This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
Ethics approval is not the whole answer
Ethics approval confirms that an activity is ethically acceptable under the National Statement. It does not confirm that the activity is lawful, and it does not override privacy or health-information law, nor the separate institutional authorisation described at Ethics review and other approvals (NS Chapter 5.1, Introduction). Those legal obligations sit underneath ethical review and vary by jurisdiction, so evaluators and researchers working across state and territory borders are often subject to several regimes at once.
This is general guidance, not legal advice. For specific questions about obligations in a given jurisdiction, you should engage legal counsel.
Privacy law
The starting layer is the Privacy Act 1988 (Cth) and the Australian Privacy Principles, which apply to Commonwealth agencies and many private-sector organisations. Most states and territories then have their own frameworks, including Victoria's Privacy and Data Protection Act 2014 and Health Records Act 2001, New South Wales's Privacy and Personal Information Protection Act 1998 and Health Records and Information Privacy Act 2002, Queensland's Information Privacy Act 2009, the ACT's Information Privacy Act 2014, Western Australia's Privacy and Responsible Information Sharing Act 2024, Tasmania's Personal Information Protection Act 2004, and the Northern Territory's Information Act 2002. . South Australia has administrative rather than comprehensive statutory privacy arrangements. The common thread is that identifiable personal information generally cannot be used or disclosed without consent unless an exception applies. Where a project needs to use personal information without consent, that requires a waiver granted by an ethics review body against the conditions in NS 2.3.10; it is not a decision a researcher or evaluator can make alone.
Health information
Health information is a category of sensitive personal information that attracts extra protection, in two situations that are sometimes conflated. The first is collecting health information directly from participants, such as a survey that asks about diagnosed conditions, medications, or mental health; even an otherwise low-burden survey engages the relevant health records and health privacy law once those questions are included, affecting how responses are collected, stored, and disclosed, and what participants must be told.
The second is using or accessing health information that already exists. Where a project wants to use health information held by a Commonwealth agency without consent, the NHMRC's Section 95 guidelines apply. Where the information is held by a private sector organisation, the Section 95A guidelines apply. In each case, an HREC must be satisfied that the public interest in the research substantially outweighs the public interest in privacy. Projects involving linked administrative data carry heavier governance again, typically needing three separate approvals: ethics review by an HREC, approval from the relevant data linkage unit, and sign-off from each data custodian whose dataset is involved.
Working across jurisdictions
A program evaluation that asks participants about chronic illness or prescription use has introduced health information, so the design must satisfy the applicable state or territory health-privacy law in addition to ethics review, and participant materials must explain plainly how the information will be handled. A project linking program participation records to hospital admissions and Medicare or PBS data is looking at HREC review, a data linkage unit, multiple data custodians, and possibly a consent waiver under the Section 95 or 95A guidelines, with realistic timelines to match.
The practical approach is to map jurisdictions and data types at the design stage, not after approval: work out which privacy schemes apply, whether health information is involved, and whether anything needs to be linked. Where research may foreseeably discover illegal activity, researchers and institutions who become subject to disclosure orders should consider seeking legal advice (NS 4.9.2).
Related resources
- Ethics review and other approvals: how ethics review, legal compliance, and institutional authorisation relate to one another
- Government review bodies: separate approvals needed for research in schools, health services, and justice settings
- Research that may discover illegal activity (NS 4.9) and mandatory disclosure obligations: disclosure obligations where illegal activity is discovered
This page was last updated on 9 October 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.