NDIS Restrictive Practices Guide: Rules for Providers

A registered NDIS provider can lawfully use a regulated restrictive practice only when three things line up. The practice must be written into a behaviour support plan lodged with the NDIS Quality and Safeguards Commission. It must be authorised under the process of the state or territory where the participant lives. And its use, including months when it is not used at all, must be reported to the Commission every month. If any one of those pieces is missing, the practice is unauthorised and becomes a reportable incident. 

That is where many providers come unstuck: a locked pantry nobody recognised as a restraint, an interim plan that quietly lapsed, a missed monthly report. The stakes have also risen. Recent amendments to the NDIS Act lifted maximum civil penalties for providers from $412,500 to more than $15 million where a participant is hurt or injured in their care. 

This guide sets out what NDIS restrictive practices compliance requires from the providers who deliver supports: the five regulated practices, who owns which obligation, the plan timeframes, authorisation in Western Australia, reporting, and the audit gaps we see most often. 

The Rules at a Glance 

These six obligations and deadlines form the backbone of restrictive practices compliance for any provider using regulated restrictive practices. 

The Commission measures these plan timeframes from the first use of a restrictive practice, so engaging a specialist cannot wait. Source: NDIS Commission, rules for implementing providers. 

Where the Obligations Come From 

Three layers apply at once. The NDIS (Restrictive Practices and Behaviour Support) Rules set the legal conditions for using regulated restrictive practices, developing plans and reporting. The NDIS Practice Standards make those conditions auditable: Module 2 covers specialist behaviour support providers, and Module 2A covers providers who implement plans. Authorisation sits with each state and territory, not the Commission. 

Using regulated restrictive practices without NDIS registration is itself a breach of the Rules. The Commission’s Senior Practitioner leads its behaviour support function, and responses to breaches range from education to enforcement and banning orders. 

The Five Regulated Restrictive Practices, and the Examples Providers Miss 

A restrictive practice is any practice or intervention that limits the rights or freedom of movement of a person with disability. Five types are regulated restrictive practices, and each is easier to trigger by accident than most teams expect.

1. Seclusion

Confining a person alone in a room or area they cannot leave, or believe they cannot leave. Choosing quiet time in their own room is not seclusion; telling someone to stay in their room until they calm down may be. 

2. Chemical restraint

Using medication primarily to influence behaviour or movement. Medication prescribed to treat a diagnosed mental disorder, physical illness, or physical condition is excluded, but PRN given “for agitation” with no clear treatment purpose needs close scrutiny. 

3. Physical restraint

Using physical force to prevent, restrict, or subdue movement in order to influence behaviour, such as holding someone’s hands to stop self-injury. Helping a person with daily tasks, like dressing, is not restraint. 

4. Mechanical restraint

Using a device to restrict movement in order to control behaviour. A lap belt fitted for postural support is therapeutic; the same belt used to stop someone leaving the table may be a restraint. 

5. Environmental restraint

Restricting free access to parts of the environment, items or activities. Locked fridges, pantries, cupboards and doors, and confiscated phones, are the examples we most often see go unrecognised. 

In shared homes, a restriction put in place for one resident can limit everyone else in the house. Identify that impact and address it, for example through keys or alternative access, rather than treating it as a side effect. 

Specialist Provider or Implementing Provider: Who Owns What 

Confusion between these two roles sits behind many compliance failures. 

A specialist behaviour support provider is registered for Module 2 and engages an NDIS behaviour support practitioner whom the Commission has assessed as suitable against the Positive Behaviour Support Capability Framework. The practitioner assesses the person, writes and lodges the plan, and records a schedule of its regulated restrictive practices. 

An implementing provider is any NDIS provider that delivers a behaviour support plan or uses a regulated restrictive practice. If regulated restrictive practices are involved, it must be registered, and it cannot write its own plan unless it is also a specialist provider. Its job is to engage the specialist, secure authorisation, activate the plan, train staff, keep records, report monthly and flag any change that calls for a review. 

Once the plan is lodged, almost every ongoing obligation rests with the implementing provider, not the practitioner. 

From First Use to Annual Review: The Plan Cycle Step by Step 

The NDIS behaviour support plan cycle runs in a set order, and skipping a step leaves everything after it on an unauthorised footing. 

a. A restrictive practice is used or identified. With no plan in place, the use is unauthorised and must be notified as a reportable incident, even while you wait for a practitioner. 

b. Engage a specialist. If the practice will be needed on an ongoing basis, engage a specialist behaviour support provider. The Commission keeps a register of suitable practitioners. 

c. Interim plan within 1 month. An interim behaviour support plan is a short, safety-focused document setting out the behaviours of concern, protocols to minimise harm, and if, when and how any restrictive practice may be used. 

d. Authorise, activate and lodge evidence. Once the plan is lodged, seek state or territory authorisation, activate the plan in the Commission’s portal and lodge the authorisation evidence. 

e. Comprehensive plan within 6 months. Built on a functional behaviour assessment, it explains why the behaviour occurs and sets out how each restrictive practice will be reduced and eliminated. 

f. Train the people who deliver it. Workers need training on this person’s strategies, not just a generic behaviour module. 

g. Review at least every 12 months. Count from the plan’s start date, and review sooner when circumstances change. 

