National Disability Insurance Scheme (Protection and Disclosure of Information) Rules 2013

The Rules work through a handful of repeatable concepts that structure decision-making by the Agency and by persons subject to the Act. Understanding these concepts is necessary to apply the Rules in operation.

NDIS information: The Rules use the defined term NDIS information to mean information acquired by a person in the performance of functions or duties or in the exercise of powers under the Act (paragraph 4.1). The term is central because the CEO’s disclosure powers in Part 4 and Part 5 attach specifically to NDIS information.

Compulsion and exceptions: The Rules set a default rule of compulsion, that requirements under the Act to give information, produce documents or give evidence generally are not affected by State or Territory laws (paragraph 3.2). The controlling exception is twofold: the person must be prevented from complying by State or Territory law, and that law must be one of the statutes or statutory provisions listed in paragraph 3.3(b). The list is presented by jurisdiction and is made explicit.

Public interest certificate: The public interest certificate is the mechanism by which the CEO may lawfully disclose NDIS information otherwise restricted by the Act, summarised in paragraph 4.1. Part 4 provides guidance on when the CEO may issue such a certificate, including threshold criteria in paragraph 4.3: the information cannot reasonably be obtained elsewhere, and the recipient must have sufficient interest in it. Paragraph 4.4 elaborates sufficient interest, allowing either a finding of a genuine and legitimate interest or that the recipient is a Commonwealth, State or Territory Minister.

Categories of disclosure: Part 4 lists categories where, subject to the general criteria, disclosures are likely to be appropriate. These are: enforcement of laws and protection of public revenue or property (paragraph 4.6), correction of mistakes of fact where NDIS integrity or published matters are implicated (paragraph 4.7), ministerial briefing to allow Ministers to respond to complaints or public statements (paragraph 4.8), locating missing or deceased persons and assisting coronial or estate administration enquiries (paragraph 4.9), and assisting child welfare agencies with safety or wellbeing responsibilities (paragraphs 4.10-4.11).

Inter-jurisdictional carve-outs: The Rules provide a concrete list of State and Territory statutes and specific sections that, if they would prevent disclosure, operate to excuse the person from complying with the Agency’s requirement (paragraph 3.3(b)). The list is jurisdiction-by-jurisdiction and includes statutory areas such as child protection, health records, witness protection, integrity commissions, police oversight and records acts. The list is not static, the Rules flag that the Minister may amend it (Note after list).

Recordkeeping and traceability: When the CEO discloses NDIS information to a Secretary, chief executive or head of an authority for the purposes of that Department or authority, the CEO must make a contemporaneous record of the information disclosed, the recipient, and the purpose for which it was disclosed or requested (paragraph 5.5). This creates a mandatory trail for those forms of disclosure.

Limits and non-operative text: The Rules contain boxed notes that summarise provisions of the Act and are explicitly non-operative (paragraph 6.2). The Rules also adopt existing defined terms from the Act unless they display a contrary intention (paragraph 6.3), which means definitions and interpretive rules from the Acts Interpretation Act 1901 and the Legislative Instruments Act 2003 apply.

The Rules allocate responsibilities and create disclosure possibilities that affect distinct groups. The effects are concrete and procedural.

Primary subjects required to provide information: Participants and prospective participants are explicitly given as examples of persons who may be required to give information, produce documents or give evidence to the Agency (paragraph 3.1). The general compulsion in paragraph 3.2 means such persons face an obligation to comply with requirements under the Act unless a listed State or Territory law prevents compliance (paragraph 3.3).

The Agency and its CEO: The CEO is the central decision-maker for permitted disclosures of NDIS information. Part 4 addresses when the CEO may issue a public interest certificate to allow disclosure, and Part 5 addresses disclosure to Secretaries and heads. The CEO must apply the criteria in paragraph 4.3 before issuing a certificate, and must make records when disclosing to departmental heads under paragraph 5.5.

