Disability Services and Inclusion (Code of Conduct) Rules 2023

The instrument directly affects several distinct groups. Funding recipients are the primary targets: any person or organisation that receives a grant or enters into an arrangement under section 13 of the Disability Services and Inclusion Act 2023 for the provision of disability services or inclusion activities. This includes a wide range of entities: non-profit disability service providers, for-profit providers, community organisations, local governments, and potentially individuals who receive direct funding for personal care or support. The transitional code also applies to recipients of funding under specific programs listed in the Financial Framework (Supplementary Powers) Regulations, which may include state government agencies, research organisations, and other bodies that are not typically considered direct disability service providers.

Employees and key personnel of funded entities are indirectly but significantly affected. While the code directly imposes duties only on the funded entity, sections 7 and 10 mean that an entity can be found in breach because of conduct by its key personnel or employees. This creates a strong incentive for entities to ensure all staff are trained on and comply with the code, even if the staff member has no direct contractual obligation under the Rules. The extension to after-hours conduct (where it relates to the eligible activity) imposes monitoring and training obligations that go beyond normal workplace boundaries.

People with disability are the intended beneficiaries. The code is designed to protect their rights to freedom of expression, self-determination, privacy, safety, and freedom from violence, abuse, neglect, and sexual misconduct. However, the instrument creates no direct cause of action for individuals; enforcement is through the grant-making department’s powers under the Act, which may include suspending or terminating funding.

The Social Services Department is the administering body. It must monitor compliance, investigate potential breaches, and decide on enforcement actions. The instrument also implies that the Department may require entities to maintain complaints and incident management systems (as referenced in the note to sections 7 and 10, drawing on subsections 15(4) and (5) of the Act), adding to its own administrative burden.

The core of the instrument is the seven duties set out in subsection 6(2) (main code) and subsection 9(2) (transitional code), which are identical in wording. A covered person (or eligible organisation/body) undertaking the relevant activity must:

(a) Act with respect for the individual rights of people with disability to freedom of expression, self-determination and decision-making, in accordance with applicable laws and conventions. This duty is broad and incorporates external standards such as the United Nations Convention on the Rights of Persons with Disabilities. It requires more than mere non-discrimination; it demands active respect for autonomy.

(b) Respect the privacy of people with disability. This imposes obligations beyond general privacy law, requiring that all personal information held in the course of the activity be handled with care, and that individuals’ private lives not be intruded upon unnecessarily.

(c) Provide the eligible activity in a safe and competent manner, with care and skill. This is a professional standard duty akin to a duty of care in tort, but codified as a regulatory obligation. It requires that the service be delivered by competent personnel using safe practices.

(d) Act with integrity, honesty and transparency. This duty covers financial and operational dealings, requiring that the entity not deceive beneficiaries, the Department, or the public.

(e) Promptly take steps to raise and act on concerns about matters that may impact the quality and safety of the provision of the eligible activity to people with disability. This is a proactive duty: the entity must establish mechanisms to identify and escalate concerns, not merely react to complaints.

(f) Take all reasonable steps to prevent and respond to all forms of violence against, and exploitation, neglect and abuse of, people with disability. The “all reasonable steps” standard is a due diligence obligation. It requires risk assessment, staff screening, policies, training, and reporting protocols. It is not a strict liability duty but a reasonableness standard that will depend on the context and size of the entity.

(g) Take all reasonable steps to prevent and respond to sexual misconduct. This is a specific subset of (f), likely reflecting the particular vulnerability of people with disability to sexual harm.

These duties are owed by the entity to the Commonwealth as a condition of funding. Individuals with disability do not have a private right to enforce the code. However, a breach may lead to administrative action under the Act, including funding suspension, repayment, or termination.

The instrument itself does not create criminal offences or civil penalties. It is a code of conduct made under section 20(1) of the Act, and the enforcement framework is established by the Act. The Rules merely articulate the content of the code; the Act provides the consequences for breach. Those consequences are not specified in the instrument, but the Act likely empowers the Minister or the Department to impose sanctions such as suspending or terminating funding, requiring repayment, or excluding the entity from future grants. The instrument notes that entities must implement complaints and incident management systems (referring to subsections 15(4) and (5) of the Act), which are likely enforceable through the same mechanisms.