A change of practitioner within the same specialist provider does not reset these timeframes. A new specialist provider, however, takes them on from its own engagement date, according to the Commission’s position statement on the plan workflow. 

How Restrictive Practice Authorisation Works in Western Australia 

Restrictive practice authorisation comes from the state or territory where the participant lives, not from the NDIS Commission. The implementing provider obtains it, then lodges the evidence with the Commission. 

Western Australia still relies on policy rather than legislation: the Department of Communities’ Authorisation of Restrictive Practices in Funded Disability Services Policy, although the Department reports significant progress towards new laws. Authorisation runs through a Quality Assurance Panel, which the Department describes as mandatory, and providers can book an independent external behaviour support practitioner for the panel from the Department’s register. 

The policy also lists prohibited practices that must never be used. They include prone or supine restraint, pin-downs, basket holds, takedowns, any restraint that restricts breathing or relies on pain, and punitive approaches such as aversive practices, overcorrection and denial of key needs. No plan, panel or consent form makes these acceptable. 

Supporting participants in more than one state? Map each jurisdiction’s process separately, and never assume an authorisation follows a participant interstate. 

What Must Be Reported, When and Where 

Reporting restrictive practices to the Commission runs on two separate tracks, and mixing them up is a frequent audit finding. 

Monthly reports can be lodged against active, expired or partially active plans, but not closed ones. A practice missing from the plan’s schedule cannot be reported monthly, so ask the practitioner to correct the schedule and notify each use as unauthorised in the meantime. Portal arrangements have also changed recently, so confirm where each task now sits before your next reporting cycle. 

Both tracks should draw on the same records so patterns surface early. A clear NDIS incident management process gives staff one path for escalating anything that looks like a restriction. Source: NDIS Commission, reportable incidents. 

Behaviour Support Audit Gaps We See Most Often 

Module 2A auditors test whether the plan on paper matches what happens on shift. These are the gaps that most often become non-conformities.

• Out-of-date plans on site. Staff work from a printed interim plan while a newer comprehensive plan sits in the portal. 

• Practices missing from the schedule. A locked door or new PRN order appears in shift notes but not in the plan, which makes every use unauthorised. 

• Authorisation that does not match the plan. The panel approved four practices; the plan lists five. Auditors compare the two line by line. 

• Nil months left unreported. A monthly report is expected even when no practice was used. 

• Consent mistaken for authorisation. A signed family consent form does not, on its own, authorise a practice. 

• Thin shift notes. Without time, duration, trigger, and response, monthly figures cannot be verified. 

• Generic training only. Workers hold a general behaviour certificate but have never been trained on this person’s plan, a gap a well-designed staff training matrix exposes. 

• No feedback loop. New risks or household changes never reach the practitioner, so the plan is not reviewed when it should be. 

Tailored NDIS policies and procedures that name who activates plans, lodges monthly reports, and briefs the practitioner close several of these gaps at once. A Practice Standards self-assessment tests your systems before an auditor does. If findings have already been raised, our guide to writing a corrective action plan that gets accepted covers the next step. 

Reducing and Eliminating Restrictive Practices 

Compliance is the floor, not the goal. Every regulated restrictive practice must be a last resort, the least restrictive option, proportionate to the risk and used for the shortest possible time. The comprehensive plan must also show how each practice will be reduced and eventually removed. 

Day to day, that means predictable routines, communication supports the person can actually use, meaningful activity, and environments adjusted so triggers no longer arise. Review restrictive practice data with the practitioner rather than simply filing it, and raise any practice that is no longer needed so the plan can be reviewed. 

Frontline confidence matters most. Our Understanding Challenging Behaviours course grounds support workers in de-escalation and positive behaviour support, a natural partner to person-specific plan training. 

How Angels Compliance Can Help 

Angels Compliance and Training Services helps NDIS providers in Perth and across Australia build behaviour support systems that hold up under audit. Our behaviour support and restrictive practices training prepares clinical managers, team leaders and practitioners to implement plans ethically and confidently, aligned with Module 2A. 

We can also review your documentation against the Rules and provide NDIS audit compliance support in the lead-up to your next assessment. Call 1800 241 164 or contact our team to talk through your service.