ATO correspondence and AI data leakage: what a payment plan request gives away in ChatGPT or Claude.

Correspondence with the ATO is the sharpest AI confidentiality case in an accounting firm, because it almost always carries a tax file number and a regulator’s reference together. A payment plan request adds the client’s financial difficulty to that. This page marks every item in a routine ATO email that a tax agent is obliged to protect under the TFN Rule, the TPB Code and APES 110, and shows how the same email is drafted on Ermos without leaving the practice.

The email to the ATO

Sent through the agent portal or by email when a client cannot pay an assessment on time and the firm negotiates on their behalf.

To: Australian Taxation Office, Debt and Lodgment
From: , Northgate Partners
Subject: Payment plan request, ,

We act for and request a payment arrangement for the following debt:

We propose , debited from .

Please contact me on the number below if further information is required.


An invented email. The TFN is the ATO’s published example value. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the firm

  1. 1
    The client’s name

    Attached to a tax debt, a hardship story and a tax file number. Personal information under the Privacy Act, and sensitive in the ordinary sense as well. Privacy Act guide.

  2. 2
    A tax file number

    The TFN Rule permits TFN information to be used or disclosed only for purposes authorised by taxation, personal assistance or superannuation law, and requires access to be restricted to people who need it for those purposes. Unauthorised disclosure of a TFN can be an offence under the Taxation Administration Act 1953. Tax file numbers guide.

  3. 3
    The debt and the proposal

    How much the client owes, when, and what he can afford to pay. Information about a client’s affairs that the TPB Code says must not go to a third party without the client’s permission. TPB Code guide.

  4. 4
    The ATO reference

    Ties the email to a specific matter in the regulator’s system. With the TFN it is enough to impersonate the agent in correspondence about the debt. Tax file numbers guide.

  5. 5
    The hardship story and a third company

    A lost customer named, an administration, staff reductions, and an expected settlement. Confidential information about the client and about Coastline Developments, which is nobody’s client here. APES 110 confidentiality guide.

  6. 6
    A family member’s circumstances

    That the client’s mother has entered aged care is her personal information, volunteered to support a hardship case and now on a third party’s servers. Privacy Act guide.

  7. 7
    Bank account details

    A full BSB and account number for a direct debit. The most directly misusable item in the email.

  8. 8
    The agent’s registration

    The agent’s name, registration number and phone number. Everything needed to impersonate a registered tax agent with the ATO. TPB Code guide.

What happens in Frontier Models (ChatGPT, Claude)

  • The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
  • On consumer tiers, prompts can be retained and used to train future models.
  • The provider’s staff and systems can reach the content under the provider’s own policies.
  • Once sent, the firm no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the client file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

Frontier Models (ChatGPT, Claude)Ermos EdgeErmos Dominion
Where the document is processedProvider servers, generally offshore on personal plansYour instance in an Australian data centre; answers generated in AustraliaThe unit in your office
Who can read itProvider staff and systems, under policyYour staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothingYour staff only
Is it keptOn the provider’s termsKept on your instance; the provider is barred from retaining itStays on the unit
Can it train a modelOn consumer tiers, yesNo, by contractOnly your own unit learns from it, on your hardware

Part of AI data leakage in accounting firms. See how this works in practice: Tax work on Ermos.

Common questions

Do ChatGPT and Claude use the information in an email to the ATO?
It depends on which plan the user is on. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. The email is also sent to the AI company to be processed. This email pairs a tax file number with an ATO reference and a hardship story.
Is it safe to paste an email to the ATO into ChatGPT or Claude if we change the client's name?
A new name does not help, because the story points to one business. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised. A business that lost its largest customer to an administration in July and halved its staff is easy to identify. An owner supporting a parent in aged care narrows it further. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks.
Can ChatGPT or Claude be trusted to draft an email to the ATO?
Not without a line-by-line check. A language model can produce fluent text that includes details found nowhere in the source. It can also give wrong figures, wrong dates or references that look real but are not. The debt, the due date and the instalment schedule are the figures the whole arrangement rests on. A wrong digit in the ATO reference or the debit account would attach the plan to the wrong matter or the wrong account. A registered tax agent should check every item against the assessment and the client file before anything is sent.
How can an accounting practice use AI for an email to the ATO without sending it to ChatGPT or Claude?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. Ermos drafts the email from the client file and the practice's own payment plan template. The registered tax agent checks every figure and signs it before it goes to the ATO.
Can a tax agent put a client's TFN into ChatGPT or Claude?
The TFN Rule allows TFN information to be used or disclosed only for purposes authorised by taxation, personal assistance or superannuation law, and requires access to be restricted to people who need it for those purposes. Disclosing a TFN to a frontier model provider is very hard to reconcile with either requirement, and unauthorised disclosure can be an offence under the Taxation Administration Act 1953. Remove it first, or draft inside the practice.
What if we only paste the body of the email and leave out the TFN?
The body still carries the client's name, the debt, the hardship story, the bank details and the ATO reference, each of which the TPB Code treats as information about the client's affairs. Redacting one item does not change the character of the rest.
Does drafting on Ermos change what we send to the ATO?
No. The email you send is the same. What changes is where it was drafted: on a unit in your office, or on your own Edge instance in Australia, instead of on a frontier model provider's servers.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI data leakage in accounting firms AI for accountants APES 110 and AI All professions