GDPR Statement for Your CV: Examples & When to Use One
In this article, we'll discuss the implications of GDPR for your job applications, and when, why and how to add a GDPR statement to your CV.
The GDPR provides comprehensive data protection rights to individuals across the EU and the UK. When it comes to your CV, it's understandable to have concerns about how recruiters and employers will handle and process your personal data, but GDPR provides protection.
In this article, you will learn:
- What a GDPR statement is, and whether you need one on your CV.
- Whether a GDPR statement is optional or mandatory for your CV.
- Ready-made GDPR examples.
- Where to place a GDPR statement on your CV.
- Common mistakes to avoid with GDPR statements.
What is a GDPR statement and do you need it on your CV?
The General Data Protection Regulation, or GDPR, is a wide-ranging piece of EU legislation providing data protection rights for individuals. The UK has its own version of GDPR, which is very similar to the EU version but differs in a few aspects. When you send your CV (which contains personal information) to a recruiter or employer, they have responsibility to handle and process the document in accordance with GDPR laws.
One thing you can do to ensure proper treatment of your CV regarding your personal data, is to insert a GDPR statement into the document. This gives you control and consent over the storage, processing and sharing of your personal data. By adding a GDPR statement to your CV, you can feel more assured that your personal data will be handled safely and securely.
Under UK GDPR, employers and recruitment agencies have responsibility to store, process and protect your personal data securely. Recruiters may also ask you to sign or opt-in to a privacy statement or consent form that outlines how they will use your personal data. This means that for UK job applications, a GDPR statement is optional, not mandatory.
In the EU, employers are legally required to inform you how they will store and process your personal data. However, if you can't see one of these in the job listing, adding a GDPR statement to your CV can provide extra protection. It's also worth noting that GDPR statements in CVs are mandatory when applying to some EU countries.
Let's take a look at when a CV GDPR statement is optional, and when it's mandatory:
When it is mandatory
- Certain EU countries (Poland, Italy, Spain, Germany, Romania, Czechia, Hungary and Portugal)
- Public sector roles (civil service/government, healthcare, education, law enforcement, social work)
- Regulated industries (financial services, insurance, legal services, HR/recruitment, cybersecurity)
When it is optional
- UK-based applications (any private sector job application to a company based in the UK)
- International applications within the EU (when applying for a job from the UK, to a hiring company within the EU)
- Speculative applications where data may be stored and there are no explicit data protection or privacy statements
Examples of GDPR statement for your CV
If you're thinking of adding a GDPR statement to your CV, take a look at the examples below to help you when writing your own:
Universal GDPR clause |
I hereby consent to the processing of my personal data contained in this CV for recruitment purposes in accordance with applicable data protection legislation, including the General Data Protection Regulation (GDPR). |
UK-specific GDPR statement |
I consent to the processing of my personal data for recruitment purposes in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. |
A GDPR statement providing consent to retain information for future opportunities |
I consent to the processing of my personal data for current and future recruitment processes and authorise the retention of my CV on file for consideration for suitable future opportunities, in accordance with applicable data protection laws. |
CV examples with a GDPR clause
Jobseeker can help you craft an eye-catching CV with a suitable GDPR statement. However, you don't need to write this manually. Using Jobseeker's CV builder to create your CV, you can insert a pre-written GDPR clause automatically into the footer of your document, ensuring suitable positioning and formatting. You can also adapt and customise the text in the clause according to your requirements.
Take a look at the CV examples below to see how a CV can look with a GDPR statement included:
This applicant for a retail position has included a simple GDPR statement for UK job applications.
This applicant for a mid-level police role has inserted a GDPR statement providing consent that covers both current and future recruitment opportunities.
What counts as “personal data” on a CV?
"Personal data" is any information from your application that someone could use to identify you personally. This generally includes your contact details on a CV and cover letter. However, your work and education history could also be considered personal data in some cases.
Additionally, if you include any sensitive data about your personal characteristics or situation, this would also count as personal data that's protected by GDPR. However, for UK applications it's not generally a good idea to include this information.
The following information is present in most CV templates, and is always considered to be personal data:
- Your name
- Your address
- Your phone number
- Your email address
- Details of your driving licence (if relevant to the position)
This information could also be considered as personal data if it could be used to help identify you personally:
- Your education history
- Your work history
- References
Take a look at the table below to understand the different types of personal data on a CV:
Regular application data | Career chronology | Protected characteristics |
|
|
|
Your rights as a candidate
Under GDPR, you have various rights over your personal data, even after you submit your CV to a recruiter or hiring company. Here's a brief summary of the key data protection rights regarding your job applications:
Access, amends or deletion
You're the owner of the personal data you submit in your CV. If you notice that any of your application data is incorrect, incomplete or no longer relevant, you're within your rights to request that it be removed, updated or deleted.