Commonwealth, State and Territory Departments and authorities: They are potential recipients of disclosures. Part 5 allows disclosures to Secretaries and State or Territory chief executives or heads of authorities for the purposes of the recipient Department or authority (paragraph 5.1). Paragraph 4.4(b) identifies Ministers as persons who automatically satisfy the “sufficient interest” criterion.

Child welfare agencies and coronial and investigatory bodies: The Rules explicitly recognise child welfare agencies as recipients where disclosure is necessary to assist contact with relatives or to protect a child’s safety welfare and wellbeing (paragraphs 4.10 to 4.11). Paragraph 4.9 permits disclosures to assist courts, coronial enquiries, royal commissions or inquiries and authorities responsible for administering disability schemes in other countries, in cases concerning missing or deceased persons.

Persons and entities whose State or Territory law protects information: The long list in paragraph 3.3(b) identifies multiple State and Territory statutes that may prevent disclosure. Where a person would be prevented from giving information by one of these listed laws, that person is not required to comply with the Agency’s requirement. That affects employees of health services, police, integrity commissions, schools, child protection agencies and other bodies covered by the listed statutes.

Individuals whose privacy is at stake: The Rules state as part of their purpose that they are about safeguarding the privacy of people whose information is held by the Agency (paragraph 1.1). Individuals, including participants, prospective participants, relatives and beneficiaries of missing or deceased persons, have privacy interests that the Rules require the CEO to weigh against public interest considerations and the statutory criteria for disclosure.

Legal advisors, service providers and records managers: The practical work of complying with disclosure requests and recordkeeping will fall to Agency staff, legal teams and records managers. Paragraph 5.5’s record obligation imposes an administrative duty on the Agency to document disclosures to other Departments and authorities, while paragraph 6.4’s adoption of definitions affects how penalty units and terms are to be interpreted in procedural contexts.

Ministers and political offices: Ministers are explicitly included as persons with sufficient interest under paragraph 4.4(b), and Part 4 includes a discrete category for ministerial briefing (paragraph 4.8). That creates a channel through which the Agency may share information to enable Ministerial responses to complaints or public statements.

The Rules allocate a mixture of duties on the Agency and its CEO, and rights or protections for persons whose information is sought. These are primarily procedural obligations and discretionary powers rather than normative rights with standalone remedies.

Duties to provide information and the exceptions: The Rules summarise the Act’s compulsion to provide information to the Agency (paragraph 3.2). The corresponding duty on individuals is subject to a defined exception: a person is not required to give information or produce a document if compliance would be prevented by a State or Territory law listed at paragraph 3.3(b) and the person would be prevented from doing so under that law (paragraph 3.3). Paragraph 3.4 also protects persons from having to produce information if doing so would contravene a Commonwealth law. Those provisions define the scope of a person’s duty and identify the concrete legal grounds for refusing to comply.

CEO’s certification power and preconditions: The CEO is empowered to issue a public interest certificate permitting disclosure of NDIS information, under the Act and summarised in paragraph 4.1. Part 4 imposes guidance in the form of two threshold conditions the CEO should apply: the information cannot reasonably be obtained from other sources and the recipient has sufficient interest (paragraph 4.3). Paragraph 4.4 sets out what will, in the CEO’s view, constitute sufficient interest: either a satisfaction that the person has a genuine and legitimate interest in the information in relation to the purpose of the disclosure, or that the person is a Commonwealth, State or Territory Minister.

Recordkeeping duty when disclosing to heads: Paragraph 5.5 imposes a clear recordkeeping duty on the CEO where NDIS information is disclosed to a Secretary, chief executive or head of an authority for the purposes of that Department or authority. The CEO must record the information disclosed, the recipient, and when relevant the purpose requested or, if disclosed on the CEO’s initiative, the purpose for disclosure. This duty creates an auditable trail for those categories of disclosure.

