AI data leakage in migration practices: what leaves when client files go into ChatGPT or Claude.

A registered migration agent holds passports, family details, health examinations, police certificates and income records, often for a whole household, and keeps them for years. Section 35 of the Code of Conduct stops an agent disclosing a client’s personal information to a third person without the client’s written consent, whether or not the Privacy Act applies to the practice. The OMARA’s guidance on AI, updated in March 2026, says sharing client details with AI tools may breach it. Many practices turn over $3 million or less and sit outside the Privacy Act, so the Code is often the obligation that matters. This series takes ten documents a practice produces, from the service agreement to the complaint response, marks every item it must protect, and shows where each goes when pasted into ChatGPT or Claude.

The documents, one at a time

AgreementThe service agreement and fee estimate

The client’s identity block, current visa expiry, fixed fees and a signed AI consent. The first document on every file.

See what leaves → FormThe visa application data form

Two passports, two children, a child’s asthma, a conviction and a salary. A whole family on one form.

See what leaves → SpreadsheetThe points test spreadsheet

Eight clients, their birth dates, employers, partners, visa deadlines, a refusal and a spouse in treatment. A whole caseload in one file.

See what leaves → RecordThe partner visa relationship statement

How they met, where they sleep, who pays the rent, a partner’s illness, a child, and a family that disapproves. In the applicant’s own words, signed as true.

See what leaves → EmailThe employer sponsor nomination email

The company’s tax arrangement, the worker’s salary and visa expiry, and a request for the director’s photo ID. Two parties’ secrets in one email.

See what leaves → Report or memoThe review submission after a refusal

The delegate’s reasons, the evidence for a points claim, a dispute with a former employer and a note that an AI tool was used. In a document the Tribunal will read.

See what leaves → EmailThe police check and health examination email

Which certificates, whose HAP ID, the child’s clinic appointment and a conviction the family would rather not discuss. A checklist that names names.

See what leaves → TranscriptThe first client call transcript

A man admits he worked more hours than his visa allowed, mentions a refusal, his wife’s diabetes and his savings, and is told his chances are poor.

See what leaves → Text or chat messageThe WhatsApp thread with a client

A passport photo, a bank transfer receipt, a wife on chemotherapy and a job search the client has not told his employer about. All typed between meetings.

See what leaves → LetterThe response to a client complaint about fees

The hours billed, the estimate that was exceeded, the practice’s own admission and the date the client’s visa ends. A letter written to settle a dispute.

See what leaves →

How the leakage happens

The mechanism is the same for every document. The whole text is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia. On consumer tiers it can be retained and used to train future models. The provider’s staff and systems can reach it under the provider’s own policies. Once sent, the practice no longer controls it. Our on-premise vs cloud comparison sets out the four ways to run AI and where each one puts your documents.

The obligations in play

Each marked item on these pages links to the guide that covers its obligation:

The same documents on Ermos

Ermos Dominion drafts and searches on a unit in your office, so the documents never leave it. Ermos Edge keeps your documents on your own instance in an Australian data centre and sends only permitted excerpts, per question, to a named Australian provider. Every page in this series ends with both, item by item.

Common questions

Can migration agents use ChatGPT or Claude with client information?
Registered migration agents stay responsible for any assistance given with AI, so client information needs great care. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks. The OMARA's guidance says sharing client details with AI tools may breach the Code of Conduct's duty of confidentiality, and an agent needs the client's written consent before personal details go into an AI platform. In Tribunal matters, the ART's Generative AI Practice Direction says a person must not enter confidential or protected information into a publicly available tool unless satisfied that doing so is lawful, authorised and consistent with every obligation that applies.
Do ChatGPT and Claude train on what staff paste in?
As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. For a migration practice the question matters because a single paste can carry passports, health examinations and police certificates for a whole household.
Do business plans such as ChatGPT Business or Claude Team solve the problem for migration agents?
Only in part. A business plan changes the default on training, but it does not change who receives the content. On a personal plan the user cannot choose where conversations are stored or processed. Some business plans let an organisation choose to store data at rest in Australia (OpenAI), which still leaves the content with the AI company. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. Section 35 of the Code of Conduct applies whether or not the Privacy Act does, and a practice with annual turnover of $3 million or less is generally outside the Act unless an exception applies. Our comparisons with ChatGPT Enterprise and Claude weigh the trade-offs.
What is the safest way for a migration practice to use AI with client documents?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. For migration agents, staying in control means a client's passport, health and character details stay where the agent can answer for them, and the agent can explain how every draft was checked.
What does the OMARA say about registered migration agents using AI?
The OMARA's guidance, updated in March 2026, says agents may use AI but stay responsible for the immigration assistance they give. The Code of Conduct applies to AI use, sharing client details with AI tools may breach the duty of confidentiality in section 35, and an agent needs the client's written consent before entering personal details into an AI platform.
Does the Privacy Act apply to a migration practice?
Only some. A business with annual turnover of $3 million or less is generally outside the Privacy Act unless an exception applies, such as providing a health service, trading in personal information, or being an AML/CTF reporting entity. The Code of Conduct applies to every registered agent regardless, so section 35 can be the controlling duty even when the Privacy Act is not.
Which migration documents carry the most risk when pasted into an AI tool?
The visa application data form, because it carries identity documents, family, health and character answers together; the client call transcript, because it records admissions and candid advice; and the police check and health examination email, which mixes conviction history with medical detail. The pages in this series take each in turn, with the other seven.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
Resources The Privacy Act, the APPs and AI All professions