Record the answer, the evidence and your decision for the recruitment workflow you intend to use.
Tell the supplier which recruitment task you want to run before asking it to complete the questionnaire. Describe the information involved and the people who will use the feature. For an AI-prepared candidate-record change, ask it to explain how the proposal reaches the authorised reviewer and what happens before approval.
Then ask how that arrangement works. A description of the company's general security programme is useful background, but you still need an answer about the feature and data you propose to use. Keep both in your review file without treating them as interchangeable.
The questionnaire below gives your agency a way to request those answers and record what it decides. It doesn't calculate a security score or certify the supplier.
Give the supplier a task to answer for
Start the request with a short description of the proposed use. Identify the feature or service, who would use it and which actions it would be allowed to take. Describe the information involved without attaching candidate records to an initial enquiry.
Be specific about material that needs different treatment. Will the task involve CV attachments, private recruiter notes, client-confidential vacancy details or generated summaries? If a category is excluded, say so. Ask the supplier to identify any limitation that would prevent it from supporting your proposed arrangement.
The OAIC's commercial AI guidance recommends due diligence about intended use, data flows, access and human oversight. Let those questions shape the enquiry. Have the appropriate people in your agency review the privacy, technical and contractual answers rather than expecting one consultant to settle all three.
For a detailed map of storage, processing, access and control, complete a data-flow worksheet alongside this questionnaire. Here, the job is to record the supplier's answer and decide whether the evidence supports the proposed use.
Questions to send with your request
Ask the supplier to answer for the product, plan and configuration you are considering. It should identify the documents or demonstrations supporting an answer, including their dates and any exclusions. A proposed future control belongs in the answer as a future control.
| Topic | Question for the supplier | Supporting material to request |
|---|---|---|
| Information handled | What information would this feature receive, generate, save or send elsewhere? | Feature-specific data flow, including prompts, outputs, attachments and operational copies |
| Providers and locations | Which companies handle that information, where is it processed or stored, and who can access it for support? | Applicable provider/subprocessor list, locations and access explanation |
| Permitted uses | May you or another provider use the information for model training or another purpose? Which settings and terms govern that? | Applicable contract terms and configuration, including any exceptions |
| Access | How are user and service permissions granted, limited and removed for this feature? | Role/permission description and a relevant demonstration with authorised test material |
| Customer separation | How do you prevent another customer from accessing our information through this feature? | Relevant design explanation and testing evidence, with limitations identified |
| AI actions and human review | What can the AI propose or execute? Which actions require a person, and what can that person inspect or refuse? | Workflow demonstration, permission requirements and the action/review record |
| Errors and unexpected instructions | How do you assess incorrect outputs or attempts to make the tool follow instructions in supplied material? | Relevant testing approach, observed limitations and handling procedure |
| Retention and exit | What happens to originals, generated material, logs and backups when access ends or deletion is requested? | Retention/deletion terms, exceptions and explanation of what remains |
| Incidents | How do we report a concern, how will you communicate an incident affecting our information, and what responsibilities stay with us? | Contact route, applicable contractual commitments and incident procedure |
| Changes | How will we learn about a material provider, feature, permission or data-handling change? | Change-notification arrangement and what information you will supply for review |
These are requests for investigation, not a list of controls every supplier has or a statement that every item is a legal duty. Select the questions relevant to your task and add any requirement your advisers identify.
The OAIC's APP 11 guidance addresses technical and organisational measures for protecting personal information. A technical setting alone should not finish your enquiry about the people and procedures supporting it. Equally, a policy document leaves questions about the applicable configuration to resolve.
Copy this response record for each question
Keep the supplier's answer intact and add your assessment beside it. If the supplier says a question is not applicable, record its reason. If it hasn't supplied the evidence, mark that explicitly and assign the follow-up.
| Field | Entry to complete |
|---|---|
| Question and proposed workflow | [Question reference; feature, plan, configuration and data categories] |
| Supplier answer | [Actual response, or not provided] |
| Evidence | [Document/link, version, date, relevant section or demonstration record] |
| Applicability and exclusions | [What the material covers; what it does not cover] |
| Contract reference | [Applicable clause, unresolved conflict or no reference supplied] |
| Owner | [Supplier contact and agency person reviewing this answer] |
| Received and checked | [Dates the answer/evidence arrived and was reviewed] |
| Review trigger | [Agreed expiry/review date or event requiring another look] |
| Decision and conditions | [Accept for defined use, narrow the proposed use, hold for evidence or decline; reasons and authorised decision-maker] |
Don't average these entries into an approval. Decide which unanswered question matters to the use you intend to make of the tool. If it concerns who receives candidate information, the next action may be to withhold that information while obtaining an answer. Another gap might be addressed by excluding a feature from the proposed arrangement.
For overseas handling, ask your privacy adviser to assess the actual arrangement against the applicable rules. The OAIC's APP 8 guidance distinguishes use and disclosure and includes exceptions. An overseas location alone is not the answer to that assessment.
Worked example: a report that leaves a question open
This is a hypothetical review, not an account of a supplier or a FluxHire assurance.
An agency asks where a proposed AI feature sends CV text for processing. The supplier provides an assurance report about its hosted service. The report supplied to the agency does not identify the model service or processing route for the proposed feature.
Record the report under evidence, with what it covers. Leave the processing answer unresolved. Ask the supplier for the feature's data flow, the recipient companies and the terms governing that handling. The report may support other parts of the review; it does not answer a question its contents do not address.
The agency decides to withhold candidate material while reviewing those answers. That is a decision about the proposed use, not a finding that the supplier is insecure. Put the decision in the record so the consultant arranging a demonstration knows which material must stay out.
The OAIC's privacy impact assessment guide describes mapping information flows and responding to identified risks. Use the supplier responses as input to that work where appropriate. Completing a questionnaire is not a substitute for any assessment your organisation needs.
Ask FluxHire to show the proposed review step
Use the same questions with FluxHire. Its AI assistant prepares proposed changes to existing records and holds them for approval. During early access, record edits are made by people holding the records editor permission. An authorised reviewer can inspect the proposed change before approving it.
For that task, ask what information would be provided to the assistant, who could access it and what the reviewer would see. Discuss which records and fields are supported for your team, then ask for evidence relevant to that arrangement. The proposed record change gives you something concrete to examine alongside the written answer.
Read how FluxHire handles security before the conversation. Bring your proposed task and the unanswered response records, without sending candidate information you haven't been authorised to share.
Request early access to discuss AI-prepared record changes and their human review. Leave the conversation with the evidence still needed, who will provide it and what your agency may evaluate in the meantime.