Claude for HR Teams: Employee Data & Privacy in Australia

Pay disputes, performance concerns, medical certificates, a grievance that needs a careful reply. HR handles some of the most confidential information in a business, and much of the work involves writing about it. That makes AI assistants such as Claude useful for drafting and summarising. It also makes the question of what happens to employee information particularly important.

Quick answer: When someone pastes employee information into Claude, that information is sent to Anthropic for processing and may remain in the account's conversation history. What happens next depends on the account, its settings and the organisation's controls. A business-managed workspace offers stronger oversight than a personal account, but it does not automatically make it appropriate to upload confidential HR records. In Australia, the Privacy Act 1988 also treats some employee records differently from other personal information.

What actually happens when HR pastes information into Claude?

Claude processes the text and files people provide so it can generate a response. If an HR adviser pastes a disciplinary letter, a medical certificate or notes from a workplace investigation, the information is no longer sitting only in the organisation's original HR system. It has also been submitted to an external AI service.

On a personal Claude account, the individual manages their own account, conversation history and available privacy settings. Anthropic's consumer settings can affect whether eligible conversations are used to improve models. On a business-managed Team or Enterprise workspace, the organisation manages membership and access, and Anthropic says commercial customer content is not used to train its models by default, subject to specific exceptions such as opted-in feedback.

That difference matters, but training is only one part of the question. HR should also consider where data is processed and stored, who can retrieve it, which colleagues can access shared projects, how long information is retained and what happens when a staff member leaves.

Anthropic retains conversation history for its commercial chat products so users can continue conversations, while Enterprise offers configurable retention controls. The exact arrangements depend on the product and configuration. We cover the broader account choices in Claude for Business: What IT Should Sort Out First.

Does the Australian Privacy Act cover employee information?

Sometimes. The Office of the Australian Information Commissioner (OAIC) explains that private sector employers may be exempt from certain obligations under the Privacy Act when handling an employee record in a way directly related to a current or former employment relationship.

Payroll information, leave records and other documents relating directly to employment can fall within that exemption. However, not everything HR holds is automatically exempt, and sending information to an AI provider does not, by itself, answer whether the exemption applies.

• Applicants and volunteers need separate consideration. The exemption does not cover information about applicants where no employment relationship has been established, or records about volunteers. Recruitment information may be treated differently once an individual becomes an employee, depending on the circumstances.
• Purpose matters. The handling must be directly related to the employment relationship. In a 2025 OAIC determination involving a former employee's medical certificate, disclosure to a client was found to fall outside the exemption because it was not directly related to employment.
• Third-party providers have their own obligations. The OAIC notes that contractors handling another organisation's employee records cannot simply rely on that employer's exemption. The legal analysis of an AI service arrangement therefore requires more than checking whether the original document is an employee record.
• Other laws and duties still apply. Confidentiality obligations, employment contracts, workplace laws and relevant state or territory health privacy requirements may apply even where the employee records exemption is available.
• Serious privacy claims may raise separate questions. Australia's statutory tort for serious invasions of privacy commenced in June 2025. It has its own legal requirements and should not be confused with an ordinary Privacy Act complaint.

This is why HR should not assume that an employee records exemption is permission to paste sensitive case material into an unapproved tool. Nor should every such paste automatically be described as a Privacy Act breach. The circumstances matter, and an Australian privacy lawyer should assess the legal position.

We discuss the broader question of unapproved AI tools in Is Shadow AI a Data Breach?. For HR, the added complication is the nature of the records and the purpose for which they are handled.

What about using Claude to screen job applicants?

Recruitment deserves particular attention because applicants are not automatically covered by the employee records exemption. Using Claude to reformat a job description or help draft interview questions is different from providing identifiable applications so it can rank candidates.

From 10 December 2026, organisations covered by the Australian Privacy Principles must provide additional information in their privacy policies where they arrange for a computer program to use personal information to make, or do something substantially and directly related to making, decisions that could significantly affect an individual's rights or interests. This is a transparency obligation, not a blanket ban on AI-assisted recruitment. Whether a particular screening process is covered depends on how it works and its impact.

HR teams should also keep a responsible person involved in hiring decisions, check AI-generated assessments against actual application material and watch for unfair or unsupported conclusions. The OAIC's guidance on automated decision-making explains the upcoming privacy policy requirements.

Where Claude use in HR can go wrong

The obvious risk is a spreadsheet full of employee details. A less obvious one is the everyday email thread: a manager asks HR to help respond to a performance issue, and the pasted messages contain a medical detail, an allegation about a colleague or information about a family situation.

Three patterns are worth watching:

• Personal accounts become unofficial HR archives. Draft letters and case notes accumulate in an account the business does not manage, creating problems with oversight, access and offboarding.
• Polished AI writing can disguise mistakes. Claude might draft a convincing letter that misstates a notice period, award entitlement or company policy. A person must verify these details against current, authoritative documents.
• Connectors expose existing permission problems. If HR folders in SharePoint or OneDrive are accessible to more staff than intended, connecting an AI assistant can make that existing access problem more consequential. Permissions need reviewing before connection.

HR information is often embedded in free-text notes rather than clearly labelled fields. That makes practical rules and staff judgement just as important as technical controls.

What does a sensible Claude setup for HR look like?

1. Start with a business-managed workspace. Assess whether Team or Enterprise provides the identity, administration, audit and retention controls your organisation needs. Do not rely on staff using personal accounts for HR work.
2. Set HR-specific rules for what can be entered. Distinguish low-risk tasks, such as rewriting a generic policy announcement, from identifiable employee information. Require explicit approval and an appropriate legal and security assessment before processing medical records, investigation details, tax file numbers or bank information.
3. Remove identifying information where possible. For example, ask Claude to improve an email to “the employee” rather than providing names, dates and case details. Remember that context can identify someone even without their name.
4. Keep responsibility with people. Use Claude to help draft and organise, not to make unreviewed decisions about hiring, disciplinary action, pay or termination.
5. Review Microsoft 365 access before enabling connectors. Check HR SharePoint and OneDrive access, review the permissions being granted and start with the smallest practical pilot.
6. Plan for access and retention. Decide who administers the workspace, how staff are removed, which chats or files must be retained and how sensitive content will be handled on departure or during an investigation.

The OAIC's guidance on commercially available AI products provides a useful starting point for assessing privacy risks. The technical groundwork is explored further in our Claude for business guide.

Frequently asked questions