Because the instrument is a legislative instrument, it may also be enforced through the general framework of administrative law. Decisions by the Department to impose sanctions could be subject to judicial review under the Administrative Decisions (Judicial Review) Act 1977 or internal merits review through the Social Services Department. There is no private right of action for people with disability; they can complain to the Department but cannot sue for breach of the code directly.

The attribution provisions in sections 7 and 10 create a form of vicarious administrative liability. The entity can be held in breach for conduct of its key personnel or employees, even if the entity itself took reasonable steps to prevent the breach. This goes beyond vicarious liability at common law, which often allows the employer to avoid liability by showing it took reasonable precautions. The instrument does not include a defence that the entity exercised due diligence in selecting or supervising the employee. However, the phrase “takes all reasonable steps” in duties (f) and (g) may provide some scope for arguing that the entity did not breach its own duties if it took reasonable steps, but the entity could still be found in breach because the employee’s conduct is attributed to it under sections 7 and 10. The drafting is not entirely clear on this interplay, which creates legal risk.

The instrument operates within a complex legislative framework. It is made under two Acts: the Disability Services and Inclusion Act 2023 (the primary Act) and the Disability Services and Inclusion (Consequential Amendments and Transitional Provisions) Act 2023. The code applies only to activities funded under those Acts, not to all disability services in Australia. For example, services funded through the National Disability Insurance Scheme (NDIS) are subject to a separate regulatory regime under the NDIS Act 2013 and the NDIS Code of Conduct made by the NDIS Quality and Safeguards Commission. Providers that receive both NDIS funding and funding under the Disability Services and Inclusion Act will need to comply with both codes. The two codes have similar but not identical duties; the NDIS Code, for instance, includes specific obligations about restrictive practices, which are not mentioned in this instrument.

The instrument interacts with the Financial Framework (Supplementary Powers) Act 1997. Section 11 specifies that certain programs funded under that Act are subject to the transitional code. This means that many programs that were previously governed only by standard grant conditions now have a statutory code of conduct attached. This adds a layer of regulatory requirements for program recipients who may not be traditional disability service providers.

The duties in the instrument reference “applicable laws and conventions” for rights to freedom of expression, self-determination, and decision-making (subsection 6(2)(a)). This incorporates by reference external laws such as the Australian Human Rights Commission Act 1986, state anti-discrimination laws, and the Convention on the Rights of Persons with Disabilities. It does not create new rights but requires providers to comply with existing obligations as a condition of funding.

State and territory child protection and criminal laws remain separately applicable. The duty to take reasonable steps to prevent violence and sexual misconduct does not replace obligations under state criminal law; it adds regulatory consequences for failing to prevent conduct that may also be a crime. The instrument does not provide any immunity from prosecution under state law.

The instrument is original: “as originally made” as noted in the table in section 2. It was made by the Minister for Social Services on 15 December 2023 and commenced on 1 January 2024. There are no amendments recorded in the instrument. As at the time of writing, no amending instruments have been identified. The instrument is currently in its first version. It is possible that future amendments will expand the list of specified programs under section 11, clarify the interplay between the attribution provisions and the “reasonable steps” duties, or align the code with any amendments to the parent Act or the transitional provisions. Practitioners should monitor the Federal Register of Legislation for any subsequent variations.

As this instrument came into force only on 1 January 2024, and as at the time of writing (mid-2025), there is no reported litigation directly concerning the Disability Services and Inclusion (Code of Conduct) Rules 2023. No cases have been identified that interpret the scope of “covered person,” the meaning of “eligible activity,” or the attribution provisions. Given the recency of the instrument, this is unsurprising. However, there may be administrative decisions by the Department that are subject to internal review or judicial review, but those are unlikely to be publicly reported unless they reach the federal courts. The instrument’s broad terms (e.g., “act with integrity, honesty and transparency”, “take all reasonable steps”) are fertile ground for future disputes. Providers that receive adverse funding decisions based on an alleged breach will need to test the Department’s interpretation in merits review or judicial review. The absence of case law means that the meaning of key terms is unsettled, increasing compliance uncertainty.

Several aspects of the instrument pose traps for unwary providers.

