CV anonymisation

A recruiter passes personal data to a third party as soon as a CV is sent to a client. The GDPR (art. 5(1)(c)) requires that transfer to respect the data minimisation principle: only information useful to assessing the profile may be shared. Identity data, such as name, surname, photo, address, age and nationality, has no place at this stage.

Anonymisation also protects the recruiter commercially: a candidate presented anonymously cannot be approached directly by the client without going through the agency.

The data to remove is whatever identifies the candidate without saying anything about their skills: name, surname, photo, postal address, personal email, phone number, date of birth, nationality, family situation. The CNIL recruitment guide (January 2023) states that this information should not be passed on without a reason tied to the role.

Some complex layouts make the exercise trickier: highly recognisable employer logos, identifying place names in the education section, or visible links to a LinkedIn profile. An area-by-area redaction tool, like the one built into Nicoka CABS, handles these cases precisely.

France has no explicit legal obligation requiring agencies to anonymise CVs. The law of 31 March 2006 provided for it in companies of 50 employees and more, but the implementing decree was never published, and the measure became optional in 2015.

The GDPR does impose it indirectly, through the data minimisation principle (art. 5(1)(c)): any information passed to a third party must be strictly necessary for the purpose of the processing. The CNIL confirmed this reading in its guide of January 2023 and in its formal notice of April 2024.

From the candidate record, the user opens the module without leaving the CRM. They select the areas to hide directly on the document preview, apply the agency business card configured beforehand, then save the anonymised CV to the candidate record. Sending it to the client happens from Nicoka, through the email templates built into the platform.

The business card set-up, meaning logo, recruiter contact details and file naming conventions, is defined once and applies to every document processed afterwards.

If the candidate CV has not been updated, the anonymised document saved in the record can be reused as it is for a new submission. There is no need to run the redaction process again.

If the candidate has sent an updated version of their CV between two submissions, the anonymisation module has to be applied to the new document. Nicoka CABS keeps the version history, so the recruiter can follow the updates.

The Nicoka CABS anonymisation module handles CVs in PDF format, which are the vast majority of the documents recruiters receive. Word files can be converted to PDF before processing. Redaction works by selecting areas visually on the document preview, whatever the internal structure of the file, including complex layouts with columns, tables or coloured backgrounds.

For any unusual case or atypical layout, the Nicoka support team helps users get started.

The business card is the recruiter identification block that replaces the candidate contact details on the anonymised CV. It usually carries the agency logo, the name of the consultant handling the assignment, their direct contact details and, where useful, the internal reference of the assignment.

In Nicoka CABS, this business card is configured once per user or per agency, then applied automatically to every anonymised CV produced. It is fully customisable: content, formatting and position on the document.