How long must NDIS providers keep records?
From 27 August 2026, section 45B of the NDIS Act requires NDIS providers to keep prescribed records that relate to a claim for payment, or to the support a claim relates to, for 7 years beginning on the day the claim is made. The kinds of record are to be prescribed by the NDIS Rules. Separately, the NDIS rules already set 7 years for specific records: incident records (from the day the record is made), reportable incident records (from the day the NDIS Commission is notified) and records about regulated restrictive practices (from the day the record is made). Other Commonwealth, State or Territory laws may add retention requirements.
Key takeaways
- Section 45B of the NDIS Act, in force from 27 August 2026 for claims made on or after that date, sets 7 years from the day the claim is made for prescribed records relating to a claim or the support it relates to. Failing to keep them is a civil penalty of 120 penalty units.
- Which record kinds are caught is left to the NDIS Rules. We did not find Rules prescribing them on 26 September 2026, so section 45B does not itself say that every shift note must be kept for 7 years.
- Three record types have a stated minimum of 7 years under the NDIS rules: incident records, reportable incident records and restrictive practice records.
- For a reportable incident the 7 years run from the day the Commission is notified, not the day of the incident.
- Support logs, rosters, case notes, invoices and service agreements must be complete and accurate. The NDIS record keeping page (current as of 20 August 2026) states no single retention period for them, so watch for the Rules under section 45B and check the other laws that apply to you.
- Incomplete or inaccurate records found during a review may mean funds have to be repaid.
How long must NDIS providers keep records?
The retention periods that the NDIS rules state are set out below. Each is a minimum, and each runs from a specific starting point.
| Record | Minimum period | Runs from | Where it is stated |
|---|---|---|---|
| Record of a reportable incident that has occurred or is alleged to have occurred, made under the incident management system | 7 years | The day the record is made | Incident Management and Reportable Incidents Rules 2018, section 12(4) |
| Record of a reportable incident | 7 years | The day notification of the incident is given to the Commission | Same Rules, section 25(2) |
| Written information about the use of regulated restrictive practices | 7 years | The day the record is made | Restrictive Practices and Behaviour Support Rules 2018, section 15(3) |
The Incident Management Rules add a note: a registered NDIS provider may be required to comply with other Commonwealth, State or Territory laws in relation to the retention of records. Treat the periods above as a floor, not a complete answer.
The wording quoted here is from the Rules as published on the Federal Register of Legislation: the Incident Management Rules as made on 18 May 2018 and the Restrictive Practices Rules in their 1 December 2020 compilation. The NDIS website is currently updating its information to reflect the new NDIS legislation, so check the latest compilation of each Rule before you rely on a period.
What does section 45B of the NDIS Act require?
The National Disability Insurance Scheme Amendment (Securing the NDIS for Future Generations) Act 2026 received Royal Assent on 20 August 2026. Schedule 2 Part 4 inserts section 45B into the National Disability Insurance Scheme Act 2013. That Part commenced on 27 August 2026 and applies to a claim for payment made on or after that date.
Section 45B(1) says an NDIS provider must, for the period in subsection (2), “keep and retain a record that relates to: (a) a claim for the payment of an NDIS amount; or (b) the provision of an NDIS support to which a claim for the payment of an NDIS amount relates”, if the record is of a kind prescribed by the NDIS rules. Subsection (2) sets the period as “the period of 7 years beginning on the day the claim is made”, unless the NDIS rules prescribe a shorter period.
