This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
Collection requirements
Data collection must be conducted in accordance with the approved protocol and the data management plan submitted for ethics review (NS 5.4.10(a)). The principle of data minimisation applies: researchers should collect only the data necessary to answer the research or evaluation questions. Collecting additional data "just in case" it proves useful is not consistent with this principle and may represent an unjustified imposition on participants.
All data collection instruments, including surveys, interview guides, scripts and observation protocols, must be approved by the review body before use (NS 5.2.16).
Developing a data management plan
For all research and evaluation, researchers should develop a data management plan addressing generation, collection, access, use, analysis, disclosure, storage, retention, disposal, sharing, and re-use of data, together with the risks associated with these activities and strategies for minimising them (NS 3.1.44). The plan should be developed as early as possible and should cover:
- Physical, network and system security measures, proportional to risk (also 3.1.45)
- Policies and procedures for handling data
- Contractual and licensing arrangements and confidentiality agreements
- Training for team members
- The form in which data will be stored
- The purposes for which data will be used or disclosed
- Conditions under which others may access the data
- What, if anything, from the plan needs to be communicated to participants
- Whether extended or unspecified consent will be sought for future use, or a waiver of consent will be sought from the review body (see Secondary use of data)
Where multiple researchers or organisations, including commissioning clients, collaborate on collecting, storing, or analysing data, they should agree in advance on custodianship, storage, retention, and destruction arrangements, rights of access and re-use, and ownership of any intellectual property generated by the project (NS 3.1.43). This agreement need not be a contractual document, but the arrangements should be clearly resolved; in commissioned evaluation, this is typically documented in the services contract, the project plan, or a memorandum of understanding.
Security proportional to risk
Security arrangements in the data management plan must be proportional to the risks of the project and the sensitivity of the information collected (NS 3.1.45). A study of public transport usage may require only basic security, such as password-protected files. A study involving users of family violence or domestic violence services will generally require stronger controls, such as encrypted databases, restricted team access, and pseudonymisation or de-identification before analysis.
Legal and consent compliance
Researchers must comply with all relevant legal and regulatory requirements applying to the data collected, used or disclosed, as well as the conditions of consent given by participants (NS 3.1.46). This includes the Privacy Act 1988 (Cth) and relevant state or territory privacy legislation. Where consent was given only for a specific evaluation, the data cannot later be used for an unrelated project unless new consent is obtained or a waiver is approved by the review body (see Secondary use of data). Projects with an international component may also be subject to overseas regulation, such as the European Union's General Data Protection Regulation, and to sector codes of practice issued by bodies such as the Australian Evaluation Society or The Research Society.
Secure storage
The National Statement requires that data be stored securely to protect participant privacy and confidentiality. In practice this means:
- Storing data separately from identifying information where possible
- Restricting access to identifiable data to those who need it for the project
- Protecting data against unauthorised access, modification or loss
- Complying with applicable privacy legislation, including the Privacy Act 1988 (Cth) and relevant state or territory legislation
Storage location and sovereignty
For research involving Aboriginal and Torres Strait Islander peoples, data sovereignty principles require consideration of where data is stored and who controls access. The AIATSIS Code of Ethics and the terms of engagement agreed with the relevant community should govern data storage decisions for such research; see Aboriginal and Torres Strait Islander peoples (NS 4.7).
For international research, data may need to be stored within specific jurisdictions to comply with data localisation requirements. See Research in other countries (NS 4.6).
Related resources
This page was last updated on 16 September 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.