A recruiter gets a messy CV ten minutes before a deadline. No clean Word version anywhere, and the client is waiting. So they paste it into ChatGPT to tidy it up.
Ten seconds later it's done. Nobody signed off on it, because nobody had to. It's not written into any process. It's just what people reach for when a CV is broken and the clock is running.
TL;DR
Pasting a candidate's CV into ChatGPT sends their name, contact details, and full work history to a third party with no data processing agreement, no anonymisation, and no record of it happening. Under UK and EU GDPR, and equivalent obligations in Australia and New Zealand, the agency is the data controller for that data. A policy telling staff to stop doesn't work without a faster, safer alternative sitting next to it.
How this actually happens
Ask most ops leads whether their recruiters use ChatGPT and the honest answer is "probably, informally." Nobody has audited it, because it doesn't look like a system: it's a browser tab a recruiter opens when a CV needs fixing fast.
The typical trigger is a scanned PDF, a CV with broken formatting, or a candidate's LinkedIn export that needs cleaning up before it goes to a client. ChatGPT handles the text problem well. It says nothing about what happens to the data once it's pasted in.
Why it's a compliance problem, not just an IT one
- Under UK and EU GDPR, and equivalent privacy obligations under Australia's Privacy Act and New Zealand's Privacy Act 2020, the agency is the data controller for candidate PII. Sending it to OpenAI without consent or a data processing agreement is hard to defend if a candidate or client asks how their data was handled.
- Free-tier AI tools don't guarantee data isn't retained or used for model training.
- There's no anonymisation step: names, emails, phone numbers, and graduation dates (a proxy for age) all go through unfiltered.
- It's invisible to management. There's no log of who pasted what, when, or where it went.
What a safer alternative looks like
A memo telling people to stop doesn't fix this. It just pushes the behaviour underground. The fix is giving recruiters a tool that's as fast as ChatGPT for the same job, without the exposure: no retention, no third-party data sharing, built specifically for CV formatting rather than general-purpose text generation.
That's the direct comparison in Distill vs ChatGPT for CV formatting: what each tool is actually good at, and where the compliance gap sits. It's one half of a broader pattern in how CVs move through an agency; the other half is what happens to formatting consistency once a CV reaches a client, covered in why your agency's CVs don't look consistent. Both trace back to the same root cause, laid out in the two CV mistakes costing agencies client trust.
FAQ
Is it illegal to paste a CV into ChatGPT?
Not automatically illegal, but hard to justify. Under UK and EU GDPR, transferring candidate PII to a third party without consent or a data processing agreement is difficult to defend if challenged, and most agencies don't have either in place for informal AI tool use.
Does this only apply to full-time ChatGPT users?
No. The risk exists the first time anyone pastes a real candidate's data in, even once. It doesn't require a pattern of use, just an instance where personal data left the agency's control without a lawful basis.
Does this apply outside the UK?
Yes. The exposure is sharpest under UK and EU GDPR, but Australia's Privacy Act and New Zealand's Privacy Act 2020 carry similar obligations around candidate PII, so the risk isn't confined to one jurisdiction.
If your recruiters are already reaching for ChatGPT when a CV needs fixing fast, the fix isn't a ban, it's a faster and safer option. Try Distill free and see what a compliant, client-ready CV looks like in under 30 seconds.