This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
Overview
Research and evaluation may generate findings or information about third parties, including individuals, organisations, or communities who are not themselves participants, or about participants that a third party such as a commissioning body, employer, government agency, or media outlet wishes to obtain. Disclosure of such information is not a purely ethical question; it also engages legal obligations that sit outside the scope of ethics review.
General principles
Information generated in research and evaluation is collected within a relationship of trust between researchers/evaluators and participants. Where disclosure to third parties can be anticipated, researchers and evaluators should identify:
- whether, to whom, and in what circumstances findings will be disclosed;
- whether participants will be forewarned of the possibility;
- the risks of disclosure and how they will be managed; and
- the rationale for communicating or withholding findings, weighing the benefits and risks to participants of disclosure or non-disclosure (NS 3.1.65).
The Privacy Act 1988 (Cth) restricts secondary use or disclosure of personal information unless an exception applies. In general, personal information about identified or identifiable participants should not be disclosed to third parties without consent, unless disclosure is required or authorised by law.
Disclosure required or compelled by law
Researchers and evaluators should be aware that a court, law enforcement agency, or regulator may seek to compel release of findings, and should have a strategy for this possibility and advise the review body of the potential for it to occur (NS 3.1.66). Where the imperative to disclose emerges after research/evaluation has commenced, researchers and evaluators must develop a strategy for addressing this and promptly advise and seek advice from the review body (NS 3.1.67).
Legal disclosure obligations vary by jurisdiction and by the nature of the information involved, and determining them is a matter for legal advice rather than ethics review. As a general framework, three categories of situation are useful for planning purposes:
- Must not disclose: no legal authority or obligation permits disclosure, and the researcher/evaluator does not have participant consent to disclose.
- May disclose: legislation permits disclosure, such as an exception for a serious threat to life, health, or safety under the Privacy Act 1988 (Cth) Australian Privacy Principles, but no mandatory duty to report applies; or advance, free, and informed consent to disclose has been obtained.
- Must disclose: legislation imposes a duty to report, most commonly under child protection mandatory reporting schemes, offences for failing to report child sexual abuse, the Northern Territory's universal duty to report serious harm to children and serious domestic or family violence, and organisational duties under reportable conduct schemes.
Each Australian state and territory has its own privacy, health records, and mandatory reporting legislation, and whether a researcher is a mandatory reporter typically depends on their professional registration or role rather than the fact that they are conducting research. Because these frameworks differ materially by jurisdiction and can change, researchers conducting projects with a realistic prospect of encountering reportable disclosures should seek legal advice specific to the jurisdictions involved, rather than relying on general guidance. Iris Ethics can advise on the acceptability of a project design under the National Statement, but cannot provide legal advice on disclosure obligations as part of review.
Research that may discover illegal activity
Where research may foreseeably discover illegal activity but is not designed to expose it, researchers and evaluators should explain to participants, as clearly as possible, the possibility of such discovery and any resulting legal or other disclosure obligations, the extent to which information about illegal activity will be kept confidential and the response the researcher may be required to make under any legal obligation or order, and which interactions form part of the research/evaluation (NS 4.9.3). Researchers and evaluators must consider the use of pseudonyms, or removing the link between names and data, for participants whose illegal activity may be revealed (NS 4.9.4), and should be satisfied that participants subject to criminal justice processes are aware the research/evaluation may discover illegal activity and do not have unrealistic expectations of benefit from participating (NS 4.9.5). Where research or evaluation discovers information about illegal activity, researchers/evaluators and institutions may become subject to orders to disclose it to government agencies, law enforcement, or courts, and should consider seeking legal advice in that circumstance (NS 4.9.2). Research and evaluation intended to study or expose illegal activity, or likely to discover it, must be reviewed and approved by an HREC, except where it uses only non-identifiable data and may be eligible for lower risk review (NS 4.9.6). See Research that may discover illegal activity (NS 4.9) for the ethics review requirements that apply to this category of research and evaluation.
Contractual and commissioning disclosure requirements
Where research or evaluation is commissioned, contract terms may legitimately require disclosure of findings to the commissioning body before wider publication. This is a legitimate arrangement, provided it was disclosed to participants during consent, but it must not extend to suppressing findings or misrepresenting results, either of which would breach research integrity requirements. Researchers must disclose to the review body any restrictions on publication or dissemination of research or evaluation findings (NS 5.3.11). See Dissemination planning for the related requirements on disclosing publication restrictions and justifying them to the review body.
What to address in an ethics application
- Whether disclosure to third parties, including commissioning bodies, is anticipated, and on what basis
- Whether participants have been, or will be, forewarned of the possibility of disclosure
- Whether any statutory reporting duties apply to the research/evaluation team, jurisdiction by jurisdiction, and how this has been confirmed
- What participant information materials say about the limits of confidentiality
- What internal procedures exist for responding to a disclosure if it arises during the project
Related resources
This page was last updated on 16 September 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.