Qualifying or waiving consent

In an ideal world, the consent process is clear-cut: you tell participants exactly what you're doing, why you're doing it, and they say yes or no. But evaluation and research don't always fit this mould. Sometimes full disclosure would compromise the validity of your findings. Sometimes contacting thousands of participants individually is impracticable or impossible. Sometimes you're analysing data that was collected years ago for a different purpose entirely.

Chapter 2.3 of the National Statement on Ethical Conduct in Human Research 2025 (National Statement or NS) addresses these scenarios through three distinct pathways: limited disclosure, opt-out approaches, and waivers of consent. Each has specific requirements and constraints. None should be used as a shortcut around proper consent processes. However, when applied appropriately, they enable valuable research and evaluation that would otherwise be impossible.

This article unpacks each pathway, provides practical checklists (which you can download here), and clarifies when each approach is (and isn't) appropriate for evaluation, social research and market research contexts.

The Foundation: Consent Remains the Default

Before examining the alternatives, the overriding principle is clear in the National Statement: consent must be "voluntary and based on sufficient information and adequate understanding of both the proposed research and the implications of participation in it" (NS 2.3, Introduction).

Limited disclosure, opt-out approaches and waivers are departures from this standard. They're justified only when specific conditions are met, and the burden of demonstrating those conditions sits with the researcher or evaluator.

Limited Disclosure: When Not Telling is Necessary

Limited disclosure exists on a spectrum. At one end there are minor omissions such as in observational research in public spaces. At the other end there are projects with active deception where participants are deliberately misled about the research purpose or methods.

The Commercial-Academic Divide

The context matters significantly here. Commercial research and academic research generally operate in different contexts with different objectives, and limited disclosure is applied differently.

Commercial market research typically involves concealing the commissioning client's identity. A brand perception study commissioned by Woolworths might not disclose the sponsor to avoid biasing responses. Participants know they're in a study; they just don't know who's paying for it. This is relatively low-stakes limited disclosure, with no “active” deception of participants.

Academic deception studies are different. Classic examples include confederate-based experiments where researchers stage situations to observe genuine responses, or studies where participants are told the research examines one thing when it actually examines another. These cases of active deception involve more substantial ethical questions about respect for persons and risks of psychological harm.

The National Statement treats these scenarios distinctly.

When Limited Disclosure Doesn't Involve Active Deception (NS 2.3.1)

Scenario: You're evaluating customer service quality through "secret shopper" observations*. Staff don't know they're being assessed. No one is lying to anyone, but the observation is undisclosed.

Review bodies may approve these and similar scenarios if you can demonstrate:

1. No suitable alternatives exist that achieve your aims with fuller disclosure. In the secret shopper case: if staff knew they were being observed, behaviour would change, thereby defeating the purpose.
2. The benefits justify both the limited disclosure and any risk to public trust in research. This second part is important. Each instance of concealment potentially erodes trust in researchers and evaluators more broadly.
3. The research involves no more than low risk and the limited disclosure is unlikely to affect participants adversely. Staff being observed aren't exposed to harm beyond normal workplace monitoring.
4. You've defined precisely what you're not disclosing. Vague hand-waving doesn't cut it.
5. Where possible and appropriate, you'll debrief participants afterward, explaining what you actually studied and why the limited disclosure was necessary, and offering them the opportunity to withdraw their data.

That last point deserves emphasis. It's about respect. Even when you couldn't tell them upfront, you can restore transparency afterward.

When Limited Disclosure Involves Active Deception (NS 2.3.2)

Scenario: You're conducting a study on implicit bias. You tell participants you're testing memory, but you're actually observing discriminatory patterns in their recall of faces from different ethnic backgrounds.

This is deception. You're not just withholding information, you're actively misleading people.

This is not to say that doing this is wrong, but because people are being actively misled the bar for ethical approval is higher. In addition to meeting all the requirements in 2.3.1, you must demonstrate:

1. Participants won't be exposed to increased risk of harm because of the deception. Discovering you were deceived can itself be distressing.
2. You'll provide a full explanation afterward, both of the real aims and methods, and why the deception was necessary.
3. There's no known or likely reason participants would have refused consent if they'd known the truth.

