GDPR-Compliant Resume Parsing in Practice
A CV is among the most personal documents a person produces, and EU ones carry photos, birth dates and marital status. Seven concrete rules that keep a parsing pipeline on the right side of GDPR.
GDPR treats every parsed resume as personal data processing: you need a lawful basis, a declared purpose, a retention limit, a processor agreement with your parsing vendor, and answers ready for access and deletion requests. The seven rules below turn that into an implementation checklist.
Rule 1 — Name your lawful basis before the first parse
For active applications, processing is usually justified as steps prior to entering a contract (Art. 6(1)(b)) or legitimate interest; for keeping candidates in a talent pool afterwards, you need consent. Decide which applies where, write it into your privacy notice, and make the talent-pool consent an actual checkbox, not a footnote.
Rule 2 — Sign a DPA with your parsing vendor
An API that parses your candidates' CVs is a processor under Article 28, full stop. A data processing agreement is mandatory. The clauses that matter in this niche: processing is transient (documents live only as long as the job), data is never used to train models, and sub-processors are listed. SharpAPI commits to all three, alongside GDPR, SOC 2 Type II and PDPA compliance.
Rule 3 — Minimize what you store, not what you parse
The parser returns 50+ fields, including ones EU CVs volunteer: birth date, nationality, photo links. Extraction is not the compliance event; storage is. Decide field by field what your purpose actually requires, and drop the rest at ingestion. A structured JSON schema makes this trivially auditable; you can point at the exact fields you discard.
Rule 4 — Put a clock on everything
Retention limits apply to the file and the parsed JSON alike. Common practice: delete rejected-candidate data within months of closing the process, keep talent-pool data only under live consent, and re-confirm that consent periodically. Encode the clock in the database: a delete_after column beats a policy document nobody executes.
Rule 5 — Be ready for access and deletion requests
Candidates can demand a copy of their data and its deletion. Structured storage turns both from archaeology into a query: export the JSON, delete the row and the source file, done. If your parsed data feeds downstream systems (search indexes, analytics), map those flows now, because Article 17 follows the data everywhere it went.
Rule 6 — Keep automated decisions explainable
The moment parsed data feeds ranking or screening, Article 22 and the transparency provisions begin to apply; candidates are entitled to meaningful information about the logic involved. Scoring with written per-dimension explanations, computed on PII-stripped data, gives you something to show; an opaque percentage does not. The wider regulatory picture is in the AI screening law guide.
Rule 7 — Ask your vendor the four questions
- How long does a document live on your systems after processing?
- Is candidate data ever used to train or fine-tune models?
- Which certifications back the answers, and can I see the SOC 2 report?
- Where does processing physically happen, and under which transfer mechanism?
A vendor with good answers sends them fast; a vendor without ones stalls. That response time is itself due diligence.
Questions, answered
Is a resume personal data under GDPR?
Unambiguously — and EU CVs often include special-category adjacent data like photos and birth dates. Everything you do with it needs a lawful basis, a purpose and a retention limit.
Do I need a DPA with my parsing vendor?
Yes. The vendor processes personal data on your behalf, which makes them a processor under Article 28 — a data processing agreement is mandatory, and transient processing plus no-training commitments are what you want inside it.
How long can I keep parsed candidate data?
Only as long as the purpose holds. Common practice is deleting rejected candidates' data within months of the process closing unless the candidate consents to a talent pool. Parsed JSON follows the same clock as the file.