Keep HR Assistants Focused on Policy and Permissions

02An assistant can point to an approved policy and the relevant form.

03If the employee then explains a medical condition or disputes a manager's decision, the conversation has moved into a different information and authority context.

04The OAIC's small-business guidance makes Privacy Act coverage dependent on turnover and relevant exceptions.[

051] Our recommendation is to assess the actual entity and proposed use before enabling record access.

06Do not assume that an HR label or the company's size settles every privacy question.

07Define the first assistant's scope in ordinary language.

08It can retrieve approved policy, identify the responsible role and explain the submission process.

09It cannot decide an individual's entitlement, interpret a disputed case or access every employment file simply to make its answers feel personalised.

02Remove superseded versions from ordinary retrieval while retaining required history through the appropriate archive.

03If two policies conflict, make that a document-owner task rather than a model synthesis exercise.

04Keep personal case files outside the initial retrieval boundary.

05An assistant that searches broadly and filters the final answer may still expose information through titles, snippets or generated inferences.

06Permissions should determine which material it can discover before it constructs a response.

07The OAIC's AI guidance addresses due diligence, oversight and risks involving personal information.[

082] Applied here, assess the conversational record too.

09A staff member may type sensitive details into an apparently simple policy chat, so the design needs a clear response and handling route.

02Explain the ordinary process in plain language, then indicate when a person must assess individual circumstances.

03A link to a private HR contact can be more useful than a confident answer based on incomplete facts.

04Ask only for information needed to route the question.

05A generic leave-process assistant does not need a diagnosis or a complete employment history.

06If personal detail appears, avoid repeating it unnecessarily in summaries, shared dashboards or messages to people outside the authorised case process.

07Where policy refers to employment instruments or payroll arrangements, direct the user to the approved source and responsible reviewer.

08Do not let the assistant choose an award or interpret a disputed provision from general model knowledge.

09The business needs accountable decisions that can be explained and corrected.

02These recommendations describe system boundaries rather than legal classifications.

03The business should confirm its own privacy, record-keeping and employment requirements with suitable advisers before expanding personal case handling.

04Give managers the same clear boundary as employees.

05Otherwise, a manager may assume the assistant can rank staff, summarise medical records or recommend disciplinary action because it already answers policy questions.

06A new purpose deserves an explicit assessment and authority decision.

02An employee asks how to submit a request and includes personal medical information.

03The assistant provides the ordinary process and a private contact route without broadcasting the detail to the employee's wider team.

04The conversation is handled under the organisation's assessed settings and procedures.

05The system does not promise immediate deletion where retention or investigation requirements might apply.

06It also does not infer an entitlement or ask for further medical detail simply to continue the conversation.

07The people lead reviews whether the interface invited unnecessary disclosure.

08The company updates the opening instructions and routing design, then tests the same pattern using fictional information.

09The useful lesson is a better intake boundary, not a claim that one scripted response makes the system compliant.

023] Our recommendation is to keep the authoritative record in the designated system.

03An assistant's conversation summary should not silently replace an approved correction or formal employment record.

04There is a tradeoff between personalisation and exposure.

05Many recurring HR questions can be answered from policy without individual records.

06Where personalisation creates a meaningful benefit, document the additional data, permissions and review process rather than extending access for general convenience.

07Begin with the questions HR answers repeatedly from approved documents.

08Test wrong versions, missing policies and requests involving personal circumstances.

09Expand only when the organisation can explain what information the assistant handles, who may rely on answers and how employees reach a responsible person.