| Provision | What it says |
|---|---|
| Section 45B(3) | A provider who refuses or fails to keep and retain a record as required contravenes a civil penalty provision: 120 penalty units. |
| Section 45B(4) | The civil penalty does not apply in circumstances prescribed by the NDIS rules. |
| Section 45B(9) | The record must be in English, or be readily accessible and convertible into English. |
| Section 182(4), as replaced | An amount equal to an NDIS amount is a debt due to the NDIA if the person claimed and received it, was required under section 45B to keep a record relating to the claim or the support, did not comply, and cannot otherwise demonstrate an entitlement to the amount. |
What section 45B does not say: it applies only to records of a kind prescribed by the NDIS rules, and it does not list shift notes, progress notes, invoices, rosters or any other record type. The Bills Digest states that the kinds of record to be kept will be set out in the rules. We did not find Rules prescribing them on 26 September 2026. A provider that keeps support logs, case notes and the records behind each claim for at least 7 years from the date of that claim is aligned with the section as drafted, but confirm the position when the Rules are made. Participants who claim, and other claimants, have separate and shorter periods under the same section.
A contractual duty: the NDIA Terms of Business
Separate from the Rules, registered providers also agree to the NDIA’s Terms of Business for Registered Providers (version effective 1 July 2016, updated January 2020). That is a contract with the NDIA, not a Rule, and its record-keeping clause sits under “Maintenance, Records & Audit: Maintaining records”. It reads:
“A Registered Provider must keep full and accurate accounts and financial records of the supports delivered to NDIS participants, along with records of service agreements. The accounts and financial records must be maintained on a regular basis and in such detail that the Agency is able to accurately ascertain the quantity, type and duration of support delivered.”
Two points about that clause. It concerns accounts, financial records and service agreements, and it sets a standard of detail, not a retention period. It does not say that all correspondence must be kept for a set number of years. Neither that clause nor section 45B sets a rule for all provider correspondence, and we have not found a general seven-year rule for it in the NDIS website’s record keeping page, the Practice Standards or the 2026 reform instruments, so this guide does not state one. The wording is from the version effective 1 July 2016 and updated January 2020. We have not confirmed that it is the version currently served through the NDIA provider portal, so check the current version. Since 27 August 2026 the statutory requirement in section 45B of the NDIS Act is the newer and higher authority, and it is the one to rely on first.
What records must an NDIS provider keep?
The NDIS states that a provider needs to keep complete and accurate records of NDIS supports delivered to participants. Records include invoices, support logs, rosters, case notes and service agreements. It is the provider’s responsibility to make sure claims for payment are complete, truthful and accurate.
All record keeping should include, as a minimum, the participant’s name, the participant’s NDIS number, the date or dates the support was delivered, the amount and quantity or hours of support delivered, and the support type.
- Invoices also carry the business name, the support item number, the claim type and the total amount. Each invoice can only be for one participant.
- Support logs track individual supports and need to be signed by the participant, a child representative, a nominee or a legal guardian.
- Rosters for group activities show the activity, the names of participants and staff, and that the participant attended as scheduled.
- Case notes outline the activities a participant has engaged in and how they relate to the specific support item and the participant’s goals. They may also include progress and plans for future sessions.
What must an incident record contain?
The Incident Management Rules require the incident management system to provide for details to be recorded as a minimum for each reportable incident, including a description, the time, date and place, the people involved and any witnesses, the actions taken in response, consultations with the people affected, whether they were given reports or findings, the details and outcome of any investigation, and the name and contact details of the person making the record. Records for an alleged incident follow a similar list.
What must a restrictive practice record contain?
Section 15 of the Restrictive Practices Rules makes it a condition of registration to keep written information about the use of regulated restrictive practices. As a minimum it must include a description of the use (its impact, any injury, whether it was a reportable incident and why it was used), the behaviour that led to it, when and where it started and ended, who was involved and who witnessed it, the actions taken in response, what less restrictive options were considered or used first, and the actions taken leading up to it, including strategies used to prevent the need for it.
What changed for record keeping in 2026?
- The National Disability Insurance Scheme Amendment (Integrity and Safeguarding) Act 2026 received Royal Assent on 8 April 2026. The NDIS Commission describes it as delivering strengthened monitoring, compliance and enforcement powers.
- The NDIS record keeping page carries a notice that information on some pages may change to reflect new NDIS legislation. It was current as of 20 August 2026.