Scope of permissible disclosure categories: The Rules identify categories where a public interest certificate may be appropriate. Paragraph 4.6 indicates disclosure may be necessary for enforcement of criminal laws, enforcement of laws imposing pecuniary penalties, or to prevent acts adversely affecting the public revenue, and where the disclosure relates to offences against officers, property, or premises of the Agency. Paragraph 4.7 permits disclosure to correct mistakes of fact where the integrity of the NDIS is at risk or where the matter was published. Paragraphs 4.8, 4.9 and 4.10 to 4.11 list ministerial briefing, missing/deceased persons and support to child welfare agencies respectively. These are not framed as exhaustive, and paragraph 4.2 expressly states the Rules are not intended to limit the CEO’s capacity to give a public interest certificate.

Privacy and dignity principles: The Rules open by identifying two principles from the Act relevant to them: respect for worth and dignity and that people with disability should have their privacy and dignity respected (paragraph 1.3(a)-(b)). Those principles signal the intended balancing exercise the CEO should undertake when considering disclosures, although the Rules do not translate these principles into separate enforceable rights within the instrument.

Non-operative summaries and interpretive constraints: Paragraph 6.2 emphasises that boxed notes summarising the Act do not form operative law. Paragraph 6.3 establishes that terms used in the Act have the same meaning in these Rules unless a contrary intention appears, and paragraph 6.4 reproduces several key definitions including the definitions of the Agency, CEO, NDIS, participant and the meaning of criminal law. Those interpretive clarifications affect how duties and rights are read across the Act and these Rules.

The Rules are procedural rather than penal, and they leave enforcement design primarily to the Act and to other laws. Nevertheless the instrument interacts with enforcement in specific ways.

No new offences created in the Rules: The Rules themselves do not create new criminal offences, nor do they set penalty amounts. The only textual reference to penalties is in paragraph 6.4, which adopts the definition of “penalty unit” as in section 4AA of the Crimes Act 1914. The Rules therefore rely on the parent Act and other statutes for any enforcement or criminal consequences arising from failure to comply with information requirements.

Statutory enforcement as a justification for disclosure: Part 4 specifically recognises enforcement of laws as a ground for disclosure. Paragraph 4.6(a) allows disclosure where necessary for enforcement of a criminal law, enforcement of a law imposing a pecuniary penalty, or to prevent acts that may significantly adversely affect the public revenue. Paragraph 4.6(b) extends to offences against Commonwealth, State or Territory officers, property and premises occupied by the Agency. Those categories show the Rules anticipate disclosures that assist law enforcement and financial-protection functions of government.

Recordkeeping as an enforcement-facing measure: Paragraph 5.5 imposes a duty on the CEO to make records of disclosures to Secretaries, chief executives or heads of authorities. That recordkeeping supports oversight, audit and any subsequent enforcement or review processes by creating documentary evidence of what was disclosed and the purpose. The Rules thereby enable tracing of disclosure decisions which is relevant should enforcement or accountability action follow.

Interplay with other laws that carry penalties: Paragraph 3.4 protects a person from compliance where giving information would contravene a Commonwealth law. That provision interacts with other federal statutes that impose penalties for unauthorised disclosure or for contravening confidentiality protections. The Rules do not list those statutes, but the protective mechanism is explicit and procedural.

Discretion and potential external review: The Rules give the CEO discretionary power to issue public interest certificates (paragraph 4.1, summarising para 66(1)(a) of the Act) and to disclose on request or initiative to departmental heads (paragraph 5.3 to 5.4). The Rules do not themselves prescribe administrative review processes or external oversight mechanisms for those discretionary decisions. Paragraph 4.2 explicitly states that the Part sets out guidance and is not intended to limit the CEO’s ability to issue a certificate, meaning there is scope for broad administrative discretion. The Rules do not deal with consequences for misuses of that discretion.

Ministerial amendability of the State/Territory list: The compilation includes a Note that the list of prescribed laws in paragraph 3.3(b) is subject to ongoing review and the Minister may amend the Rules to alter the list. That capacity to amend the list affects enforcement dynamics because it can expand or contract the circumstances in which persons can rely on a State or Territory law to refuse to comply.

The Rules are expressly ancillary to the Act and to State, Territory and Commonwealth laws. The instrument sets out specific cross-jurisdictional interactions.

