Your rights when a provider asks for your documents

Starting a care role usually means handing over a stack of personal documents: a National Police Check (Nationally Coordinated Criminal History Check) or worker screening clearance, qualifications, first aid certificates, proof of identity and your right to work. It is fair to wonder what a provider can reasonably ask for, why, and what happens to your information after you send it. This guide explains the balance between a provider's compliance duties and your privacy rights, and where your Career Passport fits in.

Why providers ask for so much

Care providers do not collect documents to make your life difficult. They collect them because the law requires it before you can support vulnerable people. The exact rules depend on the sector you work in, but the pattern is consistent: a provider has to confirm you are screened, qualified and entitled to work before you start, and keep evidence of that on file.

• Aged Care: From 1 November 2025, Aged Care worker screening generally requires either a National Police Check issued within the last 3 years, or an NDIS Worker Screening Clearance. Those are the two accepted options. See the Aged Care worker screening requirements guide for the detail.
• Disability and NDIS: Risk-assessed roles need an NDIS Worker Screening Check. That check already includes a national police history component, so a provider should not need a separate police check on top of it.
• Childcare: A valid Working With Children Check is required in every state and territory. Police history is built into the WWCC process, so again a standalone police check is not a separate requirement.

On top of screening, a provider may reasonably ask for qualification certificates, current first aid and CPR, mandatory training records, and proof of your right to work in Australia. These map closely to the documents you need to start working in care.

What "reasonable" means under the Privacy Act

Most providers are bound by the Privacy Act 1988 and its Australian Privacy Principles, overseen by the Office of the Australian Information Commissioner (OAIC). A few principles shape what a provider can ask for and how it must treat your information.

• Collect only what is needed (APP 3). An organisation must collect personal information by lawful and fair means and only where it is reasonably necessary for its functions. Asking for a clearance you genuinely need is fine. Asking for unrelated personal details is harder to justify.
• Tell you why (APP 5). At or around the time it collects your information, a provider should notify you of matters such as why it is collecting the information and how it will be handled. This is usually set out in a privacy policy or collection notice.
• Keep it secure (APP 11). A provider must take reasonable steps to protect your information from misuse, loss and unauthorised access, and to destroy or de-identify it when it is no longer needed.

You are entitled to ask any provider how it handles your documents: where they are stored, who can see them, how long they are kept, and how they are protected. A provider that takes privacy seriously will be able to answer.

The employee records nuance

One detail worth knowing: once you are employed, records a private sector employer holds that are directly related to your current or former employment relationship may fall under the employee records exemption. That means some of the APPs may not apply to those specific records in the same way. The exemption does not cover information collected about prospective workers who are never engaged, so the rules around collecting your documents during recruitment still bite. The practical takeaway is the same either way: a good provider should still be transparent and secure, regardless of which rules technically apply.

Consent and giving documents

In reality, screening and compliance obligations mean you cannot work in a regulated care role without providing the required checks. So while you technically choose to share your documents, declining usually means you cannot take the role. That is not a provider overreaching; it is the law setting a baseline before you support vulnerable people.

What consent does protect is the scope. You are agreeing to share information for screening and compliance, not for any purpose a provider invents later. If a provider wants to use your documents for something unrelated, that is a separate question and you can ask about it.

A few practical things you can always do:

• Ask which specific obligation each document relates to.
• Ask to see the provider's privacy policy or collection notice.
• Ask how long records are retained and how they are stored.
• Keep your own copies, with current expiry dates, so you are never caught out.

For a closer look at protecting your information, see security and privacy on your Career Passport.

You hold your own credentials

The traditional model puts every provider in the position of separately collecting, copying and storing your documents. That is duplicated effort for them and scattered copies of your personal information across multiple organisations. A Career Passport flips this. You hold a single, portable set of credentials, and you decide which provider can see them and when. A provider can still keep its own record of the credentials it holds for you, and you can always see what an organisation holds.

Holding your own Career Passport does not remove a provider's legal duties. The provider still has to satisfy itself that you meet the screening requirements, and makes the final decision about whether you can work. What changes is the friction. Instead of re-collecting the same documents at every new job, you share access once, and the provider reviews what is already in order. If you work across multiple care providers, this matters even more, because your checks travel with you rather than being re-gathered each time.

Where Koora fits

Koora is building a Career Passport so care workers can hold their credentials in one place and choose who sees them. The compliance engine checks what you hold against the requirements for your roles, and a person reviews your documents once you share your passport with a provider or a provider requests access. Where an authoritative source exists, such as a public state WWCC lookup or the AHPRA register, status is verified by Koora rather than taken on trust. Screening clearances and qualifications sit at the reviewed level, with source verification of more credential types on the roadmap.

The point is to put you in control of your own information while still giving providers the assurance they are legally required to have. Your provider keeps the legal responsibility for who they engage. That keeps the rigour where it belongs and spares you from handing the same stack of documents to every employer who asks.

Frequently asked questions

Can a provider ask to keep a copy of my National Police Check?

Yes. Care providers have screening and record-keeping duties, so retaining a copy of a clearance is usually reasonable and lawful. The provider should tell you why it collects the document, store it securely, and only use it for the purpose it was collected. You can ask how long it keeps records and how it protects them.

Do I have to give a provider my documents?

Practically, yes, if you want the role. Screening and compliance rules mean providers cannot lawfully engage you until they are satisfied you hold the checks the role requires. You are still entitled to know why each document is needed, how it will be stored, and who can see it. A provider should only ask for what its obligations actually require.

What if I think a provider is mishandling my information?

Raise it with the provider first and ask about its privacy policy and complaint process. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner. Note that records directly related to a current or former employment relationship may fall under the employee records exemption.