When researchers and evaluators design participant information forms, they often reach for phrases like "your responses are completely confidential" or "information will remain anonymous." These promises are reassuring. They help reduce concerns about participation. But there is a critical problem: in many research and evaluation contexts, these promises are not entirely true, and the National Statement on Ethical Conduct in Human Research 2025 (National Statement) requires that we tell people as such.

This is the central tension in Chapter 4.9 of the National Statement: How do you honestly describe a situation where you cannot guarantee confidentiality because the law might require you to break the confidentiality?

The interaction with mandatory reporting

The challenge is not new, but it has been sharpened by increasing awareness of mandatory reporting laws. These laws exist for good reasons. They protect vulnerable people, particularly children. But they create a genuine dilemma for anyone conducting research or evaluation. We've created a separate resource for understanding these obligations, because they are complex and depend on where the research and evaluation is taking place. 

Consider a researcher evaluating a domestic violence support program. She asks participants: "How has your experience in the program changed your relationship?" 

In the course of an interview, a participant mentions that their partner has been abusing their children. In many jurisdictions, the researcher now has a legal obligation to report this disclosure. The participant agreed to take part believing their responses were confidential. Technically, they were, until the researcher discovered information that the law requires to be reported.

Or consider an evaluator assessing a youth justice program. During interviews with young people, one mentions an incident that constitutes a criminal offense that the evaluator is legally required to report. The young person may have understood "confidentiality" to mean their information would never be shared. This is not true.

These are not hypothetical scenarios. They are foreseeable risks in evaluation and research contexts where vulnerable populations are involved, or where the research topic touches on areas covered by mandatory reporting laws.

The cognitive shortcut that many researchers and evaluators take is understandable: they want to encourage participation, so they emphasise the confidential nature of the research. They may know about mandatory reporting obligations in the abstract, but the interaction between "confidentiality" and "legal obligations to report" gets muddled. The result is consent forms that mislead participants about the actual protections their information will receive.

What evaluators and researchers need to do

We set out three core requirements for research and evaluation that may discover illegal activity, consistent with the National Statement:

1. They must design research and evaluation in ways that reduce the risk of discovering illegal activity, where practicable. This is consistent with establishing that any residual potential risk is justified by the likely benefits of the activities. It is also worth noting that these risks extend beyond the activity to the act of exposure itself, as this may present reputational and social risks (Section 4.9.1).
2. Researchers and evaluators must be familiar with mandatory reporting obligations and legislative requirements in their jurisdiction. This may require seeking legal advice (Section 4.9.2).
3. They must disclose to prospective participants the circumstances under which information about illegal activity must be disclosed or reported, and take steps to ensure this information is conveyed in ways that help participants make informed decisions (Section 4.9.3 and 4.9.5).

These requirements reflect a shift from simply managing the risk reactively ("what do we do if we discover illegal activity?") to managing it proactively ("how do we design research to avoid discovering illegal activity in the first place?"). But the National Statement also recognises that sometimes, discovery is unavoidable or inherent to the research design itself.

The key insight is in requirement three. It is not enough to bury a sentence in section 9 of a 15-page participant information and consent form. Participants need to understand, clearly and upfront, that some disclosures may be legally required.

Risk varies by context

The National Statement correctly notes that the risk of discovering illegal activity is not uniform across research and evaluation.

At the low end of the spectrum is much routine social and market research. A consumer preference survey about packaging design, or market research about brand perceptions, carries minimal risk of uncovering illegal activity. Yes, in theory, a respondent could mention something unlawful. In practice, it is unlikely and unrelated to the research aims.

At the medium end is evaluation and research on many social programs. An evaluation of a financial literacy program, or research on people's use of community services, might touch on sensitive topics but is not deliberately designed to elicit information about illegal activity. The risk is foreseeable but not the primary focus.

At the high end is research and evaluation that is either explicitly designed to examine illegal or criminal activity, or that deliberately involves populations where mandatory reporting is highly likely. Evaluations of youth justice services, domestic violence support programs, child protection services, and family support programs all fall into this category. Research with people who have experienced homelessness, child abuse survivors, or people in contact with the criminal justice system also carries a higher risk.

Child abuse, sexual assault, and threats to public safety as the most common triggers for mandatory reporting laws, though these vary across states and territories.

Three strategic activities

Given this landscape, how should researchers and evaluators approach Chapter 4.9? We recommend three activities: designing to avoid, being transparent in consent, and preparing for the event that disclosure does occur.

1. Design to avoid where practicable

The first and best move is to design research and evaluation in ways that reduce the risk of discovering illegal activity in the first place. This is proactive risk management.

In a consumer research context, this might mean framing your survey questions to be purely about preferences and behaviours, and explicitly briefing your research team to redirect any disclosed information that is not relevant to the research aims. If someone mentions something unlawful, they are gently brought back to the topic at hand.

In evaluation of a youth mentoring program, this might mean designing your interview protocol to focus on the young person's experience within the program, not on their broader circumstances or legal history. You are not asking "have you been in trouble with the law?" You are asking "what did you learn from the mentor?"

In a domestic violence research context, this might mean framing your research as examining the experience of support services, not the details of what happened in the relationship. You are asking people to evaluate the service, not to disclose abuse in detail. You are also clear, upfront, that if disclosures of certain types of illegal activity occur, you are obligated to report them.

These design choices reduce the foreseeable risk of discovering illegal activity without preventing the research from achieving its aims. They require thinking clearly about what information you actually need to collect, and what information is tangential.

2. Be honest and clear in consent

The second move is to be transparent about mandatory reporting obligations in your participant information and consent forms. This is about integrating honesty into the core narrative of your form.

One effective approach is to broaden the "risks" section of your PICF. Instead of listing only risks to the participant (emotional distress, time burden, etc.), you should also describe the risk associated with what might be reported.