Summarising core Act provisions: Several boxed notes in the Rules state they summarise provisions of the Act. Paragraph 3.2 summarises subsection 58(1) of the Act on the effect of State or Territory laws on compulsion to provide information. Paragraph 3.3(a) summarises paragraph 58(2)(a) of the Act. Paragraphs 4.1 and 5.1 summarise ss 62, 65, 66 and subparagraphs 66(1)(b)(i) and (v) of the Act. Paragraph 3.4 summarises section 59 of the Act which deals with Commonwealth law constraints. Paragraph 6.3 further states that terms used in the Act have the same meaning in the Rules unless a contrary intention is displayed. Those explicit cross-references anchor the Rules as interpretive guidance for applying the Act alongside other laws.

Concrete State and Territory carve-outs: The clearest statutory interaction is the list in paragraph 3.3(b). That list names specific State and Territory Acts and sections which, if they would prevent a person from giving information or producing documents, operate to relieve the person from complying with an Agency requirement. The list spans areas such as witness protection, health records, child protection, integrity commission provisions, police oversight, electoral secrecy, and records acts. Where a listed State provision operates to prevent disclosure, the Act’s requirement is displaced in that specific circumstance.

Commonwealth law primacy: Paragraph 3.4 summarises section 59 of the Act, stating that a person is not required to give information or produce a document under Part 1 of Chapter 4 of the Act to the extent that doing so would contravene a Commonwealth law. That gives primacy to Commonwealth statutory confidentiality or prohibition provisions over the Agency’s information-gathering powers where the two conflict.

Interface with law enforcement and revenue protection statutes: Part 4 identifies enforcement of criminal laws, enforcement of laws imposing pecuniary penalties and protection of public revenue as valid purposes for disclosure (paragraph 4.6). That positions NDIS information as potentially relevant to investigations under criminal codes, revenue laws, confiscation regimes or other enforcement statutes in both Commonwealth and State/Territory jurisdictions.

Overlap with child protection and coronial systems: Parts 4.9 and 4.10 to 4.11 expressly provide for disclosures to assist coronial enquiries, royal commissions, commissions of inquiry and child welfare agencies. Those cross-jurisdictional interactions mean Agency-held information can be mobilised to feed into child protection processes and into coronial or inquiry functions.

Ministerial and departmental information flows: Part 5 formalises the pathway for the Agency to provide information to Secretaries, chief executives and heads of authorities for departmental purposes. That both facilitates inter-agency exchange and requires the CEO to document those transfers (paragraph 5.5), creating an administrative interface between Agency records and other public sector information systems.

Interpretive interaction with Acts Interpretation and Legislative Instruments Acts: Paragraph 6.3 directs that definitions from the Act have the same meaning in these Rules unless there is a contrary intention, and that the Acts Interpretation Act 1901 and the Legislative Instruments Act 2003 provide definitions and interpretive rules. That treats the Rules as subordinate instruments that must be read within the established interpretive framework for Commonwealth legislation.

Ministerial power to amend the State/Territory list: The compilation Note flags that the Minister may amend the list of State and Territory laws in paragraph 3.3(b). That creates an interaction with the statutory instrument-making process and with other jurisdictions, because changes to the list alter the legal interplay between the Agency’s compulsion and State/Territory confidentiality protections.

The compilation provides a discrete amendment timeline and marks where the textual changes in the Rules have occurred up to 11 November 2016.

Compilations and amendment instruments: The front matter identifies that this is Compilation No. 3, compilation start date 11 November 2016 and that the compilation includes amendments up to the National Disability Insurance Scheme (Protection and Disclosure of Information) Amendment Rules 2016 (the compilation was prepared on 15 November 2016). The Table of Instruments shown lists the original Rules and three amendment instruments: Amendment Rules 2014, Amendment (No. 2) Rules 2014 and Amendment Rules 2016, with FRLI registration numbers F2014L00903, F2015L00017 and F2016L01733 respectively. Commencement dates for the instruments are noted as 14 June 2013 for the original Rules, 1 July 2014 for the 2014 amendments, 8 January 2015 for the 2015 instrument and 11 November 2016 for the 2016 instrument.