That third point is crucial. You can't use deception to secure participation from people who would have legitimately declined. That's not ethical research or evaluation, that's manipulation.

Critical constraint: Only an HREC can review and approve research involving active deception or research aiming to expose illegal activity (NS 2.3.4). Lower-risk review pathways cannot review these applications.

Limited disclosure should be rare. Each time you consider it, ask: "Am I using this because it's necessary, or because it's convenient?" If the answer is convenience, reconsider your design.

Opt-Out Approaches

The opt-out approach presumes participation unless people actively decline. It's used when you can feasibly contact some or all participants, but the scale makes individual consent impracticable.

Where the 2014 Guidance Falls Short

There is a common misconception in evaluation that the National Statement at paragraph 2.3.7 exempts evaluation from the requirements of this section by directing evaluations and QA projects to the NHMRC's Ethical Considerations in Quality Assurance and Evaluation Activities (2014). While this document briefly mentions opt-out approaches, its scope is severely limited. That document addresses QA/audit activities that do not require ethics review at all, which is a tiny minority of projects. Most evaluation and quality improvement activities do require ethics review (see our lower-risk reviews guidance), and when they do, the National Statement requirements override the 2014 document.

When Opt-Out is Appropriate (NS 2.3.5-2.3.6)

Scenario: You're evaluating a state-wide public health intervention using linked administrative data from 200,000 patients across 50 hospitals. Individual consent is theoretically possible but practically infeasible.

Opt-out may be appropriate when the project is "of such scale and significance that using explicit consent is neither practical nor feasible."

Before approving opt-out, review bodies must be satisfied that:

1. Involvement carries no more than low risk. If there's a foreseeable risk of harm, you need explicit consent.
2. Public interest in the research substantially outweighs public interest in privacy protection. Both interests are legitimate.
3. The research would be compromised if participation rates weren't near-complete, and explicit consent would compromise that participation rate.
4. You're making reasonable attempts to provide appropriate information to all prospective participants, explaining what data you're collecting, why, and how to decline.
5. You're allowing reasonable time between information provision and data use, so people can actually decline before you start.
6. You're providing a mechanism for people to get more information and decline participation.
7. Data will be managed according to relevant security standards.
8. Clear governance delineates responsibility for the project and data management.
9. Opt-out isn't prohibited by law.

Important distinction from waivers: Opt-out still requires providing information and an opportunity to decline. You're not dispensing with consent, you're changing the default from "no unless you say yes" to "yes unless you say no." People still need to understand what they're (not) consenting to.

The Privacy Law Implications

Here's where it gets complicated. The opt-out approach is "unlikely to constitute consent when applying Commonwealth privacy legislation to the handling of sensitive information, including health information" (NS 2.3, Introduction).

If you're using health information and can't get explicit consent, you must comply with the Section 95 or 95A Guidelines under the Privacy Act (Cth) 1988. Only an HREC can grant opt-out approval for research requiring Section 95/95A compliance. Other review bodies can approve opt-out for research not involving health information (assuming the overall project risk profile permits lower-risk review).

Practical Design Considerations

Review bodies should consider (NS 2.3.8): the sensitivity and risks, the participant pool, the context, and whether withdrawal is feasible once identifiers are removed.

If you're collecting data, de-identifying it immediately, and destroying the link, withdrawal becomes impossible after a certain point. You need to tell people this upfront.

Waivers: When Even Opt-Out Won't Work

A waiver dispenses with consent entirely. Participants characteristically won't know they're involved in research.

This is the most significant departure from the consent principle, and accordingly has the strictest requirements.

Who Can Grant Waivers?

This depends on the data type and overall project risk:

• Medical research or personal health information: Only an HREC may grant waivers (NS 2.3.9)
• Other personal information: An HREC or a lower-risk review body may grant waivers—but only if the overall project doesn't meet the threshold requiring full HREC review (i.e., no foreseeable risk of harm to participants)
• Non-personal information: Typically doesn't require consent in the first place, so waiver provisions don't apply

When Waivers May Be Granted (NS 2.3.10)

Scenario: You're evaluating the effectiveness of a mental health program implemented in 2018-2020. Participants consented to the program, but not to evaluation. Many have moved; contact details are outdated. You want to analyse their de-identified clinical outcomes data.