1. Attribution of employee conduct regardless of working hours. Sections 7(3) and 10(3) state that the attribution provision applies “whether or not the member or employee undertakes, or participates in undertaking, the eligible activity during the ordinary working hours of the member or employee.” This means that an entity can be liable for conduct by an employee that occurs outside normal working hours, provided it is still within the scope of the eligible activity. For example, if a support worker has a personal social media interaction with a client that involves disclosing private information, that may breach the privacy duty and be attributed to the employer even if it happened on a weekend. Providers must extend their training and supervision beyond the workplace.

2. No due diligence defence in attribution. Unlike some vicarious liability provisions in other legislation, sections 7 and 10 do not include a defence that the entity took all reasonable steps to prevent the employee’s conduct. If the employee breaches the code while undertaking the eligible activity, the entity is in breach, period. This creates strict liability for the entity in respect of employee actions. The only potential escape is to argue that the employee was not “undertaking, or participating in undertaking” the eligible activity at the time, but the carve-out of ordinary working hours makes that harder.

3. Broad definition of “key personnel” and “employee.” The instrument does not define these terms; it relies on the Act’s definition of “key personnel” and the ordinary meaning of “employee, or otherwise engaged.” “Otherwise engaged” includes volunteers, contractors, and subcontractors. A provider could be liable for the conduct of an independent contractor who is providing services on its behalf. Providers must ensure that all individuals performing work in connection with the eligible activity are covered by policies and training.

4. The transitional code applies to many programs not traditionally considered disability services. Section 11 specifies programs under the Financial Framework (Supplementary Powers) Regulations that may include research programs, community grants, and other initiatives that are not direct service delivery. Organisations receiving such grants may be unaware that a code of conduct applies to them. The duty to “act with respect for the individual rights of people with disability” may be challenging for grantees that have little direct engagement with people with disability.

5. Reporting obligations may conflict with other laws. The duty to “promptly take steps to raise and act on concerns” (subsection 6(2)(e)) suggests that providers must report potential quality and safety issues. But reporting may be restricted by privacy laws, confidentiality clauses, or professional obligations. Providers must navigate these conflicts carefully.

Compliance with the code of conduct requires a systematic approach integrated into the provider’s governance and operations.

Step 1: Understand scope. Identify all arrangements and grants under section 13 of the Act, and any transitional funding under the listed specified programs. Confirm whether the code applies to each funding stream. Document which eligible activities are covered.

Step 2: Develop a code of conduct policy. Adopt a written policy that mirrors the seven duties in subsections 6(2) and 9(2). The policy should be tailored to the specific services provided and the risks faced by people with disability in those services. It should reference applicable laws and conventions, particularly the UN Convention on the Rights of Persons with Disabilities.

Step 3: Implement training. All key personnel and employees (including contractors and volunteers) must receive training on the code. Training should cover each duty with practical examples, and emphasise that the duties apply outside ordinary working hours when engaged in eligible activities. Document completion.

Step 4: Establish complaints and incident management systems. The Act (section 15) requires these systems. The code’s attribution provisions reinforce them. These systems must be able to capture concerns from any source, allow prompt action, and provide records that demonstrate compliance with the duty to “raise and act on concerns.”

Step 5: Risk assessment and reasonable steps. For duties (f) and (g) (violence/exploitation/neglect/abuse and sexual misconduct), conduct a formal risk assessment. Identify vulnerabilities in service delivery and client interactions. Implement risk controls: staff screening (working with children checks, police checks), supervision ratios, reporting protocols, safe environments, and prohibition policies. Document all steps taken.

Step 6: Privacy and consent. Ensure policies address the collection, use, and disclosure of personal information of people with disability. Obtain informed consent where required. Train staff on respecting privacy in all interactions, including informal settings.

Step 7: Monitor and report. Regularly audit compliance. Appoint a compliance officer responsible for overseeing the code. The Department may require reports or conduct audits. Maintain records that show evidence of compliance.

Step 8: Review contractor arrangements. Since the code may attribute conduct of contractors to the funded entity, ensure contracts include obligations to comply with the code and pass on training requirements. Indemnity clauses may provide some protection but will not shield the entity from administrative sanctions.

Step 9: Prepare for enforcement. Understand the Department’s enforcement powers under the Act. If a breach is identified, the entity should self-report and demonstrate prompt corrective action, which may mitigate sanctions. Seek legal advice early if any potential breach arises.

Compliance is not static; the obligation to “take all reasonable steps” implies ongoing improvement. Providers should treat this code as a minimum standard and consider adopting best practice frameworks such as the National Standards for Disability Services.