How the Rules were amended: The Table of Amendments in the compilation identifies that subparagraph 3.3(b) was amended in each of the listed instruments: F2014L00903, F2015L00017 and F2016L01733. That indicates the principal substantive change recorded in the compilation history is to the list of State and Territory laws in paragraph 3.3(b). The amendment entries are marked “am”, which in the document’s legend means “amended or amended/inserted”. Thus the historical record shows iterative changes to the prescribed list of laws whose effect is to modify the situations in which State or Territory laws can prevent disclosure to the Agency.

Notes about uncommenced amendments and application: The compilation front matter cautions that the effect of uncommenced amendments is not reflected in the compiled text but that the text of the amendments is included in the endnotes. It also notes that if the operation of a provision or amendment is affected by an application, saving, or transitional provision that is not included in the compilation, details will be included in the endnotes. Those procedural remarks mean that the version in this compilation reflects the legislative state as at 11 November 2016 and that users should consult the endnotes and subsequent compilations for later changes.

Ministerial ability to change the list: The compilation includes a Note after the State/Territory list pointing out that the list is subject to ongoing review and the Minister may amend these Rules to alter the list. That is a structural feature of the amendment history and is also relevant for compliance planning because the statutory landscape for what State or Territory laws operate as exceptions may change through delegated rule-making.

Practical implication of amendment focus: The amendment history demonstrates that the primary locus of change since the Rules’ inception has been the identified State and Territory provisions in paragraph 3.3(b). This is consistent with the policy aim to reconcile the Agency’s information compulsion with existing confidentiality or privilege regimes across jurisdictions, and the iterative amendments indicate active maintenance of that list rather than wholesale rewrites of the CEO disclosure powers or the overarching procedural framework.

The compilation does not record or reference judicial decisions. The Rules themselves contain no citations to case law and contain no express section on litigation outcomes or precedent.

No cases mentioned in the instrument: The text of the Rules is silent about litigation. There are no case names, authorities or examples of judicial interpretation set out in the Rules or the compilation notes. The instrument therefore does not provide a litigation history and does not claim to settle any point that would otherwise be subject to judicial review.

Administrative decision-making may be subject to review: Although the Rules provide guidance on the CEO’s discretionary power to give public interest certificates (paragraphs 4.1 to 4.5) and on recordkeeping obligations when disclosing to departmental heads (paragraph 5.5), the Rules do not specify administrative review mechanisms, merits review avenues or judicial review pathways. In practice, discretionary decisions by public officials can be challengeable through administrative law avenues under the Administrative Decisions (Judicial Review) Act 1977 or by application for judicial review, but the Rules themselves do not discuss or modify review rights.

Recordkeeping that may feed into litigation: Paragraph 5.5 requires the CEO to make a record of certain disclosures. Those records would form the evidentiary basis in any subsequent legal challenge or review concerning whether disclosure was authorised and whether the CEO applied the threshold criteria set out in paragraph 4.3. The Rules therefore create an administrative trail that could be relevant to legal proceedings, although the Rules do not discuss admissibility or litigation practice.

No reported cases or challenges included: The compilation’s endnotes and tables of amendments document legislative changes but do not include or cite any litigation arising from the operation of these Rules. Users seeking litigation history will need to search judicial databases, administrative law reports and subsequent commentary because the Rules’ compilation does not provide case law.

Practical implication for practitioners: The absence of litigation in the compilation does not mean decisions under the Rules are immune from challenge. The CEO’s discretionary power to issue public interest certificates, the assessment of “sufficient interest” and the determination that information cannot be reasonably obtained elsewhere are all fact-sensitive exercises that could be amenable to judicial scrutiny. The Rules, however, provide guidance rather than legally binding thresholds beyond the text of the Act, and the compilation does not provide examples of contested applications.

A number of practical traps and sources of uncertainty arise from the Rules’ design and drafting. These are matters that practitioners should watch for because they affect compliance, disclosure risk and administrative practice.

