It is a reasonable thing to wonder about. You upload your CV to a job board, hand it to three agencies, and it now exists on servers you will never see. So: can recruitment agencies train AI on your CV, and what can you actually do about it?
The short answer is that it depends entirely on their lawful basis and what they told you, that UK law gives you real rights here, and that the practical protection comes from asking a few direct questions before you hand it over.
Your CV Is Personal Data
Start here, because everything follows from it. A CV is personal data under UK data protection law, often a lot of it. Employment history, education, contact details, sometimes health information disclosed in an adjustment request, sometimes information that reveals ethnicity or religion through organisational membership.
That means an agency holding your CV is a data controller with legal obligations, and you are a data subject with enforceable rights. This is not a matter of their goodwill.
Can They Use It as AI Training Data?
Not by default, and not simply because they possess it.
To process your data for any purpose, an organisation needs a lawful basis and must have told you about that purpose. Recruitment agencies typically rely on legitimate interests for the core activity of matching you to jobs, which is what you came to them for and what you would reasonably expect.
Training an AI model is a materially different purpose. It is not what you submitted your CV for, and it is not something most candidates would reasonably expect. To do it lawfully an organisation would need to have identified it as a purpose, told you about it, and satisfied itself it has a basis for it, which for a purpose this far from your expectations is a demanding test.
The principle in play is purpose limitation: data collected for one purpose cannot be freely repurposed for something incompatible with it. Your CV was given to find you work.
So a well-run agency will tell you plainly that it does not use candidate data to train models. A poorly-run one may never have thought about it. And this is exactly why the question is worth asking out loud.
The Subtler Risk: the Tools They Use
This is the part most candidates miss, and it is more likely than the agency itself training a model.
Most agencies do not build AI. They buy software. If that software sends your CV to a third-party model provider for processing, your data has travelled further than the agency's own systems, and whether it is retained or used for improvement depends on terms between the vendor and that provider, terms that vary by product tier and change over time.
Which means the honest question is not just "do you train AI on my CV" but "which third parties process it, where, and is it used for model training by any of them". A competent agency can answer. One that cannot has a supply chain it does not fully understand.
The Rights You Can Actually Use
These are enforceable, free to exercise, and organisations generally have one month to respond.
- Right to be informed. They must tell you what they do with your data, why, who receives it, how long they keep it, and whether automated decision-making is involved. This lives in their privacy notice, and it is worth actually reading before you register.
- Right of access. You can request a copy of the personal data held about you. This can include notes, assessment records and scores, not just your CV back.
- Right to rectification. Inaccurate data must be corrected. Useful if a parser has mangled your history.
- Right to erasure. You can ask them to delete your data. Not absolute, but strong once you no longer want their service.
- Right to object. Where processing relies on legitimate interests, you can object. They must stop unless they can show compelling grounds that override your rights.
- Rights around automated decisions. Decisions made solely by automated means with a significant effect on you are restricted. You can ask for human involvement, express your view and contest the outcome.
That last one matters for job hunting specifically. A rejection significantly affects you, so it should not be made by a machine alone with no human involvement.
What to Ask Before You Register
Five questions. Any decent agency will answer them without fuss, and the way they respond tells you as much as the answers.
- Is my CV or any data from it used to train AI models, yours or a third party's? You want a plain no.
- Which third parties process my CV, and in which countries? Transfers outside the UK are lawful with the right safeguards, and you are entitled to know they happen.
- How long do you keep my data if I am not placed? A defined period, not indefinitely.
- Will you share my CV with employers without asking me first? The answer should be no. Your CV being sent to your current employer is a real and avoidable harm.
- Is any screening decision made without human involvement? There should be a person in the loop.
Practical Steps That Reduce Your Exposure
- Minimise what you volunteer. Leave out full postal address, date of birth, nationality, marital status and photograph. They are not needed to assess you and they widen what is held about you.
- Be deliberate about job boards. A publicly searchable CV can be downloaded by anyone with a recruiter account. Consider keeping it private and applying directly.
- Keep a list of who holds your CV. Erasure requests are much easier when you know where to send them.
- Read the privacy notice at registration. Tedious, and it is the one moment you can see the purposes before consenting to anything.
- Send an erasure request when you are placed or have moved on. A short email is enough.
- If an organisation ignores your rights, you can complain to the ICO. Raise it with the organisation first, and escalate if the response is inadequate.
Frequently Asked Questions
Can a Recruitment Agency Use My CV to Train AI Without Telling Me?
They would be on very weak ground. Processing requires a lawful basis and transparency about the purpose, and AI training sits well outside what you would reasonably expect when submitting a CV for job matching. Purpose limitation prevents freely repurposing data collected for something else.
How Do I Find out What an Agency Holds About Me?
Make a subject access request in writing, an email saying you are requesting a copy of all personal data held about you is sufficient. They normally have one month. Ask specifically for assessment notes, scores and any automated screening output, not only your CV.
Can I Ask Them to Delete My CV?
Yes. Send an erasure request stating you no longer wish them to hold your data. It is not absolute, they may retain some records for legal obligations, but once you are no longer using their service the balance strongly favours deletion.
Is It Safe to Upload My CV to Job Boards?
It is a trade-off. A searchable CV generates opportunities and is downloadable by anyone with recruiter access, including potentially your current employer. Keeping it private and applying selectively gives you more control at the cost of some inbound interest.
Can I Object to AI Being Used on My Application at All?
You can object to processing based on legitimate interests and ask for human involvement in a decision that significantly affects you. In practice an employer may decline to proceed differently, but asking is legitimate and a transparent organisation will explain what happens.
The Balanced View
Automated screening is not inherently a threat to you, and in some respects it treats you more consistently than a tired human reading application number 190. What matters is whether the organisation is honest about what it does, keeps your data where it says it does, keeps a human in the decision, and does not quietly repurpose your CV as training material.
CVSense operates on the position that candidate data is not training material, that screening output carries the evidence behind it so a decision can be explained, and that a human confirms every outcome. Those are the conditions under which this technology works in your favour rather than at your expense, and they are the conditions worth asking any organisation to confirm.
Sources
Information Commissioner's Office. Guidance on AI and Data Protection.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/
Information Commissioner's Office. Right of Access.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-of-access/
Information Commissioner's Office. International Transfers.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/
Data Protection Act 2018.
https://www.legislation.gov.uk/ukpga/2018/12/contents
InsightCircle
