This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
Data sharing
The National Statement encourages sharing research and evaluation data and outcomes where appropriate, because sharing supports the transparent and cumulative nature of knowledge, and because researchers/evaluators should generally collect and store data so that it can be used in future research or evaluation unless there are justifiable ethical reasons not to, such as cultural ownership or unmanageable privacy risk (NS 3.1.49). Where data is deposited in an open or mediated access repository, or shared with other researchers/evaluators, an identified custodian must be able to enable access while keeping the data protected (NS 3.1.54). Researchers and evaluators must develop a data management plan covering the sharing arrangement (NS 3.1.55; see Collection and storage), make data custodians aware of any confidentiality agreements or conditions on identifiability or re-use (NS 3.1.56), and ensure that sharing between collaborators and sites is secure and proportional to the ethical sensitivity of the information (NS 3.1.57). Proposals to share or disclose data should distinguish between disclosure to specific third parties, sharing with other researchers/evaluators, and disclosure to the public, and should clarify whether the sharing is subject to participant consent, other agreements, or mandatory requirements (NS 3.1.58).
Participants should be informed at the time of initial consent of any expectations or policies about sharing or re-use of their data, and given appropriate options, including extended or unspecified consent to future research (NS 3.1.59, NS 2.2.14-2.2.16). If consent to future use was not obtained at collection, the review body may consider a waiver of consent or whether additional consent should be sought, taking into account any ongoing relationship with participants and the burden of re-contact. Before publishing data or adding it to a repository, researchers should consider whether the data could allow participants to be identified by other researchers/evaluators or third parties (NS 3.1.60). Data stored in a form that can identify individuals may sometimes be used in lower risk research or evaluation, but cannot be used in research or evaluation that is exempt from ethics review (NS 3.1.61, NS 5.1.16).
Data retention
The National Statement does not set a fixed retention period. It requires that, with respect to retention, storage, and eventual disposal of data, researchers
- adhere to the principle of respect for persons, including the culture and beliefs of participants;
- maintain confidentiality in accordance with any assurances made to participants; and
- comply with applicable national, state or territory codes and legislation (NS 3.1.72).
Data of cultural, historical, or other significance may warrant retention beyond the minimum period, and disposing of it without considering this violates the principle of respect (NS 3.1.73). The Australian Code for the Responsible Conduct of Research is the relevant national reference point for retention practice generally, though the specific period appropriate to a project depends on the type of research, applicable legislation, and the terms of ethics approval.
Two further sources of guidance can produce different answers for the same project, and researchers should understand the distinction between them. The NHMRC's guide to the Australian Code for the Responsible Conduct of Research suggests, as a general rule of thumb, that research data be retained for a minimum of five years from the date of publication, varying by research type. By contrast, the Privacy (Market and Social Research) Code 2021, a registered Australian Privacy Principles code under the Privacy Act 1988 (Cth) binding on members of the Australian Data and Insights Association, requires that identifiable research information be retained only while it continues to be necessary for the purpose for which it was collected, and be destroyed or de-identified once that purpose is achieved. Iris Ethics' position is that, for the market research, social research, and evaluation projects it reviews, the Privacy (Market and Social Research) Code 2021 carries legislative weight and takes precedence over the NHMRC's general guidance, particularly for data that includes identifiable information about participants who have not consented to publication of that identifiable data. See Iris Ethics Position Statement: Data retention in evaluation and research.
In practice, this means retention periods will vary by project, by the type of data collected, and by the permissions participants have given, and researchers should treat the minimum necessary period as the default rather than a fixed term. Indefinite retention may occasionally be justified, for example where the data is the only remaining record of the research or evaluand, but this is the exception and must be clearly documented. De-identified data should still be treated as potentially re-identifiable in combination with other information, and secured accordingly.
Researchers and evaluators must describe their retention and disposal approach in ethics applications, including:
- How long data will be retained, with a rationale referencing the applicable NHMRC and OAIC guidance
- Where data will be stored during the retention period
- Who will have access to retained data
- How data will be securely destroyed or de-identified at the end of the retention period (NS 3.1.48)
Participant rights and retention
Participants are entitled to withdraw from research or evaluation at any stage, and must be told before consenting about any consequences of withdrawal, including whether it will be possible to withdraw their data (NS 2.2.20, NS 3.1.31). Once data has been de-identified or published, withdrawal is no longer practically possible, so participants should be told at what point withdrawal ceases to be available. Where a participant withdraws, data collected before withdrawal may generally be retained for the purposes of the research or evaluation, provided the consent process specified this outcome at the outset.
Related resources
This page was last updated on 16 September 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.