Review bodies may waive consent if satisfied that:

1. Involvement carries no more than low risk (i.e. no foreseeable risk of harm). This is non-negotiable.
2. Research/evaluation benefits justify the risks of proceeding without consent. "No risk" doesn't mean "waiver automatically granted”, as you still need public interest justification.
3. Obtaining consent is impracticable. This isn't "inconvenient" or "expensive." It's genuinely impracticable due to quantity, age or accessibility of records.
4. There's no known or likely reason participants would have refused consent if asked. If you have evidence people would object, you can't proceed.
5. There's sufficient privacy protections in place.
6. There's an adequate plan to protect confidentiality of data.
7. If results might be significant for participants' welfare, there's a plan (where practicable) for making that information available, for example via disease-specific websites or regional media.
8. Commercial exploitation of data won't deprive participants of financial benefits they'd be entitled to from this exploitation (a rare instance in evaluation, but potentially relevant in market research for commercial product development).
9. The waiver isn't prohibited by law.

Special Case: Research Exposing Illegal Activity (NS 2.3.11)

If you're analysing data to expose illegal activity (say, evaluating fraud patterns in disability support claims), waivers have additional requirements. HRECs must be satisfied that:

1. The value of exposing the activity justifies adverse effects on those exposed.
2. Privacy is sufficiently protected.
3. Confidentiality of data is sufficiently protected.
4. The waiver isn't otherwise prohibited by law.

Only HRECs can grant these waivers (NS 2.3.9).

Transparency Requirement

Given the importance of maintaining public confidence in the research/evaluation process, institutions must make publicly accessible (e.g., in annual reports) summary descriptions of all projects granted consent waivers (NS 2.3.12). Unfortunately the National Statement is obtuse on what comprises an “institution”, but in this case it is Iris Ethics as the entity which provided the grant of waiver. Our annual reporting process includes provision for disclosing summary information for the projects for which waivers have been granted.

For waivers related to illegal activity exposure, this public disclosure is deferred until the research is completed.

This transparency mechanism is important. Waivers happen behind closed doors; public reporting provides accountability.

Common Misunderstandings

"My project is evaluation, not research, so I don't need consent"

Wrong. Evaluation is a form of research for National Statement purposes. Consent requirements apply unless you meet the specific conditions for limited disclosure, opt-out or waiver.

"The 2014 QA guidance says I can use opt-out without ethics review"

This applies only for a very narrow set of evaluation and QA projects that don't require ethics review at all. If your project needs ethics review (and most do need at least a lower risk review), the National Statement governs, not the 2014 document.

"I can't contact participants, so I'll just use a waiver"

You need to demonstrate it's impracticable to obtain consent and that all the other waiver conditions are met, including no more than low risk and sufficient public interest justification.

"Limited disclosure just means I don't have to tell them everything"

It's more specific than that. You need to demonstrate that fuller disclosure would compromise research aims, that benefits justify any erosion of trust, and that you'll debrief participants where appropriate.

Checklists for Practitioners

We've prepared a set of checklists that you can copy across to your documents and use in your projects. Or you can download our consent checklist here.

Limited Disclosure Checklist (Without Active Deception)

Before seeking approval under NS 2.3.1:

• I have considered and ruled out alternatives involving fuller disclosure
• I can articulate how the benefits justify both the limited disclosure and any risk to trust in research
• The research involves no more than low risk to participants
• Limited disclosure is unlikely to affect participants adversely
• I have precisely defined what information is being withheld and why
• I have a plan for debriefing participants afterward (where appropriate)
• I will offer participants the opportunity to withdraw their data after debriefing

Limited Disclosure Checklist (With Active Deception)

In addition to all requirements above under NS 2.3.1:

• I have confirmed the research does not aim to expose illegal activity (if it does, different requirements apply under NS 2.3.3)
• Participants will not be exposed to increased risk of harm as a result of the deception
• I have a detailed plan for full debriefing, including explanation of the real aims/methods and why deception was necessary
• I have no known or likely reason to believe participants would have refused consent if fully informed
• I understand only an HREC can review and approve this research/evaluation (NS 2.3.4)

Opt-Out Approach Checklist

Before seeking approval under NS 2.3.5-2.3.6:

• The project is of such scale and significance that explicit consent is neither practical nor feasible
• Involvement in the research/evaluation carries no more than low risk
• Public interest in the research/evaluation substantially outweighs public interest in privacy protection
• Near-complete participation is necessary and explicit consent would compromise participation rates
• I am making reasonable attempts to provide appropriate information to all prospective participants
• Information clearly explains: what data is being collected, why, and how to decline participation or withdraw
• Reasonable time is allowed between information provision and data use for participants to decline
• A mechanism exists for participants to obtain further information and decline participation
• Data management meets relevant security standards
• Clear governance delineates responsibility for the project and data management
• The opt-out approach is not prohibited by law
• I have considered whether withdrawal will remain feasible after identifiers are removed, and communicated this to participants
• If the research/evaluation involves health information and requires S95/S95A compliance, I am seeking HREC review (not lower-risk review)

Waiver of Consent Checklist

Before seeking approval under NS 2.3.10:

• Involvement carries no more than low risk (this is mandatory)
• Benefits from the research/evaluation justify risks of proceeding without consent
• Obtaining consent is genuinely impracticable (not just inconvenient or expensive)
• There is no known or likely reason participants would have refused consent if asked
• Sufficient privacy protections are in place
• An adequate plan exists to protect confidentiality of data
• If results may be significant for participants' welfare, I have a plan (where practicable) to make information available to them
• Commercial exploitation of derivatives will not deprive participants of financial benefits to which they'd be entitled
• The waiver is not prohibited by law
• If the research/evaluation involves medical research/evaluation or personal health information, I am seeking HREC review (only HRECs can grant these waivers per NS 2.3.9)
• If the research/evaluation involves other personal information and the overall project has no foreseeable risk of harm, a lower-risk review body may review
• I understand the institution must publicly disclose summary descriptions of all waiver decisions (NS 2.3.12)

Additional Waiver Checklist (For Research Exposing Illegal Activity)

In addition to all requirements above under NS 2.3.10:

• The value of exposing the illegal activity justifies adverse effects on those exposed
• Privacy is sufficiently protected
• Confidentiality of data is sufficiently protected
• The waiver is not otherwise prohibited by law
• I understand only an HREC can grant this waiver (NS 2.3.9)
• I understand public disclosure of the waiver decision should not occur until research is completed (NS 2.3.12)

Summary

Limited disclosure, opt-out and waivers exist because rigid adherence to standard consent processes would prevent valuable research and evaluation. They're pragmatic accommodations to real-world constraints.

But they're not shortcuts. Each pathway has stringent requirements for good reason: they depart from the fundamental principle of respect for persons' autonomy.

When you're considering these approaches, ask yourself:

1. Is this necessary, or just convenient? Convenience doesn't justify compromising consent.
2. Have I genuinely minimised risk? Low risk is a threshold requirement for all three approaches.
3. Can I articulate the public interest justification? For waivers and opt-out especially, "it would be useful to know" isn't sufficient.
4. Am I being transparent where possible? Debriefing after limited disclosure, clear communication in opt-out, public accountability for waivers.

The National Statement's approach to consent is both rigorous and flexible. It demands high standards while recognising real-world constraints. Limited disclosure, opt-out and waivers reflect that balance—but only when applied with care, justification and genuine respect for participants.

For more on consent in evaluation and research, see our article on general consent requirements. For guidance on lower-risk ethics review pathways, see lower-risk reviews: why they matter.

Have questions about whether your project qualifies for limited disclosure, opt-out or waiver? Contact us here.

*Fun fact: one of the first jobs our Managing Director had in market research was doing this work.

AI Disclosure:  Initial drafts of the content for this article were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.