This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
Overview
Research sometimes discovers illegal activity by participants or others, whether the research is intended to expose it, likely to discover it without being designed for that purpose, or discovers it inadvertently. Chapter 4.9 of the National Statement addresses the ethical questions this raises for researchers, reviewers, and institutions; it does not itself set out researchers' specific legal obligations, and it is not the role of an HREC to give legal advice on those obligations (NS 4.9, Introduction).
What Chapter 4.9 requires
Where research is designed to study or expose illegal activity, participants may be exposed to risk because of their involvement, and researchers must establish that these risks are justified by the value of the research, including the value of the exposure itself, for example where the illegal activity concerns the discharge of a public responsibility or fitness to hold public office (NS 4.9.1). Where research discovers information about illegal activity, researchers and institutions may become subject to orders to disclose that information to government agencies, law enforcement, or courts; in these circumstances, they should consider seeking legal advice (NS 4.9.2).
In research that may foreseeably, but is not designed to, discover illegal activity, researchers must explain to participants as clearly as possible:
- the possibility or likelihood of such discovery and any resulting legal or other disclosure obligations;
- the extent to which the researcher will keep information about illegal activity confidential, and how the researcher may be required to respond to legal or other obligations or orders to disclose; and
- which interactions and activities form part of the research and which do not (NS 4.9.3).
Researchers must consider using pseudonyms or removing the link between names and data for participants whose illegal activity may be revealed or discovered (NS 4.9.4), and must be satisfied that participants who are subject to criminal justice processes are aware the research may discover illegal activity and do not hold unrealistic expectations of benefit from participating (NS 4.9.5).
Research intended to study or expose illegal activity, or likely to discover it, must be reviewed and approved by an HREC, unless it uses only non-identifiable data collections, in which case it may be eligible for lower risk review (NS 4.9.6; see Lower risk vs full HREC review).
Confidentiality and the limits of disclosure
Outside these National Statement requirements, researchers carry separate legal obligations under Commonwealth, state, and territory law that determine when confidentiality can, or must, give way. These obligations exist independently of the research context, but are commonly engaged by disclosures made in interviews, surveys, and focus groups. They fall into three categories:
- Must not disclose: no legal authority or obligation permits disclosure, and the participant has not consented to it
- May disclose: legislation permits disclosure, such as if a serious threat exception in privacy or health records law, but no mandatory reporting duty applies; or if the participant, or someone with legal authority to consent on their behalf, has given advance informed consent to disclosure
- Must disclose: legislation imposes a duty to report, including mandatory reporting to child protection authorities, offences for failing to report child sexual abuse, the Northern Territory's universal duty to report serious child harm and domestic violence, and organisational duties under reportable conduct schemes
At a Commonwealth level, the Privacy Act 1988 (Cth) and the Australian Privacy Principles restrict disclosure of personal information unless an exception applies, including where disclosure is required or authorised by law or necessary to lessen or prevent a serious threat to life, health, or safety where consent cannot practicably be obtained. Equivalent state and territory privacy and health records legislation applies in parallel, and mandatory reporting duties for child protection exist in every jurisdiction, with the Northern Territory alone imposing a universal duty on all adults to report serious child harm and domestic violence. This is general information, not legal advice; researchers should seek their own legal counsel on specific disclosure questions, consistent with NS 4.9.3, and should consult Disclosure to third parties for the related question of disclosing research findings more generally.
Designing for this in advance
Applicants should be able to show that they have:
- identified the statutory limits on confidentiality relevant to the jurisdictions in which the research will occur,
- determined whether any member of the research team is a mandatory reporter,
- understood the circumstances in which a duty to report child sexual abuse arises,
- considered whether the hosting organisation is subject to a reportable conduct scheme,
- drafted participant information that explains the limits of confidentiality in plain language, and
- developed an internal procedure for responding to disclosures if they occur.
Building this into the consent materials and data management plan at the design stage, rather than improvising a response after a disclosure occurs, is what reviewers look for.
Related resources
This page was last updated on 16 September 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.