- The provider payment assurance program checks that claims for payment are accurate. The NDIS states that failing to provide complete and accurate records during a review may result in funds having to be repaid.
We found no change to the 7-year periods in the pages and Rules listed under Sources, retrieved on 25 September 2026. That is a statement about those sources, not legal advice.
How to keep records so they hold up
This part is practical guidance rather than a regulatory requirement.
- Keep a retention list by record type, with the start date rule beside each one: the day made, or the day the Commission was notified.
- Record the notification date on every reportable incident record, because it sets the start of its 7 years.
- Meet the Practice Standards outcome for information management: each participant’s information is identifiable, accurately recorded, current and confidential, and easily accessible to the participant and appropriately used by relevant workers.
- Do not destroy a record early because a shift note feels routine. Check the other laws that apply to your organisation first.
This guide is general information, not legal advice. Confirm the position for your registration and your state or territory with the NDIS Commission or a legal adviser.
Frequently asked questions
Is there a 7 year record retention requirement in the NDIS Act?
Yes, for prescribed records. Section 45B of the NDIS Act, in force from 27 August 2026 for claims made on or after that date, requires an NDIS provider to keep and retain a record relating to a claim, or to the support a claim relates to, for 7 years beginning on the day the claim is made, if the record is of a kind prescribed by the NDIS rules. The kinds of record are left to the Rules.
What is the penalty for not keeping records under section 45B?
A civil penalty of 120 penalty units under section 45B(3). Under section 182(4), an amount claimed and received can also become a debt due to the NDIA where the required record was not kept and the provider cannot otherwise demonstrate an entitlement to the payment.
Does the 7 years start when the incident happens?
Not necessarily. For the incident record made under section 12 it starts on the day the record is made. For a reportable incident record under section 25 it starts on the day notification of the incident is given to the NDIS Commission.
How long do NDIS providers keep shift notes and case notes?
The NDIS record keeping page requires complete and accurate records, including case notes, but does not state a retention period for them. The 7-year periods in the Incident Management and Restrictive Practices Rules apply to incident, reportable incident and restrictive practice records, and section 45B of the NDIS Act sets 7 years from the claim for records of a kind prescribed by the NDIS rules, which we could not find on 26 September 2026. Other laws may apply, so confirm your obligations.
How long must restrictive practice records be kept?
Seven years from the day the record is made, under section 15(3) of the NDIS (Restrictive Practices and Behaviour Support) Rules 2018.
What happens if my records are incomplete during a review?
The NDIS states that failing to provide complete and accurate records during a review under the provider payment assurance program may result in funds having to be repaid.
Sources
- National Disability Insurance Scheme Amendment (Securing the NDIS for Future Generations) Act 2026, Schedule 2 Part 4 (section 45B) and item 86 (section 182(4)) (Federal Register of Legislation, retrieved 26 September 2026)
- What are the record keeping requirements (NDIS) (NDIA, retrieved 25 September 2026)
- NDIS (Incident Management and Reportable Incidents) Rules 2018, sections 12 and 25 (Federal Register of Legislation, retrieved 25 September 2026)
- NDIS (Restrictive Practices and Behaviour Support) Rules 2018, section 15 Record keeping (Federal Register of Legislation, retrieved 25 September 2026)
- NDIA Terms of Business for Registered Providers, Maintenance, Records & Audit: Maintaining records (NDIA, retrieved 26 September 2026; version effective 1 July 2016, updated January 2020)
- Core module: Provider governance and operational management (Information management) (NDIS Quality and Safeguards Commission, retrieved 25 September 2026)
- Integrity and safeguarding (NDIS laws page, Royal Assent 8 April 2026) (NDIA, retrieved 25 September 2026)
- Regulator welcomes new powers to strengthen NDIS integrity and safeguards (NDIS Quality and Safeguards Commission, retrieved 25 September 2026)
Related
Keep an evidence trail as work happens
See how NoteGate checks notes before they are saved and keeps the record an assessor can follow.
Book a 20-minute walkthroughChoose a plan