In Australia, the principles for responsible conduct of research with or about humans are established by the Australian Code for the Responsible Conduct of Research (2018). This framework supports high-quality research, strengthens reliability, and promotes trust within the community. Adherence to the Code is a prerequisite for funding from research grant bodies, including VLF.

It is your responsibility to conduct ethical research, data collection, and data management practices when undertaking any project funded through Victoria Law Foundation’s Grant Program. If you are undertaking research in collaboration with another organisation or other people, you must ensure that they understand their responsibilities and agree to abide by the following standards and principles.

There is no ‘one size fits all’ approach to ethical research. While we provide a range of resources and information to help you plan your activities, they are a starting point and should be tailored to the nature and purpose of your research and the needs of all participants.

Need help?

Please contact us if you have any questions. Some of the things we might be able to help with include review of documents such as a risk analysis, consent and participant information forms or data security and storage protocols.

If you need further information or support, please contact the Grants Manager

Overarching research values and principles

Ethical conduct of research within your organisation will be informed by the specific values and principles that underpin all your work. In addition, it is important to ensure that all research activities involving human participation align with the values outlined in the National Statement: respect for human beings, research merit and integrity, justice, and beneficence.

Applicable standards

When undertaking research, it is your responsibility to ensure that all parties involved in carrying out the research project are aware of and comply with the relevant guidelines, codes and legislation relating to ethical research in Victoria, including:

• Privacy and Data Protection Act 2014 (Vic)
• Privacy Act 1988 (Cth)
• The Australian Privacy Principles (Privacy Amendment- Enhancing Privacy Protection- Act 2012, Sched 1)
• National Health and Medical Research Council, Australian Research Council and Universities Australia. Australian Code for the Responsible Conduct of Research (2018). Commonwealth of Australia: Canberra.
• National Health and Medical Research Council, Australian Research Council and Universities Australia. National Statement on Ethical Conduct in Human Research (‘National Statement’) (2025). Commonwealth of Australia: Canberra.
• Australian Institute of Aboriginal and Torres Strait Islander Studies (AIATSIS). AIATSIS Code of Ethics for Aboriginal and Torres Strait Islander Research (2020). AIATSIS: Canberra.
• Australian Institute of Aboriginal and Torres Strait Islander Studies (AIATSIS). A Guide to Applying the AIATSIS Code of Ethics for Aboriginal and Torres Strait Islander Research (2020). AIATSIS: Canberra.
• National Health and Medical Research Council, Ethical conduct in research with Aboriginal and Torres Strait Islander Peoples and communities: Guidelines for researchers and stakeholders (2018). Commonwealth of Australia: Canberra
• National Health and Medical Research Council, Keeping Research on Track II: A companion document to Ethical conduct in research with Aboriginal and Torres Strait Islander Peoples and communities: Guidelines for researchers and stakeholders (2018). Commonwealth of Australia: Canberra.
• Williams, M. & Ragg, M. (2023), Research protocol checklist, Yulang Indigenous Evaluation. Produced with the support of Justice Health and Forensic Mental Health Network and the Aboriginal Health and Medical Research Council of NSW, this checklist can be used to support the development of research proposals. It combines questions that respond to the National Statement guidelines, AIATSIS core values, and specific considerations for research among people in criminal legal system custody.

While this material can appear daunting for first-time researchers, remember that these standards are used by researchers every day to support them to deliver their work. As research technologies and norms change over time, these standards undergo regular review, so they don’t need to be memorised.

For every research project, the extent to which you engage with the standards will depend upon the scope and scale of your research and the type and level of associated risks. Guidance material and tips to get started follow.

Practical information to consider when developing a research project

Understanding ethical risks

All research involving people and their personal information has a level of risk involved. When considering ethical risks to participants, we are asked to think of all possible risks of harm or discomfort that a participant may be exposed to through the research. This may involve physical, psychological, economic, social, legal, and environmental harms, among others.

Risks may arise by virtue of participating in the research, or from the potential outcomes of the research. Discomfort or harm could arise because of a breach in research protocols, for example, if a participant’s personal information is shared without their consent. The research process itself may cause participants anything from minor inconvenience to discomfort or serious harm, for example, if the research questions ask participants to consider distressing issues or experiences.

Research may also involve burdens or inconvenience to the research participants. These must also be weighed against the potential benefits of the research to ensure they are not overly onerous.

Managing ethical risks

Ethical risk assessments require consideration of the likelihood of the risk occurring and the severity of the impact or consequence if the risk does occur.

