Keeping up with ndis marketing rules and compliance is not just about checking the wording of your next advertisement. Problems can sit in forgotten directory listings, old participant photos, enquiry forms and campaigns that keep running after your services change. A practical marketing audit helps you find those gaps and assign someone to fix them.

This guide gives NDIS provider owners a repeatable audit process. Rather than another list of phrases to avoid, it focuses on the evidence, permissions and controls behind your marketing.

What an NDIS marketing compliance audit should cover

Your audit should examine what people see, what information you collect and who controls publication. Include work completed by employees, contractors, agencies and referral partners using your materials.

Several obligations may overlap: the NDIS Code of Conduct, Australian Consumer Law, applicable privacy requirements, and rules for commercial electronic messages. Registered providers also need to consider applicable registration requirements. Platform advertising policies are another layer, not a substitute for legal compliance.

This is an operational checklist, not legal advice. Check current guidance from the NDIS Quality and Safeguards Commission, NDIA, ACCC, OAIC and ACMA when reviewing a specific issue.

NDIS marketing rules and compliance: build your audit register

Start with one shared spreadsheet. Give each marketing asset its own row rather than recording broad entries such as “website checked”. A service page and its enquiry form can have different risks and owners.

Record these fields:

• Asset: URL, advertisement, brochure, directory entry or email sequence.
• Owner: the person responsible for its accuracy.
• Evidence: where supporting records and permissions are stored.
• Issue: what needs checking or correcting.
• Action: pause, update, remove or seek advice.
• Review date: when the correction and next check are due.

Restrict access to supporting records. Your marketing register should reference consent evidence without becoming another unnecessary store of participant information.

Step 1: Find every place your provider appears

Search your business name, trading names, phone number and main services. Check your own channels first, then places where information has been copied or supplied to someone else.

• Website pages, downloadable PDFs and enquiry forms.
• Live advertisements, scheduled posts and automated emails.
• Google Business Profile and provider directories.
• Brochures supplied to support coordinators and community partners.
• Recruitment pages that also describe participant services.
• Old landing pages that remain accessible through search.

Compare each listing against one approved service record covering locations, available supports, contact details and current capacity. Check that registration descriptions accurately reflect your status and scope, without implying government endorsement.

If a third party controls an incorrect listing, record your correction request and follow up. Updating your website will not automatically update their copy.

Step 2: Match published claims to current evidence

For each factual claim, ask: “What would we show someone who challenged this today?” Focus on statements about staff qualifications, service availability, accessibility, locations and how supports are delivered.

For example, “appointments available this week” needs a current capacity check. A description of specialist expertise needs support from the relevant qualifications and actual service arrangements. An accessibility statement should reflect the specific premises or service, rather than a broad assumption.

Keep evidence references and an expiry or review date where appropriate. Availability claims need more frequent checks than your business history.

Also check NDIA logos, NDIS references and provider badges against current official brand guidance. Do not assume an image is permitted because another provider uses it or an agency supplied it.

Step 3: Audit participant stories, photos and permissions

Create a separate inventory of identifiable participant content, including testimonials, videos, event photos and stories. A changed name does not necessarily make someone anonymous if their location, image or circumstances identify them.

For every asset, check:

• What publication permission was obtained and how it was explained.
• Whether it covers the intended channels, particularly paid advertising.
• Whether the person understood that declining would not affect their supports.
• Whether the finished content stays within the permission given.
• How requests to stop future use will be handled.

Do not treat service consent as marketing consent. Avoid assuming a family member or support person can authorise publication; check the participant’s wishes, decision-making support needs and any relevant legal authority.

If permission is unclear, pause new use while you clarify it. Explain practical limits on removing already distributed print materials or third-party copies, without using those limits as a reason to ignore withdrawal requests.

Step 4: Follow an enquiry through your systems

Submit a test enquiry using fictional details. Follow it from the form to the inbox, CRM, notifications and any automated follow-up. This often reveals information flows that are invisible when reviewing a page in isolation.

Check whether your first-contact form requests more than you need. An initial callback request may not require an NDIS number, plan upload or detailed disability history. Collect sensitive intake information later through an appropriate process where needed.

Check tracking, not just the privacy page

Ask whoever manages your website to document analytics tools, advertising pixels, session-recording software and form integrations. Check whether personal or sensitive information can reach third parties through form fields, page addresses or tracking events.

Do not assume a cookie banner resolves every privacy issue. Review collection notices, access permissions, retention practices and applicable privacy obligations. Seek specialist advice where the data flow or legal position is unclear.

Review enquiry follow-ups separately from newsletters and promotions. An enquiry does not automatically establish permission for ongoing promotional emails or SMS. Check consent, sender identification and unsubscribe arrangements against applicable requirements.

Step 5: Test participant choice and dignity

Read your marketing as someone comparing supports, not as the business selling them. Can they understand the service, ask questions and decline without pressure?

Look for urgency that exaggerates scarcity, language that implies guaranteed funding, or forms that bundle a callback request with unrelated marketing permissions. Check whether stories frame participants as people with preferences and goals, rather than as proof of a provider’s success.

Review the practical experience too: readable text, clear labels, understandable language and alternative contact options. These checks support informed choice, although they are not a substitute for a formal accessibility assessment.

Step 6: Give publication and corrections clear owners

A small provider does not need a large approval committee. It does need someone accountable for checking facts and someone authorised to pause questionable content.

• Service lead: confirms capacity, locations and delivery details.
• Privacy or compliance lead: reviews permissions and information handling.
• Marketing owner: checks approved wording, links and campaign settings.
• Publisher: releases only the approved version and records the date.

One person may hold several roles, but sensitive participant content deserves a second review. Include agencies in this workflow and check who retains access to advertising accounts, website publishing and enquiry systems.

When outsourcing NDIS marketing services, make approval responsibilities, account ownership and urgent takedown procedures explicit. Outsourcing production should not leave accountability unclear.

Turn audit findings into a maintenance routine

Prioritise by potential harm. Suspected unauthorised disclosure or clearly misleading live content needs prompt attention. If personal information may have been exposed, follow your incident response process and obtain advice on any notification obligations; removing the content may not be enough.

Then correct outdated service details and broken contact pathways. Leave cosmetic consistency issues until higher-risk problems are controlled.

Set reviews around change: a new service, changed registration status, revised capacity, new tracking software or a participant withdrawing permission. Add a recurring register review as an internal practice, not as an assumed legal deadline.

The useful outcome is not a “compliant forever” label. It is a documented process for checking evidence, respecting choice and correcting mistakes before they spread.

Want help making your marketing easier to manage and review? book a free strategy call with NDIS Advertising.

Frequently asked questions

How often should an NDIS provider audit its marketing?

Set a recurring review based on your marketing activity and risk, then add checks whenever services, capacity, registration status, permissions or technology change. Time-sensitive availability claims need more frequent checks. This is a practical approach, not a universal statutory audit schedule.

Does an agency take responsibility for NDIS marketing compliance?

An agency can help review content and maintain approval records, but providers should not assume outsourcing removes their own responsibilities. Agree who verifies service facts, checks participant permissions, approves publication and handles urgent corrections.

What should we do if we cannot find consent for a participant photo?

Pause new use and review existing publication while you establish what permission was obtained. Do not assume consent to receive services includes marketing permission. If valid permission cannot be established, remove content you control and seek advice where a privacy issue may have occurred.

Should website analytics be included in a marketing compliance audit?

Yes. Map what analytics, advertising pixels and other integrations collect and where information goes. Check for personal or sensitive information in form data, page addresses and tracking events. Review applicable privacy obligations rather than assuming a cookie banner makes every data flow acceptable.