Use a data-flow worksheet to decide what candidate information a particular AI workflow can handle.
Before you let a recruitment tool summarise a CV, ask what happens to the text after the consultant presses the button. Where is it processed? Who can access it? Does a copy remain in a log?
An Australian storage location answers one part of that enquiry. It doesn't tell you the processing location, the access arrangements or the terms governing another company's use of the information. Those are separate entries in the worksheet below.
Start with one task your agency wants to use. You can then make a decision about the information that task needs, rather than trying to approve every possible use of a supplier's platform at once.
Four things to establish before entering candidate data
Data residency describes where data is stored. For a buying decision, examine it alongside processing, access and control. The label sovereign AI needs a more specific explanation before it can help you choose what to share.
| Question | What to ask the supplier | What to put in your file |
|---|---|---|
| Storage | Where are the original record, generated output, backups and logs stored? | Locations for each, with the relevant service named |
| Processing | Which services receive information to perform the task, and where does that processing happen? | The route from input to output, including any model service |
| Access | Which companies and people can access that information, including for support? | Recipients, their purposes and the access arrangements |
| Control | What can each recipient do with it, under which contract and applicable laws? | Purpose limits, subcontractor terms, retention and deletion arrangements; questions for your adviser |
AI inference means using a model to produce an answer from an input. Ask where that step happens even if you've already established where the candidate database sits. Also ask whether prompts or outputs can be retained or used for training. The OAIC's guidance on commercial AI products identifies data flows, third-party access and training terms as matters to investigate when choosing a product.
You don't need to accept a single country name as the answer for every row. Ask the supplier to identify the arrangement for the particular feature you intend to use.
Fill in the worksheet for one recruitment task
Choose a task with an output you can describe plainly, such as drafting questions for a candidate conversation. Then list the information you propose to supply. Challenge anything the task doesn't need before asking where it will go.
Use one row for each relevant data object or step. A CV attachment, a prompt and a saved answer may need different entries. Leave an unknown answer visible until someone can resolve it.
| Data object or step | Information needed and why | Storage / processing locations | Who can access it and why | Terms and retention | Proof and decision |
|---|---|---|---|---|---|
| Input | What will be supplied? Can the task work with less? | Supplier's answer for this input | Companies, services and people | Permitted uses, training and retention | Document/version; what remains unanswered |
| Output | What will the tool produce or infer? | Where it is generated and saved | Who receives or reviews it | Reuse, retention and correction | Checked arrangement; permitted use |
| Operational copies | What appears in logs, backups or support material? | Locations for each copy | Support and other access | Retention, access removal and deletion | Evidence requested; unresolved conditions |
The OAIC's privacy impact assessment guide recommends mapping how personal information is collected, used, disclosed and protected, and who can access it. The worksheet applies that approach to a recruitment task. It isn't a substitute for a privacy impact assessment or advice about your agency's obligations.
Record what supports an answer. A sales email, a contractual term and an observed configuration are different kinds of proof. If the supplier's document describes a different plan or feature, ask for the version that applies to your proposed arrangement.
Worked example: preparing candidate questions
This is a hypothetical example, not a FluxHire workflow or a customer result.
An agency owner wants consultants to use AI to prepare questions about a candidate's experience. The proposed input is a full CV plus recruiter notes. The supplier says the records are stored in Australia, but hasn't answered where the model processes prompts or how long support logs retain them.
The owner can't fill those blanks with the database location. They can, however, reconsider what the task needs while seeking the missing answers.
| Proposed use | What the owner records | Next action |
|---|---|---|
| Prepare generic questions about a role | No candidate record is needed for this version of the task | Use a role description checked for confidential or identifying details, subject to the agency's approved tool policy |
| Prepare questions from a candidate's CV | Processing location, recipients and retention remain unknown | Withhold the CV until the supplier answers and the proposed handling is reviewed |
| Include recruiter notes | The owner has not established why every note is necessary | Select only information needed for the task, then review its handling before use |
The narrower task still needs a permitted tool and an appropriate input. Check the remaining material for identifying or confidential details too, rather than stopping after removing the name. The point of the exercise is to identify a usable task without treating unanswered questions as permission to upload a complete record.
What APP 8 adds to the decision
For an organisation covered by the Australian Privacy Principles, an overseas arrangement needs more analysis than a map pin. The OAIC explains that disclosure involves making information accessible outside the entity and releasing its subsequent handling from the entity's effective control.
Its APP 8 guidance says providing personal information to an overseas contractor is generally a disclosure. In limited arrangements where effective control is retained, it may instead be a use. Routing information through an overseas server also isn't automatically a disclosure. Have your privacy adviser assess the actual arrangement and any applicable exceptions.
Where APP 8.1 applies, reasonable steps are required before disclosure to ensure the overseas recipient does not breach the APPs, other than APP 1, in relation to the information. Other privacy obligations can still matter when an arrangement is classified as a use.
Ask for the contract as well as the technical description. The OAIC's overseas information guidance discusses purpose limits, subcontractor obligations and the ability to access, retrieve or delete information when considering effective control. A supplier's location claim alone cannot establish those terms.
Take the unfinished rows into the buying conversation
For the first workflow, write down what information the team may use, what it must withhold and who will revisit the decision when the supplier answers. If the model service or feature configuration changes, check whether the answers still apply.
Apply the same questions to FluxHire. Its AI assistant prepares proposed changes to existing records and holds them for approval. During early access, record edits are made by people holding the records editor permission. That gives the authorised reviewer a proposal to inspect before approving a change.
Use that record-change task for your enquiry. Which fields would the assistant receive to prepare the proposal? Where would they be processed, and who could access the input or output? What would the reviewer see before approving it? Ask for answers about the supported arrangement for your team, then add them to the worksheet.
Our page on how FluxHire handles security sets out the matters to raise about data access, processing providers and human review. Bring a description of the change you want to make without sending candidate material you haven't been authorised to share.
Request early access to discuss AI-prepared record changes, the review step and the evidence you need before using candidate information. Bring the unanswered worksheet rows with you.