Recruitment Data Consent on a CV
A copied “consent clause” is not a universal requirement. The correct approach depends on the country, the employer, the data included and whether the application covers only the current recruitment or future opportunities.
Start with the employer’s instructions
Read the job advert, application form and privacy notice. An employer should identify who processes the data, for what purpose, on what legal basis and for how long. Do not replace those instructions with a clause copied from an old CV.
Current recruitment and future recruitment are different
An application for a specific vacancy and permission to retain data for later vacancies are separate purposes. If an employer asks for permission for future recruitment, it should be clear, specific and optional. Keep a copy of the wording you accepted and note how to withdraw it.
Minimise the data in your resume
Include information needed to assess your suitability: professional contact details, experience, education and relevant qualifications. Avoid identification numbers, unnecessary full addresses, family information, health data and other sensitive details. A smaller, relevant data set reduces privacy risk and improves readability.
Photos and additional information
A photo or other optional information may involve a different legal basis from data required for the recruitment process. Do not assume that adding a general sentence automatically makes every type of processing lawful. If the employer requests sensitive information, ask why it is necessary and refer to official guidance.
A practical, neutral template
When an employer explicitly requests a statement, use the wording supplied in the advert or privacy notice. If you need to identify the purpose, keep it specific, for example: “I agree to the processing of the additional personal data voluntarily included in my application for the purpose of this recruitment process.” The employer’s identity and scope should be unambiguous. Do not add consent for future recruitment unless you actually want it.
Polish and EU recruitment
In Poland and the EU, recruitment processing can rely on different legal bases depending on the type of data and purpose; consent is only one possible basis. The Polish data-protection authority also emphasises data minimisation and that employers should not collect excessive data “just in case”. Check the latest official UODO material before publishing a standard clause.
What to verify before sending
- the controller/employer is correctly identified;
- the purpose is limited to the intended recruitment;
- future-recruitment consent is separate and voluntary;
- the resume contains no unnecessary sensitive data;
- you know where to find the privacy notice and withdrawal instructions;
- the wording matches the current advert rather than an old template.
Official sources
For Polish recruitment, consult the current “ABC rekrutacji” materials of the Polish Personal Data Protection Office (UODO). For EU rules, consult the official text of Regulation (EU) 2016/679, especially the principles and lawful bases for processing.