For example, a domestic violence evaluation might say something like:

"This evaluation asks about your experience with the [service]. Some questions will ask about your situation. In rare cases, if you tell us about harm to a child or young person, we are legally required to report this to [child protection authority]. This is true even if you have not asked us to report it. We cannot keep this information confidential."

Note what this does. It:

• Names the specific trigger (harm to a child or young person, not "illegal activity" in general)
• Identifies the authority (not vague reference to "authorities")
• Removes the false promise of confidentiality
• Acknowledges that this is a legal obligation, not the researcher's choice

A youth justice program evaluation might say:

"This evaluation talks to young people and staff about their experience in the program. If you tell us about a serious offense that we are legally required to report, we must report it. We will let you know what we are reporting and to whom."

An evaluation of a family support program might say:

"We are evaluating how well [program] works. Some of the questions ask about your family situation. If you tell us that a child or young person is being harmed, we are legally required to tell [child protection services]. We cannot keep this secret."

What these examples share is directness. They do not promise confidentiality. They clarify what is and is not confidential.

But there is a balance to strike. Long and detailed warnings about all possible scenarios can be alienating. Researchers and evaluators face genuine pressure: if consent forms become too burdensome or alarming, participation rates drop. This is the cognitive shortcut we mentioned earlier.

The solution is to calibrate to context. A consumer preference survey needs almost no warning. A program evaluation with medium risk needs a clear, straightforward paragraph. Research explicitly designed to examine or uncover illegal activity needs more detailed information about what triggers reporting and what the process will be.

3. Know your jurisdiction and prepare

The third move is to actually know the legal landscape in which you are operating. The National Statement explicitly states that it does not provide legal advice on mandatory reporting obligations. Your institution, however, should have guidance. Your HREC should ask you about it. Your legal department, if your institution has one, should be a resource.

Before you design your research, you need to know:

• Which types of illegal activity are subject to mandatory reporting in your jurisdiction?
• Are there mandatory reporting laws that apply specifically in research contexts, or do general legal obligations apply?
• Which agencies receive reports?
• What information do you need to provide when you report?
• Are there any exceptions or carve-outs for researchers?

These answers differ across states and territories, and sometimes between different research contexts. A researcher in one state might have mandatory reporting obligations that a researcher in a different state does not face.

This is why the obligation is on researchers and evaluators: "be familiar with mandatory reporting obligations and legislative requirements that apply in their jurisdiction." This activities must not come after ethics review or at the point you conduct research. It must happen before you design it.

What HRECs are looking for

Ethics committees reviewing research and evaluation under Chapter 4.9 are typically checking for three things.

First, they want evidence that the researcher or evaluator understands what mandatory reporting obligations apply. This is not about legal certainty (no HREC can provide that). It is about demonstrating that you have thought about the legal landscape. This might be reflected in your protocol: you name the jurisdiction, you describe the specific types of illegal activity that are subject to mandatory reporting, and you explain how you have informed yourself of these obligations.

Second, they want to see that you have made deliberate design choices to reduce the risk of discovering illegal activity. This is not always possible. If you are evaluating a child protection service, you cannot avoid the possibility of discovering abuse. But even in high-risk contexts, you can make choices about how you frame questions, what you actively ask about, and what you will and will not pursue. HRECs want to see that these choices have been made deliberately, not by accident.

Third, they want to review your participant information form with fresh eyes. Does it honestly describe what information will and will not be kept confidential? Does it explain, in plain language, which circumstances might trigger reporting? Does it do this in a way that is clear without being so alarming that participation becomes impossible? A good PICF does all three things.

Getting It Right

Chapter 4.9 is not about preventing research and evaluation from happening. It is about ensuring that the people who participate in research and evaluation understand the actual conditions of that participation. When someone agrees to an interview, they deserve to know whether their responses are truly confidential, or whether some circumstances would trigger mandatory reporting.

The cognitive shortcut of promising "complete confidentiality" is understandable, but it is ultimately dishonest. It misrepresents the research to participants, and it puts researchers and evaluators in an untenable position: either you break a promise you made, or you breach a legal obligation. Neither is acceptable.

The better path, which the National Statement endorses, is to design research to minimise the risk of discovering illegal activity where you can, and to be honest with participants about the risks you cannot eliminate. This takes more care, more thought, and more clarity in how you communicate. But it is the only approach that is genuinely ethical.

Quick Reference: Checklist for researchers and evaluators

Before you finalise your protocol and participant information form, ask yourself:

1. Have I understood the legal landscape? 

   1. Do I know what mandatory reporting obligations apply in my jurisdiction to research or evaluation like mine?
2. Have I designed to avoid? Are there design choices I can make to reduce the foreseeable risk of discovering illegal activity, without compromising the research aim?

3. Is my consent form honest? 

   1. Does it promise only the confidentiality I can actually deliver? 

   2. Does it explain which circumstances might trigger mandatory reporting, and in plain language?

4. Is the burden proportionate? 

   1. Have I calibrated the level of warning and detail to the actual risk in my context? (A consumer survey needs less than an abuse research project.)

5. Have I informed my institution and HREC? 

   1. Does my protocol clearly describe the mandatory reporting risks and how I have addressed them?

6. Am I prepared? 

   1. If a disclosure does occur that triggers mandatory reporting, do I know what to do? 
   2. Have I thought about how I will inform the participant? 
   3. Have I prepared my team?

If you can answer these questions clearly, you have understood Chapter 4.9.

Still have questions? Get in touch - we're always happy to help!

This post is intended as a practical guide to Chapter 4.9 of the National Statement on Ethical Conduct in Human Research (2025). It does not constitute legal advice. 

AI Disclosure: Initial drafts of the content for this article were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.

​