This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
Overview
Research using existing data or records means accessing and analysing data that was collected for a purpose other than the proposed research, rather than collecting new data from participants directly. This includes government and organisational administrative data, program and case records, data or biospecimens from earlier research projects, and commercial datasets such as market research panel records. The method-specific ethical question is not only whether the data can be used, addressed under Secondary use of data, but how a researcher lawfully gets to it in the first place, and what that route implies for data handling downstream.
Types of existing data used in evaluation and social research
Common sources include:
- administrative datasets held by government agencies (for example service usage, benefits, or education records);
- organisational or program records generated in the course of service delivery;
- datasets collected in a prior research or evaluation project; and
- de-identified or aggregated commercial datasets.
Each source carries a different combination of legal access requirements, custodian relationships, and identifiability, so the ethical assessment needs to be made against the specific dataset proposed, not against existing data as a generic category.
Access is separate from ethics approval
Ethics review does not itself authorise access to data. Approval from an HREC or other review body establishes that the proposed research use is ethically sound; separately, the researcher must obtain the data custodian's agreement to provide access, consistent with the Privacy Act 1988 (Cth), any state or territory equivalent, and the custodian's own data governance policies. These are complementary requirements, and an ethics approval is generally not sufficient on its own to compel a custodian to release data.
Consent, waiver, and re-use
Where participants consented, at the time of original collection, to future or unspecified research use of their data (NS 2.2.14–2.2.16), a proposed secondary use may proceed if it falls within the scope of that consent. Where no such consent was obtained, researchers must seek either re-consent from the individuals concerned or a waiver of the consent requirement from the relevant review body, which may be granted where the research is low risk and meets the conditions at NS 2.3.10*. Research using personal information without consent cannot be exempted from ethics review outright (NS 5.1.16). Secondary use of data sets out this consent framework, including the extended and unspecified consent mechanisms and the constraints on identifiable shared or banked data (NS 3.1.59–3.1.61), in more detail; this article focuses on the practical access and method questions that arise once the consent position is established.
De-identified data and exemption
Research using data that has been de-identified before it reaches the researcher, where re-identification is not reasonably possible and the researcher agrees not to attempt it, may qualify for a formal exemption from ethics review under NS 5.1.17(a). Institutions must keep a record of any decision to grant exemption (NS 5.1.18). The exemption does not apply where the research otherwise meets the triggers described in the NHMRC QA and Evaluation Guidance, and researchers should not assume de-identification without checking the criteria in full, since apparently anonymous fields (postcode, occupation, age bracket) can still permit re-identification in a small population.
What reviewers look for
- Whether the researcher has, or has a credible plan to obtain, lawful access to the data from its custodian
- Whether the proposed use is consistent with the consent or authorisation under which the data was originally collected
- Whether a waiver of consent is being sought, and whether it meets the NS 2.3.10* criteria
- Whether any claimed exemption on de-identification grounds truly meets the NS 5.1.17(a) criteria
Related resources
*NS 2.3.10 states:
Before deciding to waive the requirement for consent, an HREC or other review body must be satisfied that:
- (a) involvement in the research carries no more than low risk to participants (see Chapter 2.1)
- (b) the benefits from the research justify any risks of harm associated with not seeking consent
- (c) it is impracticable to obtain consent (e.g. due to the quantity, age or accessibility of records)
- (d) there is no known or likely reason for thinking that participants would not have consented if they had been asked
- (e) there is sufficient protection of their privacy
- (f) there is an adequate plan to protect the confidentiality of data
- (g) in case the results have significance for the participants’ welfare there is, where practicable, a plan for making information arising from the research available to them (e.g. via a disease-specific website or regional news media)
- (h) the possibility of commercial exploitation of derivatives of the data or tissue will not deprive the participants of any financial benefits to which they would be entitled
- (i) the waiver is not prohibited by state, federal or international law.
This page was last updated on 7 October 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.