Guide
Restrictive practice authorisation: what a register actually has to hold
There is no shortage of explanations of restrictive practice authorisation. Every consultancy in the sector has published one, and the Commission publishes an overview of the state and territory frameworks itself.
This is the other half, which nobody writes: given that the rules are what they are, what does the register you keep have to contain in order to answer for them?
Not legal advice, and deliberately not a state-by-state table of the rules — those change, one wrong row does more damage than the whole table does good, and the Commission's own overview of the Australian states' and territories' authorisation frameworks is the place to read them.
The fact everything else follows from
The NDIS Commission does not authorise restrictive practices. Authorisation is the responsibility of the state or territory, and it is the implementing provider's role to obtain it from the relevant state or territory body. When it has been obtained, evidence of the authorisation is uploaded to the Commission's portal under the schedule of restrictive practices.
Two consequences that practices routinely get wrong:
The specialist behaviour support provider does not obtain the authorisation. Writing the plan and authorising the practice are different jobs held by different parties. A practice that does both — writes plans and has staff implementing them — holds both, and needs to know which hat it is wearing for each participant.
A behaviour support plan is not an authorisation. A regulated restrictive practice being in a plan is a requirement, not a permission. The plan and the authorisation are two separate artefacts with two separate lifecycles, and a register that stores only the plan answers half the question.
One ambiguity worth knowing about
The Commission words the jurisdiction question in more than one way. In one place, authorisation comes from the state or territory body where the person with disability lives. In another, it is the responsibility of the state or territory in which the regulated restrictive practice is used.
Those are the same sentence for almost every participant, and a different sentence for a small number — someone living near a border, or receiving a support delivered in another jurisdiction. This is not a gap to resolve by picking whichever reading suits: it is a question for the authorising bodies involved, and a practice with a cross-border participant should ask rather than assume. It is flagged here because a register designed around only one of the two readings will not record the fact you later need.
Where the state has no process
This is the part most summaries leave out entirely.
Where a state or territory does not have an applicable authorisation process, the requirements under the NDIS Act and the Behaviour Support Rules still apply. The regulated restrictive practice must still be in a behaviour support plan, and the specialist behaviour support provider must still lodge that plan with the Commission — regardless of whether state or territory authorisation was required.
So "no authorisation needed here" never means "nothing to record". It means the record has a different shape, and a register with no way to express "authorisation: not applicable in this jurisdiction, and here is why" will show a blank that reads, to anyone auditing it, exactly like a missing authorisation.
What the register has to hold
Work backwards from the questions above and the fields fall out. For each regulated restrictive practice, for each participant:
- Which practice, in the Rules' own categories rather than in your words.
- Which participant, and which jurisdiction governs it — recorded explicitly, not inferred from an address field, because the inference is the thing the ambiguity above makes unsafe.
- The authorising body, by name. "Authorised" without a named authoriser is an assertion.
- Authorised from, and authorised until. The second date is the one that quietly passes.
- The conditions attached. Authorisations are commonly granted subject to conditions, and a condition nobody recorded is a condition nobody met.
- Where the evidence is, and confirmation it was uploaded to the Commission's portal.
- Which behaviour support plan it sits in, and that plan's own review date.
- Or: not applicable in this jurisdiction, as a positive state rather than an empty cell.
Why this is the hardest register to keep in a spreadsheet
Every other compliance record a practice keeps has one clock. A credential expires. A plan is reviewed. This one has four, and they run independently:
the authorisation's own expiry · the conditions attached to it · the plan's review date · and the participant's circumstances, which can change the practice being used at any time
A spreadsheet holds four dates perfectly well. What it cannot do is notice that the third one moved and the first one is now inconsistent with it, or that a practice was changed in the plan without anyone returning to the authorisation. Those are relationships between records, and a grid of cells has no way to express a relationship — only a person remembering to check both.
And the failure is asymmetric. A lapsed credential is a problem. An expired authorisation is a regulated restrictive practice being used without authorisation, which is a reportable incident, not a filing oversight — a different obligation, with a different clock, notified under the Incident Management and Reportable Incidents Rules 2018.
Where NDPRO fits, and where it does not
Interested party, so read this accordingly.
NDPRO's restrictive practice register holds the authorisation as a first-class record rather than a note attached to a plan: the jurisdiction, the authorising body, the dates, the conditions and the link to the plan it belongs to, with reminders before expiry rather than after. Because the authorisation is a record in its own right, changing the practice in a plan is visible against the authorisation that permitted the old one.
It does not generate the monthly restrictive practice return to the Commission, and it does not produce restrictive practice reduction plan reporting. Both are real gaps and both are worth knowing before a contract rather than during an audit. Nor does it authorise anything or tell you what your state requires — no software can, and one that implied otherwise would be selling you a judgement the authorising body makes.
Where to start
Take one participant with a regulated restrictive practice in place, and answer these without asking anyone: which practice, which jurisdiction, which body authorised it, under what conditions, until when, and where the evidence sits.
If any of those needs an email to find, the register is a list rather than a record — and you have found that out on a quiet afternoon instead of in front of an auditor.
Related: what Module 2A asks for, outcome by outcome · the interim BSP clock · keeping a PBS capability record current · practising as a sole trader.
Sources: NDIS Quality and Safeguards Commission — Rules for implementing providers and Rules for behaviour support and restrictive practices. Read 28/08/2026. The state and territory frameworks are published separately by the Commission and are revised; read those rather than any summary, including this one.