NDIS Provider Website Requirements: What's Required and What's Expected

No. The NDIS Commission describes a registered provider as one that has applied for registration, been audited against the relevant NDIS Practice Standards, passed a suitability assessment covering the provider and its key personnel, and been issued a certificate of registration, generally for three years. None of those steps asks for a website, and unregistered providers don't go through registration at all. Registration is already compulsory for some supports, including specialist disability accommodation, plan management and supported independent living, and the government's timeline has it expanding to higher-risk supports such as personal care from 1 July 2027.

A website is expected rather than required. The NDIA tells participants to research providers and check reviews before choosing one, and its provider finder shows a registered provider's website details alongside their phone number, email and suburb. Unregistered providers can only be used by participants who self-manage or plan-manage their funding, and for them a site is often how those participants and their families find you in the first place.

This guide sets out the rules that touch what a provider's site says. It summarises official guidance and links to each source. It isn't legal or compliance advice: rules change, and the NDIS Commission, the NDIA and the other regulators named here are the ones to check with.

The NDIS logo and the NDIS acronym are registered trade marks in the NDIA's name, and its logo guidelines are the most specific rules about what a provider can put on a site. Nobody may use the NDIS logo itself, online or anywhere else, without the NDIA's written consent. Registered providers can download and use the 'I/we heart NDIS' and 'I/we support NDIS' logos with the 'Registered Provider' tagline. Unregistered providers can't use those logos, can't call themselves a 'registered provider', and can't use wording such as 'official NDIS provider' that implies they are.

The guidelines also cover the acronym. The NDIA accepts that providers sometimes need to use NDIS in a descriptive sense, as long as it doesn't confuse or mislead, but it gives 'NDIS' in a business name, trading name or domain name, and service names like 'NDIS packages' or 'NDIS bundles', as examples of misleading statements of affiliation. That's worth knowing before you buy a domain, because changing one later means a new email address, new printed material and a redirect for every link pointing at the old one.

Two situations need extra care:

• Working under someone else's registration. If you deliver supports through another provider's registration in a brokerage or subcontracting arrangement, the Commission says the registered provider must make the arrangement transparent so participants know who is responsible. Your own site shouldn't describe you as registered.
• Registration groups and conditions. Registered providers are listed on the NDIS Provider Register, and any additional conditions the Commission imposes appear there too. Coordinators and families can compare your site with the register, so describe your registration in the same terms it uses.

The Privacy Act's small business exemption may not help you. The OAIC lists a disability service provider that handles health information as a health service provider covered by the Act, even if it's a small business. Covered organisations need an APP privacy policy, and the OAIC's guidelines on APP 1 say it should be available free of charge and in an appropriate form, usually on the organisation's website, with a prominent link from each page suggested as one way to do it.

For registered providers audited against the core module, its information management outcome adds that each participant should be told how their information is stored and used, and how they can access or correct it.

On the site, that means a privacy policy page linked from the footer of every page, and forms that ask only for what you need before a first conversation. A referral form doesn't need a diagnosis or a copy of the plan; those can come later through whatever secure method you already use. The policy is your document to prepare, and the OAIC publishes a guide to writing one. We set it out on its own page and link it from every form.

Whether you can quote a happy participant depends on what you provide. For regulated health services, such as occupational therapy, physiotherapy or psychology from a registered practitioner, the National Law doesn't allow testimonials in advertising. Ahpra defines a testimonial as a positive statement about the clinical aspects of a service: the symptom or reason for seeking treatment, the diagnosis or treatment given, or the outcome. Comments about customer service or communication that leave those out aren't testimonials and can be used.

Supports that aren't regulated health services, such as cleaning, gardening or community access, fall outside that rule. Consumer law still applies to any testimonial or review you publish, so it has to be genuine and not misleading. Whatever the service, the Code of Conduct's requirement to respect the privacy of people with disability is a good reason to get written permission before publishing anyone's words, and to leave out anything that identifies their disability.

Parliament passed the NDIS Amendment (Securing the NDIS for Future Generations) Bill on 19 August 2026. The NDIS Commission says the Act includes new offences for providers offering kickbacks and inducements, and the government's implementation timeline lists 27 November 2026 as the day that ban begins. The ACCC's guidance already notes that the Code of Conduct requires providers not to apply pressure tactics or offer inappropriate incentives to enter a contract.

A banner offering a free tablet for signing up this month, or a gift card for every new client, reads as exactly the kind of incentive these rules are aimed at. If you're unsure whether an offer crosses the line, check the Commission's guidance or get advice; it isn't something a web designer can rule on.