NDIS respectful online conduct and SDA: A privacy-risk checklist

SDA providers hold sensitive information about where people live, who supports them, what dwelling features they need, what disputes or repairs are open, and whether a move-in or vacancy is under review. That information can easily leak through a careless post, a joking staff message, a screenshot, a referral group comment or an owner update copied into the wrong channel.

The Commission's alert says providers should understand obligations under the NDIS Code of Conduct, the Privacy Act 1988 and online safety laws, train workers, and ensure online activity and social media comply with the Code. In SDA, the practical control is a clear online conduct register: who can post, what can be shared, what must never be shared, how concerns are reported and how participant privacy is protected before content leaves the operating record.

This should cover more than the marketing team. Intake staff, property managers, support workers, contractors, owners, directors and referral partners can all create online risk if they discuss participants, homes, vacancies or incidents in public or semi-public channels.

Use this checklist before posting vacancy material, responding to online comments, sharing resident stories, sending owner updates, joining referral groups, managing a complaint, or onboarding staff and contractors who access SDA homes.

SDA vacancy promotion often sits close to participant information. A listing might mention a shared home, current housemate preferences, support-provider model, property photos, robust design features, OOA availability or local routines. Each detail may be reasonable on its own, but the combination can become identifying when copied into social media groups or investor updates.

A safe workflow uses approved listing fields, photo checks, resident consent gates where needed, and a plain rule that staff do not discuss current residents or applicants in comment threads. If a referrer asks sensitive questions in a public channel, move the conversation to a controlled referral pathway and record the authority before sharing participant-specific information.

This also protects claim and service-agreement evidence. A social post should never become the source of truth for move-in dates, my provider status, funding management, reasonable rent contribution, support arrangements or housemate fit.

The Code of Conduct expects providers and workers to respect privacy, act with integrity, provide supports safely and competently, and raise or act on concerns that may affect quality and safety. The Commission's alert also says poor online conduct can harm participant safety, wellbeing and trust.

That means an online concern should have the same triage discipline as an ordinary complaint. Classify the concern, protect the participant from retaliation, decide whether content needs to be removed, check whether any worker or contractor breached policy, and record who will contact the participant or authorised representative.

Do not let the complaint response become a new privacy breach. Store screenshots in a restricted record, avoid sending them to owners or broad operational lists, and keep any external update factual and minimal.

Online behaviour is often a culture signal. If staff feel comfortable mocking participants in group chats, posting private details, using demeaning language or resharing offensive content, the issue is not only the post. It is whether recruitment, induction, supervision, incident reporting and leadership are reinforcing the expected standard.

SDA homes are especially sensitive because they are homes, not worksites alone. A resident should not have to wonder whether property staff, support workers, managers or contractors are discussing their life online. Providers should make the online boundary part of induction, contractor terms, performance review, incident learning and complaint trend review.

The record should show the action taken: training assigned, content removed, worker conversation held, participant contacted, policy updated, support partner notified, privacy advice sought or complaint closed. Without that trail, the provider may only have a deleted post and a memory of the response.

NDIS record-keeping guidance expects complete and accurate records for supports, while SDA guidance requires written service agreements and clear participant understanding. Those records should stay controlled. A provider should not copy service agreement extracts, invoices, plan details, claim screenshots or participant identifiers into online channels to answer a public question or reassure an owner.

Owner reporting needs the same filter. Owners may need to know that a vacancy listing is live, a referral is unsuitable, a resident complaint is being handled, a content review delayed publication, or a privacy issue has been closed. They usually do not need the private detail behind that state.

The strongest SDA systems separate internal evidence from external reporting: rich participant and claim records inside the provider workflow, sparse owner-safe status outside it.

StepFree SDA is built for the operating layer where participant records, dwellings, vacancies, claims, agreements, complaints, support handoffs and owner reporting meet.

For respectful online conduct, that means providers can keep privacy-sensitive issues, complaint states, vacancy listing checks, participant authority and owner-safe reporting labels connected instead of relying on scattered screenshots and message threads.