NDIS provider record keeping: the 7-year rule and what auditors actually check

Record keeping has always mattered for NDIS providers, but since 27 August 2026 it's a harder-edged legal obligation, and the retention period is longer than most other record-keeping rules Australian small businesses deal with. Here's what the 7-year rule actually covers, what it means at audit time, and how to stop it being a scramble every time the NDIA asks.

What the 7-year rule covers

Under section 73Q of the NDIS Act, the NDIA's guidance sets a 7-year retention period covering incident records, reportable incident records, complaint records and worker screening records. In practice, most providers apply the same standard to the broader set of records tied to a claim - invoices, service agreements, progress notes and evidence a support was actually delivered - since it's the same evidence an audit or a repayment dispute would ask for.

The clock runs from when the record was created or the service was last provided, so it's a rolling obligation, not a fixed cutoff - you're always holding roughly the last 7 years of activity, not just records from a single date onward.

The under-18 exception catches people out

If a participant was under 18 when you delivered the support, the 7-year clock doesn't apply on its own - you need to keep those records until they turn 25, if that's later than the 7-year mark. Support a 10-year-old and you're looking at roughly 15 years of retention for those records, not 7. If you work with younger participants at all, it's worth flagging those records separately so they don't get cleared out on a standard 7-year cycle.

If you stop being a registered provider

The obligation doesn't end the moment you deregister. Per the NDIA's guidance, a person who has ceased to be a registered provider still has to retain the records they were required to keep under s 73Q, for 3 years from the day they ceased. Winding up a provider entity doesn't clear the retention duty with it.

What an audit actually checks

An audit or a claim review comes down to one question: can you show the support was actually delivered, to the person claimed, for the amount claimed? That means the invoice or claim lining up with a service agreement, a progress or shift note showing the support happened, and dates and amounts that are internally consistent. Gaps here are what turn into repayment requests - not necessarily because anything went wrong, but because the paper trail can't prove it didn't.

Staying ahead of it without a compliance team

For a small or growing agency, the practical fix is making record keeping a by-product of the work you're already doing, rather than a separate admin task. Every shift note, invoice and service agreement generated through your day-to-day platform should already be timestamped, tied to the right participant, and retained without anyone having to remember to file it. That's exactly how Juste handles it: append-only shift notes, invoices tied to service agreements, and nothing quietly deleted - so if the NDIA ever asks, you're not reconstructing 7 years of history from memory.

This article is general information dated 6 September 2026, not legal advice. Verify current requirements at ndis.gov.au. Juste is operated by Leah Justyce Art Gallery ABN 73 658 665 321.