Research ethics, consent and confidentiality in Australia: respecting the people behind the data (Research and Evidence for Better Decisions) | READOS

Every survey, interview, observation and analysis of customer or staff data involves people. They give time, opinions, personal details and sometimes sensitive information. They trust that what they share will be used for the stated purpose, kept secure and not turned against them. When that trust is honoured, people participate openly and the evidence is better. When it is broken, through careless handling of data, comments traced back to individuals, surveys used as disguised sales pitches or information used for purposes nobody agreed to, the damage extends beyond one project: people stop participating, stop speaking candidly and stop trusting the organisation.

Universities and health researchers in Australia work under formal ethical guidelines, with research ethics committees reviewing their projects. Most business research does not require formal ethics review, but the same principles apply: respect for participants, research that is worth doing and done competently, fairness in who bears the burdens and benefits, and care to avoid harm. Business research must also comply with privacy law, spam and telemarketing rules and workplace obligations where they apply.

This article explains the core ethical principles, informed and voluntary consent, minimising harm, the difference between anonymity and confidentiality, research with staff and vulnerable participants, incentives, honesty, privacy obligations, secure handling and retention of data, the use of automated tools and how to report findings without exposing individuals. It is part of a series on research and evidence for business decisions and is general information, not legal advice.

Core principles

Australia’s national guidance for human research, developed for universities, health services and research institutions, rests on values that translate readily to business research:

Research merit and integrity: research should be worth doing, well designed and honestly conducted and reported.
Justice: the burdens and benefits of research should be fairly distributed, and participants should be selected fairly.
Beneficence: the likely benefits should justify any risks, and harm should be minimised.
Respect: participants’ autonomy, privacy and welfare should be respected.

A useful test for any business research is whether participants would feel fairly treated if they understood exactly what was done with their information.

Participants should understand what they are agreeing to before they take part. A clear invitation or information statement covers:

who is conducting the research and why;
what participation involves and how long it takes;
whether participation is voluntary, and that declining has no consequences;
how information will be used, stored, shared and eventually deleted;
whether responses are anonymous or confidential;
any risks or discomfort, and how they are managed;
how to withdraw; and
who to contact with questions or concerns.

For surveys, consent is often given by proceeding after reading the information. For interviews, especially if recorded, explicit consent should be obtained and noted. Consent should be specific: agreeing to a customer satisfaction survey is not agreement to receive marketing.

Voluntary participation

Consent must be freely given. Pressure can be subtle: a manager asking staff to participate, a key account manager asking a customer who depends on them, or an incentive large enough to be hard to refuse. Making it easy to decline, avoiding reminders that feel like demands and ensuring that non-participation is not tracked or penalised all protect voluntariness.

Minimising harm

Harm in business research is usually not physical, but it can be real: embarrassment, anxiety, damage to relationships or careers, loss of privacy or commercial disadvantage to a participating organisation. Minimising harm means collecting only the information needed, avoiding unnecessary sensitive questions, allowing participants to skip questions, protecting identities and handling disclosures of serious issues, such as safety concerns or misconduct, through appropriate channels.

Anonymity and confidentiality

These terms are often confused:

Anonymous means that nobody, including the researcher, can link responses to an individual. Truly anonymous surveys collect no identifying information and cannot be matched to other records.
Confidential means that the researcher knows or could find out who said what, but promises not to reveal it.

Promising anonymity when responses can actually be identified, for example through unique survey links, detailed demographics or comments that reveal the writer, breaks trust. In small organisations, combinations of details such as department, role and length of service can identify individuals even without names. Removing names is not always enough to de-identify data.

Research with staff

Staff research raises particular issues because of the power relationship between employer and employee. Good practice includes:

explaining why the research is being done and how results will be used;
using independent tools or people to collect data where candour matters;
reporting results only for groups large enough to protect individuals, often a minimum of five or more responses;
avoiding questions whose answers could be used against individuals;
not using research data for performance management or discipline unless that purpose was clear from the start; and
sharing results and actions, so participation is seen to matter.

Workplace surveillance laws in some states and territories also govern monitoring of employees, such as video or computer monitoring, and must be considered when observation or digital data forms part of research.

Research involving other organisations

Business-to-business research often gathers information about other organisations as well as the individuals who represent them: their processes, costs, suppliers, plans and problems. Participants may not be authorised to share some of this, and some may be commercially sensitive or confidential under their own contracts. Research invitations should make clear what kind of information is sought, participants should be free to decline any question, and commercially sensitive information should be protected as carefully as personal information. Reports should not reveal which organisation said what without permission, and benchmarking studies should aggregate results so that individual organisations cannot be identified.

Vulnerable participants

Some people need extra care: children and young people, people with cognitive impairment, people in distress, people with limited English and people in dependent relationships with the researcher. Research involving them may need the consent of parents or guardians, simplified information, interpreters or the involvement of independent support people. Where research with vulnerable groups is significant, specialist advice or formal ethics review is appropriate.

Incentives

Thank-you gifts, prize draws and payments can improve participation and recognise people’s time. They should be modest enough not to pressure people into taking part, and they should not depend on giving particular answers. Some employers prohibit staff from accepting gifts from suppliers, so business-to-business incentives should respect those policies, for example through a donation to a charity rather than a personal gift. Prize draws may be subject to state and territory regulation.

Honesty

Research should be what it says it is. Surveys used to collect sales leads, “research” calls that turn into sales pitches and studies designed to produce a predetermined marketing claim undermine trust and, in some cases, breach consumer law. Deceiving participants about the purpose of research should generally be avoided in business settings. Findings should be reported honestly, including results that are unwelcome.

