This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
Privacy in research
Researchers, evaluators, and review bodies must give appropriate attention to the identifiability of data and information, in order to assess the risk of harm or discomfort to participants or others (NS 3.1, Element 4). Privacy is a key dimension of respect for participants, and a privacy breach may itself constitute a harm.
Identifiability is a continuum, not a category
The National Statement deliberately does not treat "identifiable", "re-identifiable," and "non-identifiable" as fixed categories, because ambiguity in these terms can mislead researchers about the actual level of risk (NS 3.1, Element 4, footnote 6). Instead, identifiability is a continuum shaped by contextual factors, such as who has access to the information and what other information they hold, and by technical factors that can convert data intended to protect anonymity into data that can identify individuals. Re-identification and de-identification are best understood as processes that change the character of information, rather than as fixed end-states.
Risk is greatest where an individual's identity can reasonably be ascertained from an identifier, or a combination of identifiers, such as name, image, date of birth, or address. Risk can also arise where identifiers have been replaced with a code but re-identification remains possible, for example by unlocking the code or linking to another data set. The identifiability of information can also change during the life of a project: data may be collected in identifiable form, coded for analysis, and then rendered anonymous once the code key is destroyed. Researchers, evaluators, and reviewers should therefore assess the risk of harm at each stage of a project, not only at the point of collection.
Retaining identifiers
Removing personal identifiers is not always ethically required. Some projects legitimately need to retain identifiers, for example to link data from multiple sources, to return results to participants, or when they have consented to be contacted for future research that may be linked to their original data. Some participants (such as public figures or named collaborators) may prefer to be identified in the collection, use, and reporting of data (NS 3.1.39). Where participants choose to be identified, researchers should agree with them whether all data collected, or only certain elements, will carry their identity.
Minimising re-identification risk
Where identifiers are not required, researchers and evaluators should adopt methods to reduce identifiability during collection, analysis, and storage (NS 3.1.40), including:
- Minimising the number of variables collected for each individual
- Separating and separately storing identifiers and content information
- Separating the roles of those who manage identifiers from those who analyse content
Further practical strategies include:
- applying minimum cell size rules to disaggregated reporting;
- avoiding verbatim text that may identify individuals; and,
- restricting access to data that remains re-identifiable.
Identification in publications
In any publication, researchers and evaluators must ensure that a participant's identity cannot reasonably be ascertained from the data or information reported, unless the participant has agreed to be identified. This may require minimising, obscuring, or changing identifiers, either during collection or when presenting results (NS 3.1.41). Where research or evaluation involves linking data sets with participant consent, researchers/evaluators should tell participants that identifying information may be needed to ensure accurate linkage, and explain the security measures that will apply, such as removing identifiers once linkage is complete (NS 3.1.42).
IP addresses and other automatically collected identifiers
Online survey platforms routinely and automatically capture IP addresses, and this raises a specific identifiability question because an IP address may be personal information under the Privacy Act 1988 (Cth) depending on whether it could reasonably identify an individual in context. The identifiability of an IP address is affected by factors such as dynamic address allocation, shared addressing on mobile and public networks, and the use of VPNs, all of which typically make re-identification impractical though not impossible. A defensible approach is to use IP addresses only for quality control, such as detecting duplicate or fraudulent responses consistent with ISO 20252 quality requirements, to keep them separate from response content, and to delete them once quality checks are complete and before substantive analysis begins, with the approach documented in the data management plan and disclosed to participants. See IP address data in online research for detailed guidance.
Related resources
This page was last updated on 16 September 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.