Because the nature of research and data collection conducted for VLF grant projects varies, ethical considerations and requirements for specific projects also vary. As a general rule, the greater the potential for and impact of detrimental impacts on participants, the greater the efforts to try to mitigate that risk that are likely to be required.

While some level of risk will always remain, it is important to develop a risk management plan to reduce the likelihood of a risk event and the severity of its impact, should it occur.

Once a risk management plan has been developed, use a risk matrix such as the one below to assess the inherent risk before the implementation of any risk minimisation, mitigation, or management strategies, and the remaining risk after these strategies have been implemented. This remaining risk will determine the level of review required for the research project.

‍

The following questions will help you to consider the potential risks for participants and how you might minimise them to the greatest extent possible.

• Does the research directly involve potentially vulnerable groups (for example, children and young people, people experiencing disadvantage, victims of family violence)?
• Does the research involve discussion of sensitive topics (for example, family violence, sexual or physical assault, mental health, addiction), including those that risk causing psychological stress, anxiety, harm or negative consequences beyond what would be normally encountered by the participants in their life outside research (e.g. are you asking participants to think about or recount traumatic past experiences)?
• Does the research involve data that could identify participants (for example, forms that contain participant’s names, date of birth, other personal details, or participant responses that contain specific details that could identify them, if published)?
• Can you minimise the likelihood of discomfort and harm to participants, by, for example:
  
  • using trauma-informed and culturally appropriate practices when designing the research activities?
  • Data collection and ethics standards ensuring participants accessibility needs are met during their recruitment and participation
  • reducing or removing questions that ask participants to share personal experiences, or that may otherwise prompt disclosures of abuse or trauma?
  • reminding participants that they do not have to answer any questions they do not want to answer?
• Can you mitigate the severity of discomfort and harm to participants, by, for example:
  
  • establishing distress protocols and having relevant services available if people experience distress?
  • ensuring sufficient staff are present during research activities to respond appropriately to possible risks?
  • ensuring that the research does not compromise the safety of participants, including in the dissemination of recruitment information, the location and requirements of research activities, and the publication of research findings?

Risk assessments and ethics approval

You will need to ensure that your project is approved by an appropriate review body before you begin your activities.

If your research project is classified as lower-risk research, the project may be approved by an internal committee or review body in accordance with Chapter Five of the National Statement. Higher risk research will need to be approved by an accredited Human Research Ethics Committee (HREC).

Use the following table to identify the required ethics process for your project, based on the overall risk rating.

Ethics Exemptions

Research that may be eligible for exemption from ethics review includes research of ‘lower risk’ (highly unlikely to cause distress or harm to anyone involved), that does not involve the use of personal information without consent, without a specific focus on Aboriginal and Torres Strait Islander Peoples and communities, and that meets one or more of the following criteria:

• All personal identifiers have been removed prior to being analysed and that those conducting the activity agree:
  
  • not to attempt re-identification of the information.
  • to take all reasonable steps to prevent re-identification of the information or data for unauthorised purposes or access to the information or data by unauthorised parties, and
  • that any sharing of any research data during or after the project will not create any additional risks of re-identification of the information or data.

OR

• The research is restricted to surveys and observation of public behaviour using information that was or will be collected and recorded without personal identifiers and is highly unlikely to cause distress to anyone associated with the information or the outcomes of the research.

OR

• The research is conducted as part of an educational training program in which the research activity is for training purposes only and where any outcomes or documentation are for program use only.

OR

• The activity ONLY uses information that is publicly available as set out by legislation or regulation, such and data and reports published by the Australian Bureau of Statistics.

Monitoring risks and incidents

Establish a schedule for monitoring and reviewing how the research project is proceeding, including:

• Any changes to approved methods or processes.
• Identifying any ethical risks, adverse events, feedback or complaints arising during the implementation of the activity.
• Developing actions and responsibilities for responding to risks, adverse events, feedback or complaints.
• Monitoring any effects of the actions taken, in a timely way.
• Promptly advise relevant stakeholders

Delegate organisational responsibility and put in place mechanisms to ensure secure retention and disposal of any information collected, at the right time, beyond the completion of the research project.

Key responsibilities in conducting ethical research

Your responsibilities to conduct ethical research begin before you start, carry on throughout the life of the project, and continue even after your activities have finished.

Some key elements at each stage.

Before starting

• Complete a research plan that includes appropriate consideration of research ethics. This includes clearly describing the benefits, burdens, and risks associated with the research.
• Establish an appropriate governance structure for the research project, including mechanisms/protocols for addressing feedback, complaints, and adverse events.

