Disabled Australians' Private Data May Have Flowed Into Palantir's Systems Through Fraud Investigation Program

Key points

• Personal data belonging to National Disability Insurance Scheme (NDIS) participants may have been fed into Palantir's analytics platform without participants' knowledge.
• The Australian Criminal Intelligence Commission (ACIC), which has legal access to NDIS data, used Palantir software as part of a multi-agency fraud investigation taskforce.
• Calls to ban Palantir from Australian government contracts began in May 2025, after the company published a document one UK politician described as the "ramblings of a supervillain".
• The NDIS funds support services for hundreds of thousands of Australians living with permanent disability, making the potential data exposure significant in scale.

Private information held by Australia's National Disability Insurance Scheme, which funds support services for hundreds of thousands of Australians living with permanent disability, may have been processed inside software built by Palantir Technologies, a US data analytics company already drawing government scrutiny in several countries.

Guardian Australia first reported the arrangement. At its centre is the Australian Criminal Intelligence Commission, a federal body with lawful access to NDIS records, which joined a multi-agency taskforce investigating fraud against the scheme. That taskforce used Palantir's platform, software that pulls large volumes of data from different sources and searches for patterns, to look for suspicious activity.

Who is Palantir, and why is it controversial?

Palantir is an American company founded in 2003 that sells data-analysis tools to governments and large corporations. Its software is used by intelligence services, police forces and defence agencies across multiple countries.

The controversy sharpened in May 2025, when Palantir published a document, sometimes described as a manifesto, that drew sharp criticism. One UK Member of Parliament called it the "ramblings of a supervillain." Critics said the document implied some cultures are inferior to others. Since then, voices inside the Australian government have called for Palantir to be removed from public-sector contracts entirely.

What information may have been shared, and with whom?

The NDIS holds sensitive personal details: medical diagnoses, care needs and the financial circumstances of some of the country's most vulnerable people. As a law-enforcement body, the ACIC has access to that data for legitimate investigative purposes.

The concern isn't that fraud was being investigated. It's that doing so may have routed private disability records through a third-party commercial platform without participants knowing their information had moved outside the agencies they deal with directly. Neither the ACIC nor the NDIS Agency has confirmed which data fields were shared or how many participants are affected.

Should NDIS participants be worried?

There's no indication, at this stage, that data was stolen or misused by outside criminals. The risk identified so far is one of governance: sensitive records may have been shared with a private company in ways participants didn't expect and weren't told about.

If you or a family member receives NDIS support, you're entitled to ask the NDIS Agency what data it holds about you and who it has been shared with. Australia's Privacy Act gives individuals that right. Watching for unusual contact, such as unsolicited calls or emails claiming to be from the NDIS, is sensible precaution regardless. Our 2 September story on Australia's new privacy rules targeting smart glasses is worth reading alongside this one.

The broader question now before Australian policymakers is whether law-enforcement data-sharing arrangements need stronger rules about which commercial vendors can touch sensitive government records, and what participants must be told. This one's worth watching: if the ACIC used a commercial platform here, other agencies almost certainly have too.