The long, jurisdiction-specific list matters in practice: Paragraph 3.3(b) lists many State and Territory statutory provisions that can prevent a person from being required to provide information to the Agency. The list is granular and varies by jurisdiction, covering laws ranging from witness protection to health records, child protection to integrity commission statutes. A failure to check whether a given State or Territory restriction applies could lead to improper compulsion or a mistaken claim of exemption.

Ministerial amendment and ongoing review: The compilation expressly states that the list in paragraph 3.3(b) is subject to ongoing review and that the Minister may amend the Rules to alter the list. That creates regulatory uncertainty because the set of protections that excuse non-compliance can change by instrument without primary legislation. Organisations and practitioners must monitor amendments to ensure their reliance on a particular State provision remains valid.

Boxed summaries are non-operative: Paragraph 6.2 emphasises that boxed text summarising the Act is not part of the operative rules. A reader may misread the boxed summaries as legally operative text, but only the Rules’ numbered paragraphs are operative. Practitioners should cross-check with the Act when in doubt.

“Cannot reasonably be obtained from another source” is indeterminate: Paragraph 4.3(a) requires the CEO to be satisfied that the information cannot reasonably be obtained elsewhere before issuing a public interest certificate. The Rules do not define the meaning of “reasonably” nor prescribe the steps required to demonstrate due diligence in seeking other sources. That vagueness can cause contested administrative decisions because it leaves the scope of the CEO’s inquiry and the standard of proof unspecified.

“Sufficient interest” is subjective: Paragraph 4.4 gives the CEO latitude to decide whether a person has a genuine and legitimate interest in the information for the purpose of disclosure. The only unambiguous category is Ministers, who satisfy paragraph 4.4(b). For other recipients, the CEO’s subjective satisfaction controls, creating a potential source of dispute if a requester believes they have an interest but the CEO does not.

Public interest categories are illustrative not exhaustive: Paragraph 4.2 expressly states the Part is not intended to limit the circumstances in which a public interest certificate may be given. Paragraphs 4.6 to 4.11 therefore provide examples rather than binding checklists. That flexibility benefits the Agency but increases uncertainty for requesters and subjects of disclosures about whether a particular fact pattern will be captured.

Recordkeeping obligation scope: Paragraph 5.5 obliges the CEO to make a record when disclosing to a Secretary, chief executive or head of an authority. There is no parallel express obligation in these Rules for records regarding public interest certificates issued to persons other than those heads, although paragraph 4.3 implies a need for considered decision-making. The limited express record duty may create gaps in traceability outside the Part 5 disclosure context.

Commonwealth law trumping the Act: Paragraph 3.4 summarises section 59 of the Act and states that a person is not required to comply to the extent doing so would contravene a Commonwealth law. Practically, persons and their advisers must check for Commonwealth statutory prohibitions on disclosure that could override both the Agency’s compulsion and State exemptions, a non-trivial task given the breadth of Commonwealth regulatory regimes.

No penalties in the Rules, but penalties may arise elsewhere: The Rules adopt the definition of penalty unit in paragraph 6.4 but do not set penalty provisions. Users may mistakenly assume the Rules impose penalties. Any penalty exposure must be traced to the Act or other statutes, not to the Rules themselves.

Potential tension with privacy and dignity principles: Paragraph 1.1 identifies safeguarding privacy as the Rules’ aim and paragraph 1.3 cites Act principles about respect and privacy. However, the CEO’s discretion to disclose in the public interest and the broad categories in Part 4 create situations where privacy may be overridden. Practitioners should not assume an automatic privacy veto; the Rules require a balancing exercise.

Geographic mismatch and cross-border disclosure: Paragraph 4.9(iii) contemplates disclosure to authorities responsible for administering disability support schemes in other countries. Cross-border disclosures raise data protection, legal assistance and evidentiary complexities that the Rules do not unpack, which can be a practical pitfall if international legal requirements are overlooked.

The Rules set out a framework for decision-making. Compliance requires both procedural steps and substantive judgement: check legal conflicts, document decisions, and apply the prescribed CEO criteria.

