This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
Overview
Secondary use of data means using data or information originally generated or collected for one research, evaluation, or non-research purpose (including routinely collected administrative data) for a different purpose. The National Statement addresses secondary use in NS 3.1.59-3.1.61, and the central ethical issue is the scope of the consent originally given, or the impracticability of obtaining consent for the new use.
Administrative and routinely collected data
Data collected routinely during service delivery, for example by a government department or private provider, may cover large numbers of people or whole populations, and it is usually impractical to obtain individual consent for its secondary use. Where consent cannot practicably be sought, respect for participants can still be demonstrated through community consultation, ensuring findings are translated into service improvements, acknowledging the source of the data in publications, and publishing results in a location and language accessible to the community concerned. Using such data without consent, or without these safeguards, risks undermining public trust in the confidentiality of information held about people.
Requirements for secondary use
Where data collected for one project is proposed for use in further research or evaluation, researchers, and review bodies must consider (NS 3.1.59):
- Whether consent for the secondary use was obtained at the time of initial collection, including under the extended or unspecified consent provisions (NS 2.2.14-2.2.16)
- Whether it is practicable to re-contact participants to seek consent for the new use, and whether the burden of re-contact on participants is proportionate, having regard to any ongoing relationship with them
- If consent was not obtained and re-contact is not practicable, whether a waiver of the requirement for consent is appropriate
Before publishing data or adding it to a repository, researchers should also consider whether the data could enable participants to be identified by other researchers or third parties (NS 3.1.60; see Privacy and identifiability).
Extended and unspecified consent
NS 2.2.14 distinguishes between
- specific consent (limited to the project at hand)
- extended consent (given for use in future research that is an extension of or closely related to the original project or in the same general area), and
- unspecified consent (given for use in any future research).
The necessarily limited information available when extended or unspecified consent is given can still be sufficient and adequate for consent purposes. Extended or unspecified consent may need to include permission to enter the data into a data bank (NS 2.2.15), and when unspecified consent is sought, its terms and wide-ranging implications must be clearly explained to participants and clearly recorded (NS 2.2.16). Where a project involves data that may be valuable for future research, seeking extended or unspecified consent at the outset is good practice; see Data sharing and retention.
Waiving consent for secondary use
Where consent for secondary use was not obtained and cannot practicably be sought, Chapter 2.3 of the National Statement governs whether the requirement for consent may be waived. Only an HREC may waive consent for research using personal information in medical research or personal health information; other review bodies may waive consent for other research (NS 2.3.9). Before waiving consent, the review body must be satisfied that the research carries no more than low risk, that the benefits justify the risk of proceeding without consent, that obtaining consent is impracticable, that there is no known reason to think participants would have declined if asked, that privacy and data confidentiality will be adequately protected, and that the waiver is not otherwise prohibited by law (NS 2.3.10). This is the waiver route referenced in the data management plan guidance at NS 3.1.44(j).
Identifiable data
Shared or banked data stored in a form that can identify individuals may sometimes be used in research that qualifies as lower risk research, but it cannot be used in research that is exempt from ethics review (NS 3.1.61, NS 5.1.16). This is an important constraint on the secondary use of identifiable data sets.
Secondary use in evaluation and quality assurance
The NHMRC's guidance on quality assurance and evaluation activities identifies secondary use of QA or evaluation data - that is, using data or analysis from a QA or evaluation activity for another purpose, as one of the specific triggers that should prompt consideration of ethics review, even where the original data collection did not itself require review (NHMRC QA and Evaluation Statement, section 2(e)). Practitioners planning to reuse evaluation data collected for internal reporting in a subsequent piece of research or a published output should treat this as a trigger to check whether ethics review, or an amendment to existing approval, is required.
Related resources
This page was last updated on 16 September 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.