What exactly is sensitive in a resume?
Nearly everything. A resume exists to identify a person and describe their professional life — the exact opposite of an anonymous document.
- Contact details — full name, phone, email, home address, links to professional profiles.
- Work history — the combination of employers, titles and dates identifies a person even with the name removed.
- Personal extras — birth year, nationality, photos and other details common in CVs outside the US.
- Metadata — the Author field in a Word file, comments and tracked changes reveal identity even when the visible text is clean.
What's the risk of pasting a resume into an AI tool?
Once the file is sent to an external AI service, the data sits with a third-party vendor under that vendor's current policy — which you should check before every use, and which can change. For a candidate that means losing control of personal data; for a recruiter it means transferring someone else's data without their knowledge.
For recruiting teams the problem multiplies: they process dozens or hundreds of such files, and every paste is another transfer event. Resumes sit squarely on the list of what not to paste into ChatGPT.
What does the law say about candidate data?
Under the GDPR, candidate data is personal data like any other: processing it requires a legal basis, and sending it to an AI vendor is a disclosure to a processor that must be covered by a data processing agreement. Fines for serious violations reach 20 million euros or 4% of global annual turnover. Many other jurisdictions apply similar rules to recruitment data, which is why safe AI use belongs in any business AI adoption plan.
How do you work with AI on a resume — step by step?
- Scan the file for every identifying detail — including those hiding in headers, hyperlinks and metadata.
- Replace consistently — every occurrence of the same name gets the same token (PERSON_001), every employer its own (COMPANY_001).
- Work with the AI on the clean version — rewrite bullet points, tailor to a job description, find gaps, improve structure.
- Restore details locally — the replacement map stays only with you, and restoration happens on your own machine.
- Review the output — make sure the AI didn't invent achievements or dates before you send anything.
Is an anonymized resume still useful to AI?
Yes — because what the AI needs is the structure and the professional content, not the identity. "PERSON_001 led a team of five at COMPANY_002" gets rewritten and improved exactly like the original sentence. Consistent replacement preserves continuity: the same employer keeps the same token throughout, so the career timeline still makes sense. That is the core principle of document anonymization.