When asked to provide information to the Agency: First, identify whether the request arises under Part 1 of Chapter 4 of the Act as described in paragraph 3.1. Second, check whether any State or Territory law prevents the person from complying and whether that law appears in the list in paragraph 3.3(b). If a listed State or Territory provision prevents compliance, the person is not required to give the information or produce the document (paragraph 3.3). Third, check for any applicable Commonwealth law that would be contravened by compliance; paragraph 3.4 protects against being required to contravene Commonwealth laws.

For Agency staff and the CEO considering a public interest certificate: Apply the threshold criteria in paragraph 4.3. Establish and record that the NDIS information cannot reasonably be obtained from another source, which will ordinarily require documenting efforts to obtain the information from other channels. Second, assess whether the recipient has sufficient interest as defined in paragraph 4.4: either document a genuine and legitimate interest analysis or note that the recipient is a Minister, which satisfies the criterion without further inquiry. When the matter fits one of the categories in paragraphs 4.6 to 4.11, note the category and how the facts meet the category’s elements, but remember the categories are illustrative rather than exhaustive.

Recordkeeping and documentation: Where disclosure is to a Secretary, chief executive or head of an authority for departmental purposes, comply with paragraph 5.5 by making and retaining a record of the information disclosed, the recipient, and the purpose. Although paragraph 5.5 is explicitly for such disclosures, practitioners should as a matter of good practice document public interest certificates and internal approvals for other disclosure pathways too, because paragraph 4.3’s threshold inquiries are discretionary and may be subject to scrutiny.

Engage legal counsel when state law issues arise: Given the granularity of paragraph 3.3(b)’s list and the Minister’s power to amend it, seek legal advice if there is uncertainty whether a State or Territory law prevents disclosure. The person claiming the protection should have a documented legal basis pointing to the exact provision in the relevant State or Territory statute.

Child welfare, missing persons and coronial disclosures: When disclosures are contemplated under paragraphs 4.9 to 4.11, ensure the conditions in those paragraphs are satisfied: for missing or deceased persons, confirm there is no reasonable ground to believe the person would object to disclosure and that the disclosure is necessary for locating the person, assisting inquiries, or estate administration (paragraph 4.9); for child welfare, confirm the necessity to assist contact or carry out child safety responsibilities (paragraph 4.10).

Train staff on the non-operative summaries and definitions: Paragraph 6.2 notes boxed summaries do not form operative law, and paragraph 6.3 imports definitions from the Act. Train staff to cross-reference the Act where legal precision is required and to treat the Rules as guidance rather than as standalone statutory text.

Monitor amendments to the State/Territory list: Because the Note after paragraph 3.3(b) advises that the list is subject to ongoing review and Ministerial amendment, implement a process to monitor Federal Register of Legislative Instruments entries and the Agency’s updates so that compliance practices reflect the current list.

Adopt proportional disclosure policies: Document a policy that sets out when information may be disclosed on the basis of public interest certificates, how minimal necessary disclosure standards are applied, and how the CEO’s threshold tests are recorded. The Rules require the CEO to be satisfied about reasonable alternative sources and sufficient interest, which practical policy can operationalise.

Prepare for inter-agency requests: Where the CEO receives requests from Secretaries, chief executives or heads of authorities, ensure requesters specify the purposes of their Departments or authorities, because paragraph 5.3 allows disclosure if the Secretary, chief executive or head requests the information for one or more purposes of the Department or authority described in the request. Record the request and the purpose as required by paragraph 5.5.

Be cautious about cross-border transfers: If disclosing to foreign disability scheme authorities per paragraph 4.9(ii), check any applicable domestic laws that might restrict cross-border disclosure, including Commonwealth statutes that might be contravened and therefore prevent compliance under paragraph 3.4.

Maintain an audit trail beyond minimum requirements: Although the Rules expressly require records only for Part 5 disclosures, create and maintain an internal register of all public interest certificates, the assessments undertaken to satisfy paragraph 4.3, consultations with legal advisors, and any communications with the person whose information is being disclosed. This approach reduces administrative risk and supports defensibility of decisions.