Nobody asks this question until they have to.
A software company sends an email on a Tuesday. The subject line says something like "important update about your account" or "changes to our service." By the end of the email, the provider knows the platform is shutting down, being sold, or changing in a way that puts operations under pressure.
Participant records, incident reports, progress notes, service agreements, rostering evidence, and compliance history may all sit on that vendor's servers.
The question every NDIS provider should ask before that email arrives is simple: what is our exposure if the company holding our participant data stops operating?
The shutdown scenario nobody plans for
When a SaaS provider shuts down in an orderly way, customers may receive an export window. That window might be 30 days, 60 days, or 90 days. During that period, the provider must download its data in whatever format the platform supports.
That format may not match the format another system can import. Data may arrive as spreadsheets, PDFs, CSV files, compressed archives, or partial exports. Attachments, audit logs, signatures, timestamps, and permission history may not travel cleanly.
If the company enters administration, the path can become harder. Access may be interrupted. Support may slow down. An administrator's priority is the company and its creditors, not the provider's audit pack.
If an eligible data breach occurs during a shutdown, acquisition, or system failure, the Notifiable Data Breaches scheme can require the provider to notify the OAIC and affected individuals. A third-party incident can still become the provider's response obligation.
What you do not own when you subscribe
When a provider subscribes to SaaS, it pays for access to software and the infrastructure the vendor controls. It does not own the environment.
The provider may own or control the information it contributes under the contract, but the practical reality is different. The data exists inside a vendor system, in a vendor format, under vendor rules, on vendor-controlled infrastructure.
The provider can see it while the platform works. It may be able to export it. It may be able to run reports. But operational continuity depends on the contract, export tools, backup practices, and the vendor's ability to keep trading.
Many providers find out how fragile that setup is only when the vendor gives notice.
Access is not continuity
Seeing participant data inside a platform is not the same as being able to preserve, restore, audit, and operate from that data when the platform disappears.
The acquisition risk is quieter
A shutdown is obvious. An acquisition can feel routine until terms, hosting, support, or product direction changes.
When a software company is acquired, the acquiring entity may inherit customer relationships, product infrastructure, and data handling responsibilities. The new owner may have different privacy practices, different subcontractors, different hosting arrangements, or a plan to migrate users to another product.
Providers often learn about this through a notice, not a consultation. The practical question is whether the provider has assessed the new owner before participant data keeps flowing through the platform.
APP 8 may also matter if data is disclosed to an overseas recipient. Providers need to understand cross-border handling before the structure changes, not after.
The continuity problem beyond privacy
Privacy risk is serious. Operational continuity can become urgent faster.
NDIS providers need complete and accurate records of supports delivered. NDIS guidance lists records such as invoices, support logs, rosters, case notes, and service agreements. The NDIS Practice Standards also require information management systems that record participant information accurately and support appropriate storage, access, retrieval, retention, destruction, and disposal.
If the provider's main platform shuts down during audit preparation, the provider cannot answer the auditor with "our software company closed." The obligation to produce records belongs to the provider.
The providers that handle a platform failure best are the ones that keep a current, complete, accessible copy of critical data in an environment they control.
What infrastructure ownership changes
Owned infrastructure does not mean building every application from scratch.
It means the provider's complete operational record does not live exclusively on another company's servers. Rostering, compliance, documentation, and reporting tools can still feed into the provider's own environment. The source of truth remains controlled by the organisation.
If a platform shuts down, the provider may lose the interface. It does not lose the record. It does not lose the audit trail. It does not lose the ability to respond to a compliance request.
That is a different operating position from relying on a vendor export during a crisis.
Questions to ask before the email arrives
Every provider should be able to answer these questions for each platform that touches participant data.
- Where is our data hosted, and in which country?
- What do the terms say about data portability when the contract ends?
- How do we export all records, attachments, timestamps, and audit logs?
- What format does the export use?
- Could another system use that export without weeks of manual reformatting?
- When was our most recent independent backup?
- Where is that backup stored?
- If the platform shut down tomorrow, how long would operational continuity take to restore?
If any answer takes more than a few minutes to find, the provider has a continuity risk that belongs on the risk register.
Take the free SIL Business Health Check
The data sovereignty section covers where participant data lives, what would happen under vendor failure, and what exposure exists before mandatory registration pressure lands.
Frequently asked questions
What happens if an NDIS SaaS platform shuts down?
The provider may need to export data within a limited window, rebuild access elsewhere, and prove that historical records remain complete and accessible.
Does a SaaS vendor shutdown remove the provider's record-keeping obligations?
No. NDIS providers remain responsible for complete and accurate records of supports delivered and for producing evidence when required.
How can providers reduce continuity risk?
Keep independent backups, understand export formats, review termination terms, map vendor hosting, and maintain critical operational records in an environment the organisation controls.