Research is only ethically acceptable when the potential benefits outweigh the potential risks and burdens to individuals, groups, communities, or broader society.

During the project

• Ensure that everyone involved in the research is appropriately trained and supervised and has access to psychosocial support.
• Document any changes to the research plan and seek ethics approval as required before you implement the change.
• Communicate any ethical issues or incidents in a clear and timely way to all relevant stakeholders, including the VLF.

After the project

• Communicate the findings to stakeholders, including the public, when appropriate.
• Ensure your data retention, storage, and destruction processes align with policies and legislative requirements.
• Resolve any outstanding ethical concerns arising from the project with due respect and regard to all the interests in the project.
• Consider what learning and improvement opportunities from the project may be relevant for future research, and ensure they are appropriately documented.

Confidentiality

To protect privacy and confidentiality it is important to consider your processes at every stage of handling data.

When preparing to collect data, consider:

• ‍

documenting the planned identity and information protection processes and providing training for those involved.

limiting the amount of data/information collected, particularly data that could identify an individual or that is otherwise sensitive, unless it is necessary for the purpose of the research.

the nature of the participant group and the potential for, and possible impacts of, re-identification through publication/dissemination of findings (e.g. the involvement of public figures, members of small groups/communities).

When collecting data, consider:

• the nature of research activities and how to protect against participants sharing information in an unauthorised way (e.g. during or after group discussions).
• whether the data needs to be collected in certain formats to enable data protection processes to be put in place (e.g. digital vs hard copy, recording to a device and/or to cloud storage).
• whether any third-party software or personnel that you are engaging have sufficiently secure data storage protocols in place, and if you have considered all the risks involved.

When storing data, consider:

• who should and shouldn’t have access to the data/information.
• where other bodies or organisations are involved in the research, developing a data sharing agreement and provide training or access to software/systems as needed.
• storing identifying information in a separate document or folder from other (response) data collected from participants.
  
  • Tip: consider allocating an individual code to each participant if you need to link the data sets (noting the need to prevent unauthorised people from doing so).
• using appropriate techniques to protect the information, such as:
  
  • developing data transfer protocols between organisations.
  • using password protections on raw data files.
  • limiting access to data by creating secure folders accessible by relevant staff only.

When analysing and reporting data, consider:

• redacting data, including qualitative responses, if they contain potentially identifying information.
• ensuring minimum subgroup sizes are set if disaggregating data, to produce reliable results and prevent participant re-identification in the reporting of findings.
• whether the framing of results/findings might be used disingenuously to promote discrimination towards specific groups based on race, class, gender or sexuality, religion, physical ability or psychological condition, or other social marker, and how to minimise the misrepresentation of findings.

When disposing of data, ensure:

• research data has been kept for the minimum mandatory period required under relevant regulations.
• personal data is not kept for longer than the maximum period under relevant regulations, unless for a permitted purpose.

Informed consent

Information provided prior to seeking consent should be proportionate to the activity and be designed to enable participation.

As a minimum, the following information should be shared in plain language and accessible formations, before you begin the research/ data collection activity:

• The purpose/s of the research
• What the participant will be asked to do
• What will be done with the participant’s data and other contributions (including who will have access to it, in what forms)
• How findings will be published or otherwise used
• At what stage, if any, the participant will no longer be able to withdraw their consent, and
• Contact information for any complaints, questions, or feedback.

Informed consent can be implied (for example, such as by completing a survey), opt-out (for example, filming in a public space), verbal, or written. Implied or opt-out methods should only be used where the risk to participants is low to minimal.

Questions to support your informed consent planning include:

• What is the key information you need to provide to participants to ensure they are sufficiently informed about the research project?
• What may be the best way/s to provide this information, considering the nature of the research, and the participants involved? Are there any participant age, capacity, or cultural considerations that need to be factored into information and consent processes?
• How will you seek or interpret consent to participate? How will you check that participants understand what they are consenting to?
• How will you explain ongoing consent (and the right to withdraw) to participants? Has your research been designed so that results will be meaningful regardless of participant withdrawal?
• Do you need approval or consent for participation from anyone else (e.g., parents, legal guardians, community leaders, sector peak bodies)? When should this be sought?
• Do you have the resources and setup (e.g. personnel, communication channels) to ensure participants can contact the research team if they have questions or want to withdraw from the project?
• Is reimbursement for participation appropriate and available? Are you confident that any financial reimbursements are not incentivising participants to engage in research if it exposes them to risk of harm?
• Do you understand the rights that participants have regarding the use of their data, and are you complying with relevant policies and legislation?