Privacy obligations

The Privacy Act and the Australian Privacy Principles govern how many organisations collect, use, disclose, store and secure personal information. They apply to businesses above an annual turnover threshold and to some smaller businesses, such as health service providers and businesses that trade in personal information. Even businesses not covered benefit from following them as good practice. Key obligations relate to:

collecting only information that is reasonably necessary;
notifying people about the collection, its purposes and their rights;
using and disclosing information only for the purposes for which it was collected, or related purposes they would reasonably expect;
taking reasonable steps to keep information secure;
managing disclosures to overseas recipients, including some cloud services; and
notifying eligible data breaches.

The privacy by design in business databases and privacy policies for small business websites articles explain these obligations in practical terms. The Office of the Australian Information Commissioner publishes guidance, and legal advice should be sought for complex cases.

Contacting people for research

Rules on unsolicited commercial electronic messages and telemarketing may apply when contacting people by email, SMS or phone, particularly if contact includes promotional content. Genuine research may be treated differently from marketing under some of these rules, but conditions apply, and research invitations should not include sales content. Using existing customer relationships, honouring opt-outs and identifying the sender clearly are good practice in all cases.

Secure handling, retention and disposal

Research data should be stored securely, with access limited to people who need it. Identifying details should be separated from responses or removed as early as possible. Recordings and transcripts should be kept only as long as needed and then securely deleted. A simple data management plan for each project records where data is stored, who can access it, how long it will be kept and how it will be destroyed.

Automated and AI tools

Loading customer comments, interview transcripts or staff survey responses into external AI or analysis tools may disclose personal information to third parties, sometimes overseas, and may allow the provider to retain or use it. Before using such tools, check the provider’s terms and data handling, remove identifying details where possible and ensure the use is consistent with what participants were told. Automated analysis of people’s information for decisions about them raises further fairness concerns, as the fair use of AI in hiring and people decisions article explains.

Reporting without exposing people

Reports should not identify participants without their agreement. Avoid reporting results for very small groups, remove details from quotes that could identify the speaker, and be cautious with case examples drawn from a small customer base or workforce. Where findings concern a particular person’s conduct, they belong in a separate, appropriate process, not a research report.

A worked example

This is an illustrative example. The business and details are hypothetical.

A 40-person engineering firm wants to run a staff wellbeing survey. The managing director initially plans to send it from the managing director’s own email account, with questions about department, role, age band, length of service and specific supervisors. A team leader points out that, with those details, most responses could be traced to individuals.

The firm redesigns the survey. An external survey tool collects responses without names or unique links. Demographic questions are reduced to a single broad grouping of office or workshop. The invitation explains the purpose, that participation is voluntary, that responses are anonymous, who will see the results and that results will be reported only for groups of at least eight. Questions about specific supervisors are removed, and staff are reminded of separate, confidential channels for raising individual concerns. Results are shared at a staff meeting with the actions management will take, and the raw data is deleted after six months.

Participation reaches about 80%, and comments are candid enough to identify workload pressure in the workshop during peak periods, which the firm addresses with changes to scheduling.

How this applies to a small Australian business

Explain purpose, use and rights clearly before collecting information.
Make participation genuinely voluntary.
Distinguish anonymous from confidential and promise only what you can deliver.
Report staff results only for groups large enough to protect individuals.
Collect only the information needed.
Check privacy, spam and telemarketing obligations.
Store, retain and dispose of data securely.
Check AI tools’ data handling before loading research data.

Common mistakes

Promising anonymity that cannot be delivered.
Using research to sell.
Reporting results for tiny groups.
Using staff research for performance management without prior notice.
Keeping recordings indefinitely.
Uploading identifiable comments to external tools without checking.

Frequently asked questions

Does business research need ethics committee approval? Usually not, unless it is conducted with a university or health service, involves certain sensitive areas or is intended for academic publication. The ethical principles still apply.

Is an online survey with no names automatically anonymous? No. Unique links, IP addresses, detailed demographics and identifying comments can make responses identifiable.

Can customer data collected for orders be used for research? Using it for related purposes that customers would reasonably expect, such as improving service, may be acceptable, but privacy obligations apply and unexpected uses should be avoided.

What should happen if a participant discloses a serious issue? It should be handled through appropriate channels, such as safety or complaints processes, with care for the participant, and participants should be told in advance how such disclosures will be handled.

Can incentives be offered to staff for completing surveys? Small, equal incentives, such as a team morning tea or a donation for each response, can encourage participation without pressure. Incentives that depend on identifying who responded can undermine anonymity.

Can participants withdraw after taking part? They should be able to withdraw identifiable information, such as an interview recording, up to a stated point, typically before analysis or reporting. Truly anonymous survey responses cannot be withdrawn, because they cannot be found, and the information statement should say so.

Questions to ask

Would participants feel fairly treated if they knew exactly how their information was used?
Can we truly deliver the anonymity or confidentiality we promise?
Is anyone under pressure to participate?
Which privacy and contact rules apply to this project?
How long will we keep the data, and how will it be destroyed?

Bringing it together

Ethical research respects the people behind the data. Informed, voluntary consent, minimal harm, honest purposes, accurate promises about anonymity and confidentiality, special care with staff and vulnerable participants, modest incentives, compliance with privacy and contact rules, secure handling and careful reporting protect participants and the quality of the evidence. Businesses that treat research participants well find people more willing to share the honest information good decisions depend on.

Source: KEVOS editorial notes. Examples in this article are illustrations. This article is general information and does not constitute legal advice; seek advice on privacy, workplace surveillance and other legal obligations for specific situations.