Right to be forgotten
In the context of job applications, the right to be forgotten means you have the right to demand your personal data is deleted from a company's files or database. This could be because you no longer wish to be considered for a current or future job opportunity. Once you request this, the company must process your demand within a month.
Restrict processing
This means that you can limit the way an organisation uses your personal data. In this case, the organisation is still allowed to store your data, but they're not allowed to do anything with it.
Right to be informed
Employers should be fully transparent about how they process your CV. This is usually via a privacy notice, explaining why they hold your data, who they share it with, and how long they will keep it.
Common GDPR mistakes to avoid on a CV
When writing a GDPR statement for your CV, be mindful of these common mistakes:
Mistake | Why it's a problem |
|---|---|
Oversharing personal or sensitive data (age, ethnicity, marital status) that isn't necessary | Assuming it's fine to include detailed personal information on a CV just because it's protected by GDPR may result in you including information the employer doesn't want, or that could prejudice your chances of success. |
Using outdated or legally incorrect GDPR statements | Could leave you exposed legally, but could also show employers that you lack the care and attention to include an up-to-date statement. |
Not adapting the statement for different regions | GDPR is slightly different between the UK and EU, so adapting it for each market will show a strong understanding of the regulation. |
Adding GDPR clauses when applying outside GDPR jurisdictions (e.g. USA) | This can show a lack of understanding of data protection laws in the country you're applying to. |
Copy-pasting legal language without understanding it | This can cause complications in the event of you needing to access, amend or remove your personal data at a later date. |
Omitting a GDPR statement when applying in a country that requires it | Shows a lack of care and understanding of local customs and legal requirements. |
Not understanding your own rights as a data owner | If the company fails to store, handle or process your data responsibly, failing to understand your rights could have negative consequences for your data security. |
Key takeaways for adding a GDPR statement to your CV
When writing your CV, there are a few key GDPR points to keep in mind.
To start, a GDPR statement is mandatory in various EU countries (including Poland, Italy, Spain and Germany), and is a great idea for certain roles (public sector jobs or highly regulated industries). Adding a GDPR statement to your CV in the UK is optional, but it can give you peace of mind over how your personal data will be stored, handled and processed.
Also, you hold significant rights over the personal data on your CV, even after you've submitted your application. And finally, Jobseeker can simplify the process of adding a GDPR statement to your CV with a pre-written example you can add at the touch of a button and customise to your needs.
On Jobseeker you can also find a wealth of resources and tools to equip you to write an impactful CV. Pick from various CV and cover letter templates that you can adapt to the role, and your personal style, to make your application stand out and give you the best chance of progressing to the interview stage. Sign up today to create your winning application in minutes.
CV GDPR FAQs
Where should a GDPR statement go on a CV?
Add your GDPR statement to the footer of your CV, or at the bottom of the document, below all the main content. Use a smaller font (size 8 to 9) so the statement doesn't distract the reader from the body text of your CV, but ensure the statement is still readable in your chosen CV font.
How long should a GDPR statement be?
A GDPR statement needn't be longer than one or two sentences to convey the consents you're granting over your personal data. Simply confirm you're granting consent for the personal data in your CV to be processed by the recruiter in accordance with GDPR regulations. You can also add further clauses, such as permission to retain your personal data for future opportunities, or share your data with relevant parties.
Does adding a GDPR clause actually protect you?
The recruiter or hiring company is responsible for secure storage, handling and processing of your data once you submit your CV. In this sense, the GDPR clause doesn't offer any further legal protection. However, it does show you're aware of your data protection rights, and it may prompt the employer or recruiter to take extra care when processing your personal data.
Do recruiters actually expect a GDPR statement?
In the UK, employers won't generally expect your CV to contain a GDPR statement, but adding one to your CV won't do your chances of success any harm. Some recruitment agencies might ask you to sign or give consent to their privacy policy, which will outline all the details of how they process your personal data, in accordance with GDPR regulations.
Do I need a GDPR statement on LinkedIn or online CVs?
Your LinkedIn profile doesn't generally require a GDPR statement. LinkedIn is responsible for the data of its users, and as a networking platform, it's necessary for you to share certain personal data to connect with other users. However, if you add any CVs or cover letter examples to your LinkedIn profile, you may wish to include a GDPR statement in them. This is because you won't have as much control over who accesses these documents as if you applied for a job directly.
Impress employers with your CV
Step-by-step guidance to create a professional CV in minutes.