For further support, refer to the Informed Consent checklist and Participant information sheet and consent form template.

Avoiding unexpected delays, costs and roadblocks

What to consider before starting to undertake research

Victoria Law Foundation is not an ethics review body, but we can offer support to review documents and research plans.

Before starting your research, we strongly recommend that you review the documents under ‘Getting started’, in particular, the National Health and Medical Research Council (NHMRC) National Statement on Ethical Conduct in Human Research (2023) (‘National Statement’), which is considered best practice.

We recommend that your Board or management team develop specific guidelines, processes and/or policies before any research project to ensure that your organisation complies with best-practice ethics standards in the collection, use, storage and disposal of data and information. The National Statement can inform this process.

When developing your research proposal, it is important to keep the following resourcing and process considerations in mind.

Partnering with a university/research body

If you are doing research with an academic or team affiliated with a university, you will need to go through their research ethics body. Depending on the ethical risk level of the research, this process can take 3-6 months, and may take longer if significant revisions are required. Factor this into your project timeframes at the beginning to avoid problems down the track.

Undertaking higher risk research

Higher risk research has greater ethical considerations and requirements. Often risk to human participants will be low, or appropriate procedures and practices can be put in place to mitigate risk, but irrespective, an ethical risk assessment must be conducted to determine the ethical risk rating for your research project. If your project has a higher ethical risk, or if you are doing research on or with the specific cohorts listed below, you will not be able to use an internal body for ethics approval and will need to go through an accredited human research ethics committee (HREC).

Cohorts identified in the National Statement as requiring HREC review

• People who are pregnant and the human fetus
• People highly dependent on medical care who may be unable to give consent
• People with a cognitive impairment, an intellectual disability, or a mental illness that may impact on their ability to give consent
• People who may be involved in illegal activities
• Aboriginal and Torres Strait Islander Peoples
• People in other countries

Other cohorts for whom specific ethical considerations apply:

• Children and young people
• People in dependent or unequal relationships

Refer to Chapter Four of the National Statement for further details.

If you are interested in doing research on or about these groups without directly engaging with them, see Doing research with lived/living experience: Benefits and challenges.

If your research is higher risk, and you are partnering with an academic institution, you will be required to go through their HREC. While there is no cost for HREC applications for affiliated research, it can be a time-consuming process (up to six months). If you are not partnered with an organisation that has its own HREC, you will need to investigate your eligibility for academic or public HREC services. For-fee HREC services are an expensive option ($4,000-6,000) but tend to be significantly faster.

A full list of HRECs certified and registered with the NHMRC are available online: List of Human Research Ethics Committees registered with NHMRC.

Using administrative data

Using data that has been collected for administrative purposes can be a sound way to reduce the time and cost of research for your organisation and the burden of over-consultation on participants. However, you must ensure that your organisation is complying with all relevant data privacy and protection legislation and ethical protocols if you choose to do this, including having the organisational systems in place to ensure safe and confidential transfer and storage of data.

If administrative data is likely to be an ongoing source for research and evaluation activities, it may be worth reviewing the terms and conditions (including data privacy statements) that clients accept when accessing your service to include a ‘future use’ consent clause that includes use for research and evaluation, and in any reporting and publication. For example, it is common for organisations to use administrative data for research and evaluation to understand and improve their operations, but only in an aggregate and de-identified form.

If you haven’t received prior consent to use administrative data for research (including for any future publication or presentations), it is important to consider how to respect the expectations that clients are likely to have about how their data is used. You would also be expected to acknowledge the data source(s) in any research publications. It is important to consider that using data or information without consent, or beyond privacy expectations, may, in some instances, undermine trust.

Refer to National Statement § 3.1.50- 3.1.53 for guidance regarding the secondary use of administrative data or information, such as for research.

Requesting data from courts, tribunals, or other third parties

Courts and tribunals will often have standard policy approaches to handling requests for access to court data or information for the purposes of research. If you are requesting statistical information that can be readily generated by their case management system, this will likely be a routine process through the local or national registry. If you are requesting access to court data, files or other records, or interviews with Judges, parties or lawyers, the assessment will often require a more detailed review, and specific application processes. It is also common to require permission from the court or tribunal before publishing or releasing any data or information that you have received. Consider that these bodies may seek to recover costs associated with fulfilling the request, and that the requests may also be denied. If you make an FOI request to a Victorian public sector agency and your request is denied, you can make a complaint to the Office of the Victorian Information Commissioner (OVIC) to request a review of the decision.

