How do I keep candidate personal information safe with AI tools?
Résumés, IDs, references and salary history are personal information. AI tools need clear rules.
- Recruiters paste résumés into ChatGPT.
- Which AI tools are safe?
- How long can we keep data?
Approve specific AI tools with business terms covering storage, training and access, and use AI inside your ATS where possible. Set rules: no IDs, work authorization documents or sensitive details in prompts, and remove anything not needed for the task. Follow PIPEDA or your provincial law on consent, purpose and retention. Tell candidates how you use AI.
Rules
| Data | AI use |
|---|---|
| Job descriptions | Yes |
| Résumé skills and experience | Approved tools |
| IDs and work authorization | Never |
| Health, family or other sensitive details | Never |
How we look at it at ShoutEx
We design automations that keep candidate data in approved systems.
- Personal AI accounts.
- IDs in prompts.
- Keeping data forever.
- No candidate notice.
- Approved tools.
- Minimal data.
- Retention policy.
- Candidate notice.
What recruiters and regulators say
Here is what regulators and recruiters say.
Consent, limited use and retention, and safeguards.
Read PIPEDA in brief →Avoid inappropriate profiling and limit data.
Read the principles →Community summaries describe recurring themes in public threads, not individual posts. Vendor pages describe vendor claims, so test them on your own calls.
Read next
Go deeper in the ShoutEx guides, or check the sources behind this answer.
We'll design automations that keep data safe.
Book a call →Follow-up questions
Does Quebec have different rules?
Yes, Quebec's private-sector privacy law is stricter.
What about US candidates?
State laws vary. Check where candidates live.
Can candidates ask for deletion?
Have a process for requests.