The 7-Year Records Rule: What NDIS Providers Must Keep, and For How Long
The NDIS framework requires registered providers to keep records for at least 7 years.
Records includes: participant files, service delivery records, incident records, reportable incident submissions, complaints records, restrictive practice usage records, behaviour support plans, financial records, workforce records (screening, training, qualifications), and management decisions.
If it's evidence of something the Practice Standards require, it's a record.
Storage isn't just storage
The Practice Standards require:
- Records secure from unauthorised access
- Access logged and limited to staff with a need
- Backup procedures so records aren't lost
- Disposal procedures for when retention ends
What auditors sample
- A reportable incident from 18 months ago — show the full chain
- A worker's onboarding from 4 years ago — show the screening, qualifications, training as they stood then
- A participant's service agreement from 2 years ago — show the version in force then and any revisions since
If you can't produce these in a reasonable time, the finding isn't about underlying compliance — it's about records management.
Disposal at end of retention
Secure destruction. Shredding for paper. Cryptographic deletion for digital. Document the disposal.
