A client hires your candidate directly, bypassing your agency. This isn't just frustrating — it costs you revenue and damages your candidate relationships. Protecting candidate ownership starts with anonymising CVs properly before client submission. Strip out the right info, every time, so clients can't contact candidates without going through you.
TL;DR
Candidate ownership means controlling how and when your candidates' data reaches clients. To protect your agency, always remove four key pieces of information before sending CVs out: name, contact details, photos, and graduation year. Build a clear, repeatable process your team can follow without slowing down. Use a written policy to set expectations and handle compliance. Tools like Distill automate this stripping, reducing errors and saving time.
What candidate ownership means legally and commercially
Candidate ownership is more than a sales tactic. It's a legal and commercial necessity in recruitment. Losing control of candidate data risks your revenue, compliance, and reputation.
Legally, candidate ownership isn't explicitly defined by statute. Instead, it arises from contract terms between your agency and your client, and from data protection principles under GDPR. Under GDPR, you must have a lawful basis to share candidate data. Sending a CV with identifiable details implies consent or a contract permitting that sharing. If candidates contact clients directly, you lose control of the process—and potentially your fee.
Commercially, candidate ownership means your agency is the gatekeeper. Your client shouldn't be able to approach candidates without going through you first. If they do, your candidate relationships degrade, and clients may cut you out entirely. Industry best practice is to anonymise CVs before client submission. This reduces the chance of direct client-to-candidate contact.
Your candidate ownership policy recruitment teams rely on must balance legal risk, commercial protection, and candidate experience. It's not enough just to promise ownership—you must implement processes that enforce it.
The four types of information to always remove before client submission
To protect candidate ownership, anonymise each CV by removing:
- Name and personal details: Full name, nicknames, and any unique identifiers like candidate ID numbers.
- Contact details: Phone numbers, email addresses, personal websites, LinkedIn URLs, and social media handles.
- Photos: These can identify candidates and reveal ethnicity, which may create compliance risks under blind hiring.
- Graduation year: This can reveal age indirectly, exposing your agency to potential age discrimination claims.
Removing these four categories isn't arbitrary. It prevents clients from bypassing you by contacting candidates directly or forming a relationship without your knowledge. It also aids compliance when you anonymise candidate data before sharing.
Other details like work history, skills, and qualifications should remain. Candidates need to sell themselves. But anything that could identify or contact the candidate must go.
If your clients insist on more information, negotiate contract terms that protect your ownership clearly. You can offer full CVs only after a formal interview stage or with signed agreements.
Building a repeatable anonymisation process
Consistency is key. An ad hoc approach leads to mistakes and breaches.
Start by defining a standard operating procedure (SOP) for anonymising CVs:
- Step 1: Receive the CV from the candidate or recruiter.
- Step 2: Strip out name, contact details, photos, and graduation year.
- Step 3: Save the anonymised CV in a dedicated folder or ATS field.
- Step 4: Submit the anonymised version to the client.
- Step 5: Retain the original CV with full details securely for your records.
Use a checklist or template to ensure nothing is missed.
If your team formats CVs manually, errors creep in. Tables, columns, and headers often hide contact details. The best practice is to use an automated tool that detects and removes these fields reliably.
Remember that anonymisation isn't just deleting text. Formatting quirks, headers, footers, and metadata can carry identifying info. Your process must cover these.
How to enforce it across your team without adding friction
For busy recruiters, extra steps feel like a burden. You need enforceable processes that don't slow hiring.
- Make anonymisation part of the CV upload or submission workflow. For example, your ATS or email system can prompt recruiters to anonymise before sending.
- Use automation where possible. Tools like Distill strip candidate name, email, phone, photo, and graduation year before submission. This reduces errors and saves time.
- Train your team regularly. Explain why anonymisation protects their commission and the agency's reputation.
- Audit submissions. Randomly check CVs sent to clients. Provide feedback quickly on any slips.
- Create accountability. Tie anonymisation compliance to performance reviews or team KPIs.
- Keep the process simple and visible. Avoid complex forms or extra software installs that discourage compliance.
The goal is to embed anonymisation so deeply that it becomes a reflex, not a chore. The less effort it takes, the more consistent the protection.
Template: candidate data handling policy for your agency
Use this template to build your own candidate data policy. Share it with recruiters and clients to set clear expectations.
Candidate Data Handling and Ownership Policy
Purpose: To protect candidate ownership by anonymising CVs before client submission and ensure compliance with data protection laws.
Scope: Applies to all agency recruiters and staff submitting candidate CVs to clients.
Policy:
- All CVs must have personal identifiers removed before sharing with clients. This includes:
- Candidate name and personal identifiers
- Phone numbers and email addresses
- Candidate photographs
- Graduation year or any age-related information
- Anonymised CVs shall retain all relevant employment history, skills, and qualifications.
- Original CVs with full details must be stored securely in the agency's systems.
- Breaches of this policy will be investigated and may lead to disciplinary action.
- Candidates' data shall be handled in accordance with GDPR and other applicable data protection laws.
- Any exceptions to this policy require prior approval from agency management.
Compliance: The agency will conduct regular audits to ensure adherence to this policy.
This policy sets a clear foundation. Adapt it according to your agency's size, specialisms, and client contracts.
FAQ
Why can’t I just send full CVs?
Sending full CVs exposes candidate contact info, allowing clients to bypass your agency. This risks losing placement fees and breaches data protection best practice.
Isn’t anonymising CVs extra work?
Manual anonymisation can be time-consuming. Automation tools like Distill handle this instantly and reduce mistakes.
What if a client wants full details for shortlisted candidates?
You can agree to share full CVs only after a formal interview stage or signed agreements confirming candidate consent.
Is removing graduation year necessary?
Yes. Graduation year can reveal age, risking age discrimination claims under the Equality Act 2010.
How often should I audit anonymisation compliance?
Monthly spot checks are a good start. Increase frequency if you detect issues.
Does anonymisation affect candidate experience?
Candidates still present their skills and experience fully. Only identifiable data is removed before client submission.
If you're sending 20+ CVs a week to clients who require anonymised submissions, Distill formats them to the spec above automatically. Try Distill free to save time, reduce errors, and protect your candidate ownership.