Front matter and glossary

Disclaimer

This Guideline is not a stand-alone document and does not contain the entirety of Provider obligations. It must be read in conjunction with the employment services Deed(s) relevant to your organisation (the Deed), including any relevant Guidelines and reference material issued by the Department of Employment and Workplace Relations under or in connection with the Deed(s).

This Guideline is not legal advice and the Commonwealth accepts no liability for any action purportedly taken in reliance upon it and assumes no responsibility for the delivery of the Services. This Guideline does not reduce the obligation of Providers to comply with their relevant legal obligations and, to the extent that this Guideline is inconsistent with obligations under the Privacy Act, Social Security Law, the WHS Laws or any other legislation or laws relevant to the respective jurisdictions in which Providers operate, the relevant legislation or laws will prevail.

Version History

Version 1.16 Published on: 3 June 2026 Effective from: 1 July 2026

In this version of the Guideline, the Privacy Chapter has been updated.

A full version history of this Guideline can be found on the relevant Archived Guidelines page on the Provider Portalsign-in required (sign-in required) for each program.

Contents

Guideline Interpretation and Glossary 3

Chapter 1. Operational Requirements 5

Chapter 2. Records Management Instructions 13

Chapter 3. Privacy 23

Chapter 4. External Systems Assurance Framework (ESAF) 38

Chapter 5. Servicing Participants with Challenging Behaviours 56

Guideline Interpretation and Glossary

Reading Notes

In this Guideline, ‘must’ means that compliance is mandatory and ‘should’ means that compliance represents best practice for Providers and is expected by the Department.

While reading this document, please note the following Icons and their meaning:

• System step — This icon represents 'System Steps' – information contained under this dot point will relate to usage of the Department’s IT Systems.

• Work health and safety — This icon represents 'Work, Health and Safety Steps' – information contained under this dot point will relate to matters of work, health and safety.

• Documentary evidence — This icon represents 'Documentary Evidence' – information contained under this dot point will relate to matters of Documentary Evidence.

Glossary

All capitalised terms in this Guideline have the same meaning as in the Deed unless otherwise defined below.

'Archives Act' means the Archives Act 1983 (Cth).

'APP entity' has the same meaning as in section 6 of the Privacy Act.

'Deed' means any Deed or contract administered by the Department that refers to this Guideline.

'FOI Act' means the Freedom of Information Act 1982 (Cth).

'Employment Services Assessment' or 'ESAt' means an assessment of a Participant's barriers to employment and work capacity conducted by Services Australia.

'Inactive Records' are Records created under previous contractual arrangements with the Department.

'Incident Report' means a written account of an incident involving challenging behaviour that is recorded on the Department’s IT Systems.

'Job Capacity Assessment' or 'JCA' means an assessment conducted by Services Australia to determine eligibility for the Disability Support Pension and includes assessment of barriers to employment and work capacity.

'Job Seeker Snapshot' means a questionnaire completed by a Participant, Services Australia or the Provider, the results of which informs the relevant Participant of the employment services that they are eligible for and supports them in making relevant choices. It includes questions that determine the Participant’s Job Seeker Classification Instrument score, support the Participant to make an informed decision where they have a choice between Workforce Australia Online and Workforce Australia Services, and help identify if the Participant requires an Employment Services Assessment.

'Managed Service Plan (MSP)' means an arrangement that a Providers can put in place to tailor the way services are delivered to a Participant who displays challenging behaviours.

'Mutual Obligation Requirement' means any activity test, participation requirement or other requirement that a Participant must meet in order to receive an Income Support Payment.

'One Main Contact (OMC)' means a Participant is restricted to communicating with one identified Provider staff member for the purpose of a Managed Service Plan.

'Protected Information' has the same meaning as in its decapitalised form under section 23 of the Social Security Act 1991 (Cth).

'Referring Provider' means a Provider who Refers an eligible Participant to CTA or EST. For avoidance of doubt, it does not include referrals from Workforce Australia Services or Yarrabah Employment Services to Transition to Work.

'Social Security Law' means the Social Security Act 1991 (Cth) and the Social Security (Administration) Act 1999 (Cth), and includes all relevant subordinate legislation and instruments, and the Guide to Social Security Law.

'Unauthorised Access' is the intentional or unintentional action by an entity to make personal information accessible or visible to others outside the entity and which releases that information from its effective control in a way that is not permitted by the Privacy Act. This includes an unauthorised disclosure by an employee of the entity.