Pasting Resumes Into ChatGPT: What Staffing Agencies Should Know
Oct. 23, 2026 · Franziska Kufner, Loop Talent · 9 min read
Photo: Sasun Bughdaryan / Unsplash
Pasting a resume into an AI chat tool means handing a candidate's complete personal data to an outside vendor. Whether that's permitted depends on your contract with the vendor, its settings, and where it's based. At many staffing agencies, nobody's ever actually checked, because recruiters and account managers just do it. That's true across temp staffing, permanent placement and executive search alike — resumes get processed in bulk everywhere.
This article covers what's actually in a resume, what happens to the data at cloud AI tools, ten questions worth asking any vendor, and how to roll out AI in recruiting without losing track of where your data goes.
As of: October 2026. This is information, not legal advice. Work through open questions with your data protection officer or a law firm. Legal references here are to German and EU law (GDPR, the EU AI Act) as they apply to a German staffing business — check your own jurisdiction's rules if you operate elsewhere.
What's actually on a resume
A resume is more than a career history. Recruiters and account managers often paste the whole thing, address and photo description included:
| Data type | Example on the resume | Why it matters |
|---|---|---|
| Identity and contact | Name, address, phone, email, date of birth | Directly identifies a person |
| Career history | Employers, time periods, roles | Reveals gaps, job changes, industries |
| Health | Disability, rehab, illness-related gaps | A special category under Art. 9 GDPR — only narrowly permitted during hiring |
| Family and background | Marital status, children, nationality | Can lead to discrimination |
| Other details | Religion, union membership, club memberships | Often also special categories |
Where does a resume actually go?
With a cloud AI tool, the text lands on the vendor's servers. What happens next depends on details you don't see on screen:
- Where is the server? Inside the EU or outside it.
- How long is it stored? OpenAI, for example, says temporary chats get deleted within 30 days; its help page doesn't name a retention period for regular chats (OpenAI).
- Is your data used for training? On personal accounts, a toggle ("Improve the model for everyone") controls whether new conversations are used for training (OpenAI). Business plans and API access run under different terms you need to check directly with the vendor.
- Who else is involved? The vendor's own subprocessors, for example for hosting.
- Which contract applies? An employee's personal account is a different thing entirely from a company contract with a data processing agreement.
The paths available
These options differ less in the underlying technology than in who actually controls the data:
| Path | Who controls the data? | What you need to clarify |
|---|---|---|
| An employee's personal account | The employee and the vendor | Is there even a policy at the company? Who has access to the history? |
| Company contract with a cloud vendor | The vendor, per contract | Data processing agreement, location, training, subprocessors, deletion |
| API access inside another piece of software | The software vendor and its own AI vendor | Which AI vendor does the software use behind the scenes? Is that in the contract? |
| Your own model on your own or a rented server | You or your hosting partner | Access rights, deletion deadlines, model upkeep, model license |
Passing candidate profiles on to client companies — common in placement work — is a separate topic and isn't covered here.
Running your own model doesn't remove these obligations. It shifts them: less dependence on third parties, more responsibility for operations, licensing and security.
Ten questions for any AI vendor
- Where are the servers, and where is data actually processed?
- Which subprocessors are involved, and where are they based?
- Is there a data processing agreement, and who signs it?
- Is submitted data used for training — by default, or only if I opt in?
- How long are inputs and outputs stored, and how are they deleted?
- Who at the vendor can read inputs, and under what conditions?
- Are there logs, and what do they contain?
- If AI is a feature inside a larger product rather than the whole product, what data actually leaves that software?
- Can I delete one specific candidate's data on request (right to erasure)?
- What happens to my data after I cancel?
How to roll out AI in recruiting
- Take stock. Ask your recruiters and account managers which AI tools they're already using today — including personally, including "just for a minute." No blame, just a clear picture of where things stand.
- Set a policy. Which tools are allowed, which data may go in, which never (health information, for example)?
- Vet vendors. Get the ten questions above answered in writing.
- Bring in your data protection officer. And tell candidates what happens to their data. Germany's Data Protection Conference (DSK) published guidance on AI and data protection that works well as a checklist.
- A human decides. The AI can suggest, a person makes the call. That's effectively required under Art. 22 GDPR, as described in the GDD practical guide (p. 12).
AI and recruiting: what the EU AI Act brings
The GDD classifies systems used to select or hire people as high-risk AI (Annex III, No. 4 of the EU AI Act; GDD practical guide, p. 12–13). The "AI Omnibus" package pushed the deadline for such systems to December 2, 2027 at the latest, while the substantive requirements stay unchanged (usd). If you're picking tools now, it's worth asking how the vendor is preparing for that.
Common mistakes
- No policy at the company. Then every recruiter decides for themselves, and you never find out.
- Pasting everything instead of just what's needed. For candidate screening, you usually don't need a name, address, or health information at all.
- Trusting the toggle in the tool. Settings apply per account and can change. A contract is more binding.
- Confusing "hosted in Germany" with "no third parties involved." Even there, operators, subprocessors and access still exist.
- Treating the AI as the decision-maker. A suggestion isn't a decision. Nobody should be rejected because a model said so.
- Forgetting deletion deadlines. Outputs and chat histories in AI tools are candidate data too.
Frequently asked questions
Can I paste a resume into ChatGPT? There's no blanket answer. It depends on the contract, the settings, the server location, and which data you're entering. Check with your data protection officer before this becomes routine for your team.
What counts as a special category of data on a resume? Things like health information, religion, or union membership. Under EU data protection law (Art. 9 GDPR) these get extra protection, with narrow exceptions during hiring.
Is it enough to just turn off training in the AI software? Training is only one piece. Storage, access, subprocessors and deletion are still open questions. You need answers to all ten, not just one.
How long can I keep candidate data? Rejected candidates: delete without undue delay as a rule, three to six months is common practice. Keeping data longer in a talent pool needs consent.
Can an AI select candidates on its own? A human has to make the decision. The AI can prepare it, but can't decide alone.
Does the EU AI Act apply to staffing agencies? Systems used to select candidates count as high-risk AI. Under the AI Act's extended timeline, those obligations apply from December 2, 2027 at the latest. Check with a lawyer what that means for your specific setup.
Transparency note
The author works at Loop. Loop builds software for staffing agencies; a self-hosted AI model on our own server is currently under development and not yet in production. This article was written independently of that: the ten questions apply to every vendor, including us, once it's live.