Assume Anything You Send a Candidate Goes Into a Model

Should candidates get real company data?

Rarely, and only once the sensitivity question is settled. Sort the material into three piles: things that could sit in a public repository, things that would be awkward in one, and things that would be a notifiable incident. Only the first pile goes into a brief unchanged. The other two get rebuilt as synthetic material, or the exercise gets redesigned around what you can safely hand over.

Assume it reaches a model. In nationally representative US surveys run in late 2024, 23% of employed respondents had used generative AI for work at least once in the previous week and 9% used it every working day ¹. Those are self-reported figures on a low bar, they are already old, and the same survey series has measured work adoption climbing since. A candidate preparing for a job interview is also not a median worker on a median Tuesday.

What tends to land in the second and third piles:

• personal data of any kind, including a customer name sitting inside a support ticket
• anything covered by a contract with a third party, which is most client and vendor material
• unreleased financials, pipeline detail, pricing logic
• security detail: architecture, credentials, anything describing how a control works
• free-text fields, which are where the surprises live

Take none of this as legal advice; the boundary between awkward and notifiable belongs to counsel rather than to a hiring team. The design question underneath it does not, and it is the one you can settle this week.

Why an NDA does not settle this

An NDA binds the candidate. It does not bind the service the candidate pastes your file into, which has its own terms, its own retention period and its own defaults on training. A candidate can comply with every word of the agreement while your material lands in a log you have no contract with, because the agreement never named a processor and the candidate never selected one on your behalf.

That gap is not hypothetical. A regulator has already audited the nearest version of it: the UK Information Commissioner's Office ran consensual audits of developers and providers of AI sourcing, screening and selection tools from August 2023 to May 2024 and made 296 recommendations across those engagements. Among the findings, some tools inferred gender, ethnicity and other characteristics from an application or from a name alone, and that information was often processed without a lawful basis and without the candidate's knowledge ².

Those were UK data-protection audits of vendors who volunteered. Nobody sampled the market and nobody ruled on discrimination, so the finding transfers narrowly. What transfers is the shape of it: candidate material was moving through arrangements nobody had written down clearly, and the obligation sat with the employer as controller ².

So keep the NDA if counsel wants it, and stop asking it to carry the decision. The questions that actually govern the exercise are what the material is, where it can end up, and how long it stays there. Those same three questions decide what you may keep from a recorded work sample and what happens to a candidate's session data afterwards.

Build a synthetic dataset that keeps the mess

Realism in an exercise comes from mess, not from provenance. A candidate cannot tell whether a customer table is real and has no reason to care. What makes a task feel like work is that two columns mean nearly the same thing, one field is empty for a third of the rows, and the definition of an active account is contested. All three are properties you can build on purpose.

Copy the shape and invent everything inside it. Take the schema, the distributions, the cardinalities and the failure modes from the real table, then generate values that carry them:

• categories typed by hand, so the same value appears three ways
• a date column in two formats, because two systems wrote to it
• duplicate records with slightly different spellings
• a metric with two defensible definitions and no note saying which is in use
• one obviously wrong outlier, and one that is only wrong if somebody checks
• a missing period, so a total does not reconcile

Keep the generator itself and file it with the exercise. It lets you mint an equivalent instance whenever you need one, which is what makes it safe to vary the data between candidates while holding the task and the bar identical. It also lets you regenerate after a version leaks, without redesigning anything.

Where realism genuinely requires real records, the mitigations are ordinary and they stack: sample down to the smallest slice that still supports the task, age it until it is no longer operationally useful, strip identifiers and free text, and set a deletion date somebody actually honours.

What to write in the brief about tools

Write one short paragraph naming what may go where. That is an instruction a candidate can follow, and a confidentiality clause is not. Say which assistants are permitted, whether the attached material may be pasted into them, and what to do if the answer is no. Then make the material match the instruction, so nobody has to choose between following the rule and finishing the exercise.

A version that works, adapted to your own facts:

> Use whatever assistant you normally work with, and tell us which one in your write-up. The attached dataset is synthetic and can go into it. Nothing else from this process should.

Three sentences, no ambiguity, nothing a candidate has to interpret. Compare that with a clause instructing somebody to keep confidential information confidential, which asks them to guess where your line sits and guarantees that some candidates guess conservatively and lose time to it. If your answer is that no assistant is permitted, say so plainly and be honest about what follows, because permitting or banning AI on the take-home has consequences in either direction.

One more sentence earns its place: what happens to the submission. Who reads it, how long it is kept, and whether it is deleted after the decision. Candidates rarely ask, and the teams that answer without being asked tend to be the ones whose retention practice would survive the question.

A single test before anything goes out. Open the attachment, picture it surfacing in a vendor's logs eighteen months from now, and ask what you would have to do about it. If the answer is nothing, the brief is ready. If it is anything else, build the synthetic version instead. That is usually an afternoon of work, and it holds for every candidate after this one.

Read the evidence >