NDIS provider marketing rules: advertising, referrals and privacy for your website and follow-up

Key takeaways

• Never describe services as NDIS approved, NDIS funded or covered by funding.
• No gifts, fees or swap deals for referrals, with coordinators or other providers.
• Enquiry forms and your CRM hold health information, so the Privacy Act applies regardless of size.
• Automated follow-up and review requests are fine when they are honest, consented and easy to stop.

Can I say “NDIS approved” or “NDIS funded” in my ads?

No. Under NDIS provider marketing rules as the NDIA applies them, calling a product or service “NDIS approved”, “NDIS permitted” or “100 percent NDIS funded” is misleading, because the NDIA does not endorse products or services (NDIA, 4 December 2025).

This is enforced. The NDIA’s campaign on misleading promotion had produced 604 referrals to the ACCC and 112 likely Code of Conduct breaches by December 2025. In June 2026 a registered provider paid a $19,800 infringement notice over social media ads that said “If you have NDIS funding, it’s covered” (ACCC, 19 June 2026).

Treat any line about funding as a red flag. The safe version describes the support and lets the participant check their own plan. “We provide in-home personal care in Western Sydney” is fine. “Fully funded by your NDIS plan” is the kind of claim the regulator counts as NDIS approved misleading wording.

Can I offer support coordinators referral fees or gifts?

No. The NDIS Code of Conduct applies to registered and unregistered providers, and guidance on it says providers should not give, ask for or accept any incentive or gift, including referral arrangements with other providers. Participants should choose without influence, incentive or pressure (National Disability Services factsheet, reviewed May 2023, citing Commission guidance).

So NDIS referral fees support coordinators might be offered, gift vouchers, “you refer to us, we refer to you” swaps and commissions are all out. The NDIA also expects support coordinators to declare and avoid conflicts of interest and to avoid “sharp practices” (NDIA).

What works and is allowed: being easy to refer to. A clear one-page summary of who you support, where, and how fast you respond. A same-day reply when a coordinator calls. Paperwork that is ready on time.

What can registered providers say about their registration status?

A registered provider can say so plainly, and may use the NDIA’s “I/we heart NDIS” or “support NDIS” logo with the tagline “Registered Provider”, subject to the logo guidelines (same NDIA source).

With registration becoming mandatory for more supports from July 2027, status will matter more to families. State it accurately, keep your registration groups current on your website, and never imply registration you do not hold.

Does the Privacy Act apply to my enquiry forms and CRM?

Almost certainly. Most businesses with turnover under $3 million are exempt from the Privacy Act, but the exemption does not apply to health service providers. The OAIC counts disability service providers that handle health information as health service providers (OAIC; Guide to Health Privacy, May 2025).

That makes NDIS Privacy Act small business questions simple: plan as if it applies. An enquiry form that asks about disability, support needs or a participant’s plan is collecting health information. In practice:

• Collect only what you need for the first conversation.
• Show a short collection notice on the form, linking your privacy policy.
• Record NDIS enquiry form consent for follow-up messages.
• Keep enquiries in a system with access controls, not a shared inbox or spreadsheet.
• Do not paste participant details into public AI tools.

How should automated follow-ups and review requests be handled ethically?

Compliant NDIS follow-up is respectful, honest and easy to stop.

• Ask first. Get consent to follow up, and include an opt-out in every message.
• Inform, do not pressure. One or two check-ins about availability or next steps, then stop.
• Talk to the right person. Families and coordinators are often in the loop. Confirm who the participant wants you to contact.
• Review requests after good service only. Ask once the support is running well, with no gift or discount attached.
• Keep the AI assistant in its lane. It should answer common questions and book a call, and never make eligibility or funding statements.

What does a compliant enquiry-to-intake process look like?

1. A participant, family member or coordinator enquires through your website, phone or socials.
2. The enquiry lands in one CRM with a collection notice and consent recorded.
3. A person or an AI assistant replies the same day with availability and a booking link.
4. An intake call is booked, with a reminder.
5. If there is no reply, one or two polite follow-ups go out, then stop.
6. An accepted participant moves into your NDIS practice system for the service agreement, rostering and claiming.

Speed matters in step 3. From 1 December 2026 claims must be lodged within 90 days, so paperwork that starts late now costs money as well as goodwill.

NDIS provider software such as LYD Assist is built for steps 1 to 5. It does not make eligibility decisions, and referral sources are recorded for reporting only.

Who builds this for NDIS providers?

Launch Your Dream, by Sharktech Global, builds LYD Assist for NDIS and disability providers, up and running within 7 working days of receiving your onboarding details. Open the live demo or book a free 30 minute discovery call.

General information only, not legal advice. Check the NDIS Commission’s current Code of Conduct guidance, the NDIA and the OAIC before relying on any of this.