you request, ask it to explain the basis rather than assuming your message can override every obligation.

If information went to the wrong person

Contact the recipient and the provider's privacy contact promptly. Identify what was sent and ask them to stop further sharing, contain access and explain the next steps. Restrict a shared link if you control it, while recognising that someone may already have saved a copy.

The OAIC's data-breach response guide explains containment and assessment for organisations. A mistake needs an appropriate response; it does not automatically mean every incident must be reported to the OAIC.

If you feel pressured or information is being used in a way you did not agree to, ask the provider's privacy or complaints contact to address the concern. The NDIS Code of Conduct includes respect for privacy. Ask for help to raise a concern if you need it; you do not have to resolve an unclear sharing arrangement alone.

For the practical work of naming files, checking versions and requesting missing reports, use the NDIS document organiser.