Refer to the following decision tree to quickly identify the common causes of delay, cost, and other barriers to moving ahead with a research project.

Further information and resources on ethical research practice

If there is a topic you would like more information on or would like to discuss how we might support you to develop your research project, please contact the Grants team

Digital data management

Stanford Center on Philanthropy and Civil Society (2024), Digital Impact Toolkit, Stanford PACS. This tool was developed by the Digital Civil Society Lab to support civil society organisations to use digital data ethically, safely, and effectively.

Intellectual Property (IP) and Indigenous Data Sovereignty

The National Principles of Intellectual Property Management for Publicly Funded Researches were developed by a working party of the Australian Government’s Coordinating Committee on Innovation and adopted by the NHMRC in 2013. They support the ethical management of IP arising from publicly funded research.

The Lowitja Institute, Indigenous Data Sovereignty Readiness Assessment and Evaluation Toolkit has been developed to support a whole-of-organisation approach to embedding Indigenous Data Sovereignty principles and practices in research organisations and is available to Lowitja members.

Collecting gender, sex and sexuality information

Data about sexual orientation is considered sensitive and its collection has privacy implications. Ensure that you consult relevant privacy legislation, including the Health Records Act 2001 (Vic) and the Privacy and Data Protection Act 2014 (Vic).

Government guidelines on collecting gender, sex and sexuality information, including the Australian Government Guidelines on the Recognition of Sex and Gender and the ABS Standard for Sex and Gender Variables (2016) can provide some basic guidance on when and how to collect information on gender, sex and sexuality. However, these guidelines and standards have limitations in how they suggest researchers collect information on gender/sex categories, including by suggesting terminology for intersex and non-binary people that can be stigmatising or inaccurate such as ‘other’ or ‘indeterminate’. It is important to include gender diverse people from your community/ies in your research and ensure that your data collection methods are sensitive, appropriate and equitable in how they operate. Staff training and other resources that may assist your organisation to conduct ethical research with LGBTQIA+ people include:

• Member Training Courses from LGBTIQ+ Health Australia member organisations
• Rainbow Health Australia’s Rainbow Tick Standards

Collaborative research with Aboriginal and Torres Strait Islander communities/organisations

Williams, M. & Ragg, M. (2024). Checklist: Where does power lie in a partnership? Yulang Indigenous Evaluation. This is a useful tool for both parties in collaborative or partnered research where Aboriginal and Torres Strait Islander organisations and/or communities are working with non-Aboriginal bodies, including government and CLCs.

Trauma-informed research practice

If you are working with people who are likely to have, or are continuing to experience trauma, it is vital to undertake research using trauma-informed principles. This is critical both for participants and for researchers.

A trauma-informed research practice involves understanding the impacts of trauma on people involved in the research (participants, researchers, and other key stakeholders) while applying strategies to minimise further trauma, including through the research methods and outputs. It involves supporting people to safely navigate through the research process with appropriate recognition of individual agency and autonomy.

It is important to undertake a context-specific and culturally safe approach to developing your trauma-informed research practice.

Additional information and support can be found at:

• AIFS Practice Guides: Principles for doing trauma-informed research and program evaluation and How to do trauma-informed research and evaluation
• DFFH Victoria Framework for trauma-informed practice
• CASA House professional training sessions

Ethics and AI in research

The use of AI (including generative AI and machine learning) in research requires careful consideration. While AI can provide efficiency benefits in under-resourced environments, there are risks that will require appropriate mechanisms to be put in place, depending on the nature of the research and the tasks that AI is undertaking.

Key considerations include:

Data privacy and security – ensuring that the use of AI does not interfere with respect for individual privacy and adherence to data protection laws

Risk of bias – considering the risk of doing further harm to marginalised or discriminated individuals and communities if learning is built on biased data

Transparent decision-making – ensuring that the legitimacy of the research and its findings is not undermined by a lack of clear reasoning (the ‘black box’ of AI decision-making)

Responsibility and oversight – understanding the importance of the human element at every stage, particularly in checking for ‘hallucinations’ and contextual accuracy.

The use of AI in any part of the research process should be declared by the research team to promote transparency and ensure appropriate verification can be made by any audience, including reviewers.

Further support:

• Australia’s AI Ethics Principles

Templates

You might like to use or adapt the following templates.

• Template Participant information sheet and consent form
• Informed consent checklist