CVs in ChatGPT: interview questions from AI, candidate data stays in the company

What happens in the film

Monday, 8:30 a.m. Mark, the boss, has a client at nine and job interviews at noon. He pastes three CVs from his email into an AI chat and asks for questions for each person. A coworker glances over his shoulder: whole CVs, with phone numbers and addresses.

The data protection officer says calmly: an entry in the register and a risk assessment. A report may not be needed, but that has to be checked. On top of that: deleting the conversation, reviewing the account settings and a training on using AI. A smaller fire, but a fire. Mark is late for the client.

Take two, this time with the extension. The same rush, the same paste. The icon in the corner shows the number of detected items, and the menu shows what will go to the AI. The chat gets stand-ins for the candidates' details, and the experience stays unchanged. The questions come back with the real names. The decision is Mark's, and he makes it to the client on time.

What the program detects in CVs and HR documents

The detection rules are tuned for Polish data, such as PESEL (the Polish national ID number). Names, e-mails and phone numbers are also found in English text.

• first names and surnames, inflected Polish forms too;
• phone numbers, e-mails, addresses and postal codes with the city;
• company names with a legal form in the employment history;
• national ID numbers, ID card numbers and bank account numbers in HR documents;
• docx, xlsx, csv and txt files. From a CV in Word the chat gets a clean copy with the content only, without the photo and formatting.

What the program doesn't change, or may miss:

• dates of birth, names of schools and universities, a town written without a postal code, company names without a legal form;
• a name hidden in the address of a social network profile: it is best to remove such a link before pasting;
• experience and qualifications: they stay on purpose, because the AI prepares questions from them;
• CVs as PDFs and scans: they are stopped by default, not masked. You can copy the text from a PDF and paste it, and then the program checks it.

You can add missing names as custom phrases to mask.

What the rules say

Labor law in many countries limits what data an employer may ask a candidate for, and the rules differ by country. Sending such data to an external chat on a personal account may be a personal data breach: every breach goes into a register (GDPR Art. 33(5)), and a report to the data protection authority is needed when the breach may result in a risk to the candidates (Art. 33(1)).

The EU AI Act (Regulation 2024/1689) classes AI systems used for recruitment and for evaluating candidates as high-risk (Annex III), and since February 2025 requires companies to ensure the AI literacy of their staff (Art. 4). That is why in the film the AI only prepares questions, and doesn't evaluate or screen out candidates.

Questions and answers