Your Data in Job Applications: Who Sees What

A CV contains your name, contact details, employment history with dates, education, frequently your location, and enough to identify you completely. Applying for fifty jobs distributes that across fifty organisations and an unknown number of systems behind them. For a related workplace-privacy perspective, see read more.

Almost no job search advice mentions this, and it is worth ten minutes of your attention. For an independent public reference, consult NIST AI Risk Management Framework.

Rights and requirements differ substantially by where you are located. What follows describes the general shape and the questions worth asking; the specifics for you depend on your jurisdiction.

Where it goes

The employer, obviously.

Their applicant tracking system, which is usually a third-party product hosted somewhere you do not know.

Any screening or assessment tools integrated with it — resume scoring, video assessment platforms, testing providers. Some tracking systems integrate with hundreds of third-party tools.

Recruitment agencies, if one is involved, plus their own systems.

Job boards, where you applied through one, which typically retain your profile and CV.

Background check providers, later in the process.

And any AI service used to summarise, score or rank applications.

Each of these is a place your employment history now lives, with its own retention period and its own security.

What happens after you are rejected

The part people never think about.

Your data does not usually disappear. Employers commonly retain applications for a period, partly for legitimate reasons — defending a discrimination claim requires records — and partly because nobody set a deletion policy.

Talent pools. Many systems place rejected candidates into a database for future roles. Sometimes you consented to this in the application; frequently it was a pre-ticked box or a line in terms you did not read.

Agencies retain indefinitely as a default in many cases, because the database is the business.

And the job board profile persists until you delete it.

What you can ask and do

Read what you agreed to. The consent checkbox at the end of an application usually covers retention and talent pools. It takes thirty seconds to read.

Ask how long they keep it. A reasonable question for a recruiter and one that most can answer.

Request deletion. In many jurisdictions you have a right to request erasure of your personal data, with exceptions. In others you do not, and asking politely still works more often than people expect.

Delete old job board profiles, particularly ones you no longer use. An abandoned profile with a five-year-old CV is a live copy of your data with nobody watching it.

And check what an agency does before handing them a CV. Whether they will send it to employers without asking you first is the question that matters, and the answer varies.

What not to put on a CV

Reducing what you distribute is the most effective control you have.

Your full address. City and country is enough. A street address on a document sent to fifty organisations is unnecessary exposure.

Date of birth, unless the market requires it. In many places asking is restricted, and volunteering it invites age-based screening.

Marital status, family details, nationality, religion, health information, unless a specific market convention requires it. See what differs by market.

A photograph, in markets where it is not standard.

Identification numbers of any kind. National insurance, social security, passport, driving licence. These are requested legitimately at offer stage, not at application.

References' contact details. "References available on request" protects people who did not agree to be contacted by fifty employers.

And nothing about anyone else — clients, colleagues, confidential projects.

Where the risk is not the employer

Fake job postings exist to collect personal data, and they are convincing. Signals: an application process that asks for identification documents or bank details before an offer, an interview conducted entirely over a messaging app, an offer with no interview, or a request to pay for equipment or training.

Never provide identification documents or bank details before an unconditional written offer from a company you have verified independently.

Verify the company separately. Find their website yourself rather than following the link in the message, and check that the recruiter exists.

And be careful with "profile completion" requests from platforms you did not seek out.

Tools that handle your CV

Including ours, and this is the honest part.

Any tool that builds, reviews or improves a CV is processing your employment history. That includes resume builders, scoring tools, AI writing assistants and interview practice products.

The questions worth asking of any of them:

What is stored, and for how long?

Is anything sent to a third-party model provider, and when? Many tools send your content to an external model. Ours does, when you ask for text to be generated. That should be stated plainly on a privacy page, and where it is not stated, ask.

Is your content used for training? The answer should be findable.

Can you delete your data, and does deletion actually remove it.

A tool that claims to collect no personal data while building your CV is either mistaken or not describing what it does. See our privacy policy.

A short audit worth doing

Twenty minutes, once.

• [ ] Remove your street address, date of birth and any identification numbers from your CV
• [ ] Remove referees' contact details
• [ ] Delete old job board profiles you no longer use
• [ ] Check the consent text on the next application you submit
• [ ] Check what your recruitment agency does with your CV before sending it
• [ ] Check the privacy page of every CV tool you use, including ours

The short version

A CV is one of your densest personal datasets, and applying distributes it across systems you will never see.

Rejection does not usually mean deletion. Talent pools, agency databases and retained applications are the default.

Reduce what you distribute: no street address, no date of birth, no identification numbers, no referee contact details.

Never provide identity documents or bank details before an unconditional written offer from a company you verified independently.

And ask any CV tool what it stores, what it sends, and for how long — including this one.