Recruiters and ChatGPT: is it safe to paste CVs into AI?
Pasting a full CV into ChatGPT is not safe as a habit. A CV is personal data about someone who never agreed to it going into an AI tool. Pasting a CV with the name, contact details and identifying facts taken out first is a different matter, and it is how most recruiters can keep using AI for rewrites without the risk. The work still gets done. The candidate stays out of it.
Why a CV is personal data
A CV is a list of facts about one person. Name. Phone. Email. Home town. Date of birth, sometimes. Employers, dates and job titles that point to exactly one human.
Some CVs go further. Nationality. Right-to-work status. Health notes explaining a gap. A photo. Those can be special category data under UK GDPR, which needs extra care.
Even with the name gone, a CV can still identify someone. "Head of Finance at Fenwick Joinery, 2019 to 2024" is one person. That matters when you plan what to strip.
What UK GDPR expects, in general terms
This is general guidance, not legal advice. The broad points are well settled.
- A reason. You need a lawful basis to use a candidate's data. Placing them in roles is one. Feeding their CV to a third-party AI tool is a new use.
- Telling people. Your privacy notice should say how candidate data is handled. Most do not mention AI tools yet.
- Only what is needed. This is called data minimisation. If ChatGPT can tidy a CV without the name, it should not get the name.
- Knowing where it goes. Free and personal accounts may use what you type to train models, unless settings say otherwise. Business plans work differently. Our guide to ChatGPT Team, Enterprise and free plans sets out the differences.
Clients matter too. A job brief from a client may be confidential. Salary bands, restructures and unannounced roles should not go in either.
Rule of thumb: if a stranger reading the pasted text could work out who the candidate is, take more out before you send it.
How to paste CVs into ChatGPT safely
The task rarely needs the identity. Rewriting a profile, tightening bullet points or matching skills to a job ad works just as well on an anonymous version.
Step 1: Strip the contact block
Delete name, phone, email, address, LinkedIn link and photo. Replace the name with "the candidate" or "Candidate A".
Step 2: Blur the identifying details
Swap employer names for descriptions. "Fenwick Joinery" becomes "a regional joinery firm". Keep dates as lengths: "five years" rather than "2019 to 2024". Remove date of birth, nationality and any health or family notes.
Step 3: Check references and achievements
Referee names and numbers come out. So do oddly specific wins, such as an award only one person in the country holds.
Step 4: Use a work account
Use the plan your firm has approved, not a personal login. Turn off chat history or training where the plan allows.
Step 5: Put the details back yourself
Paste the rewrite into your own document. Add the real name and contacts back there. Not in the chat.
A worked example
Example: Priya at Ashcombe Recruitment wants a sharper profile for a candidate. She pastes: "Candidate A. Finance lead, five years at a regional manufacturer. Led a move to new accounts software." ChatGPT returns a cleaner paragraph. Priya puts the real name and details back in Word. The question still goes. The candidate's identity never does.
Where manual stripping falls down
The steps work. They also take a few minutes per CV, and a busy desk skips them. Common slips include:
- Forgetting the email in the footer.
- Uploading the original Word or PDF file instead of pasting cleaned text.
- Pasting a whole shortlist to compare candidates, names and all.
- Using a personal account on a phone.
File uploads are the big one. Dropping a CV straight into ChatGPT sends everything in it. The same applies to other AI tools, and some store data abroad, as covered in our piece on DeepSeek at work.
Tools that can automate the stripping
There are three broad options.
- A written policy and training. Cheap. Depends on people remembering.
- Free browser redaction extensions. Some catch emails and phone numbers. Check what they miss, and whether they work on file uploads.
- Business tools that check before anything is sent. These sit in the browser and take out or block personal data on AI sites.
Helio Guard is in the third group. An agent on each Windows PC adds an extension to Chrome and Edge. It checks every paste, message and file upload on listed AI sites, including Word and PDF CVs. Phone numbers, National Insurance numbers, bank details and lists of people are taken out and swapped for labels, so the question still goes. Add your client list and client names become a stand-in such as "Client A", turning back into real names when you copy the answer.
Checks run on the PC with fixed rules, not an AI model. We never see what your team types. Your account gets only a short record: kind of data, site, person, outcome and time. It also records each person's agreement to your AI policy, which helps when a client asks about AI controls.
Where it falls short: Windows only for now. No Mac. Chrome and Edge only. It works on listed AI sites, not every tool. If you want to weigh it against free options, see Helio Guard compared with free redaction extensions. Pricing is £1 a person a month, from 5 people, with a 14-day free trial and no card needed.
Common questions about CVs and ChatGPT
Do I need candidate consent to put a CV into ChatGPT?
Consent is not the only lawful basis under UK GDPR, but candidates should be told how their data is used. If identifiable CVs go into AI tools, your privacy notice should say so. The simpler route is to take names and contact details out first, so the AI tool never receives identifiable candidate data.
Is ChatGPT Team safer than a free account for CVs?
ChatGPT Team does not use business data for training by default, which a free account may do unless settings are changed. Team is a better place for recruitment work. It is still a third party holding the text, so stripping names and contact details from CVs remains good practice on any plan.
Can I use ChatGPT to write job ads from a client brief?
ChatGPT can write a good job ad from a brief if confidential details are removed first. Take out the client's name, exact salary bands if private, and any internal reasons for the hire. Describe the client in general terms, then add the real details back in your own document.
Related: How to redact sensitive data before pasting into ChatGPT, Does ChatGPT or Copilot train on your business data?