Salary benchmark spreadsheets and AI data leakage: what a pay comparison gives away in ChatGPT or Claude.

Agencies build salary benchmarks for clients who want to know what a finance team should cost, and the useful version sets the market band beside what the client pays its current people. That means named employees and their salaries, supplied by the client in confidence, in the same sheet as the agency’s own fee projections. Someone uploads the file to ChatGPT or Claude to add commentary or check a formula. This page marks what a routine benchmark sheet exposes under the Privacy Act and the client relationship, and shows how it is worked on Ermos inside the agency.

The salary benchmark spreadsheet

Prepared for a client before a pay review or a hire, from the agency’s placement data and the client’s own payroll figures. It is shared in a cleaned-up form with the client, and the working version stays internal.

fx
ABCDEFGH
1RoleBand lowBand highMidpointIncumbentPayFee at 17%Note
2$145,000$165,000$155,000VacantSearch open.
3$165,000$185,000$175,000
4$110,000$125,000$117,500
5$98,000$110,000$104,000Steady.
6$80,000$90,000$85,000Strong.
7$76,000$86,000$81,000
8$92,000$105,000$98,500Studying part time.
9$100,000$115,000$107,500Steady.

An invented spreadsheet. The client and its employees are fictional. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the agency

  1. 1
    Role bands and midpoints

    Market ranges built from the agency’s own placement history. The agency’s commercial asset, shaped over years. The exposure is commercial rather than personal.

  2. 2
    Named incumbents

    Seven employees of the client identified by name. Their personal information, supplied to the agency under contract. The OAIC says the employee records exemption is unlikely to apply to organisations that provide recruitment or human resource management services under contract to an employer. Privacy Act guide.

  3. 3
    Each incumbent’s pay

    What seven named people earn, set beside the market. Personal information about each of them, and what the client would not want colleagues or competitors to see. Privacy Act guide.

  4. 4
    Notes about individuals

    A flight risk, a sick employee and a performance plan, written against named people. The sick-leave note is health information, which is sensitive information under the Privacy Act, and the performance note is an opinion about a person. Patient data guide.

  5. 5
    The midpoint formula

    An average of two cells, with no personal information in the formula. Safe to share on its own; the sheet it sits in is not.

  6. 6
    The client’s name on the tab

    The tab name identifies the client, so the benchmark shows who is paying for the work.

  7. 7
    The agency’s fee column

    What the agency would earn for each role at 17 per cent. Commercial information about the agency, and a roadmap of its pricing for any client or competitor who sees it.

  8. 8
    Other tabs, hidden columns and file properties

    A spreadsheet file generally carries more than the visible tab: other sheets such as raw payroll data, hidden columns, cell comments and properties such as the author. Uploading the file sends all of it, including what is off screen.

What happens in Frontier Models (ChatGPT, Claude)

  • The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
  • On consumer tiers, prompts can be retained and used to train future models.
  • The provider’s staff and systems can reach the content under the provider’s own policies.
  • Once sent, the agency no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the candidate file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

Frontier Models (ChatGPT, Claude)Ermos EdgeErmos Dominion
Where the document is processedProvider servers, generally offshore on personal plansYour instance in an Australian data centre; answers generated in AustraliaThe unit in your office
Who can read itProvider staff and systems, under policyYour staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothingYour staff only
Is it keptOn the provider’s termsKept on your instance; the provider is barred from retaining itStays on the unit
Can it train a modelOn consumer tiers, yesNo, by contractOnly your own unit learns from it, on your hardware

Part of AI data leakage in recruitment agencies.

Common questions

Do ChatGPT and Claude use the information in a salary benchmark spreadsheet?
Yes, everything pasted or uploaded is sent to the AI company's servers and processed there to produce a reply. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. The sheet lists seven named Northgate employees with their pay, notes about a sick employee and a performance plan, and the agency's fee on each role.
Can we use ChatGPT or Claude for a salary benchmark spreadsheet if we remove the employees' names?
No, because each job title still points to one person. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised. Northgate has one Financial Controller, one Payroll Manager and one Credit Controller, so anyone at the client could tell whose pay and whose note is meant. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks.
Can ChatGPT or Claude be trusted to draft a salary benchmark spreadsheet?
Not without a check. Language models can produce fluent text with details that are not in the source, wrong figures, wrong dates or references that look real but are not. For a spreadsheet that includes wrong formulas, wrong totals and mis-copied rows. A qualified person should check every item against the file, starting with the midpoint formula and each incumbent's pay.
How can a recruitment agency use AI for a salary benchmark spreadsheet without sending it to ChatGPT or Claude?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. Ermos prepares the commentary from the client's payroll file and the agency's own placement records. The consultant checks every figure and signs off the benchmark before it goes to the client.
The client gave us its payroll figures. Are they covered by the Privacy Act?
They are personal information about identifiable employees. The employee records exemption covers an employer's acts directly related to its employment relationship, and the OAIC says it is unlikely to apply to organisations that provide recruitment or human resource management services under contract to an employer. Whether the Act applies to the agency itself depends on its turnover and on the exceptions in section 6D.
Is the market band data safe to share with an AI tool?
It holds no personal information, so the Privacy Act is not the issue. It is the agency's own commercial asset, built from years of placement data, and it is worth protecting as such. The risk rises sharply when the same sheet carries named incumbents, which is why the file as a whole is the problem.
What does APP 11 require for a client's payroll data?
APP 11.1 requires an APP entity to take reasonable steps to protect personal information it holds from misuse, interference and loss and from unauthorised access, modification or disclosure. Client payroll data uploaded to a tool the agency does not control is the kind of step a reasonable agency has to be able to justify.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI data leakage in recruitment agencies Resources The Privacy Act, the APPs and AI All professions