CV redaction: what to remove before you send it on?

Sharing a CV with a client for a placement? Check what needs to come out under GDPR, privacy rules, and plain common sense — plus a checklist so you never accidentally leave in a date of birth.

You're working with a freelancer or staffing agency. A client wants to see a CV. Before you forward that PDF: what needs to go?

What must be removed (usually required under GDPR)

• Address (street and house number).
• Personal phone number.
• Personal email address.
• Date of birth (unless relevant to the role — which is rare).
• Photo (unless explicitly requested and justified).
• BSN / citizen service number (this should never appear on a CV — see recognising BSN numbers).
• Marital status.

What often needs to go (commercial reasons)

• Names of current or recent employers (competitively sensitive).
• Specific client names from previous projects.
• Hourly rate or expected compensation.
• LinkedIn URL (unless sharing it is the whole point).

What stays in

• First name or initials.
• Job title.
• Skills and technologies.
• Experience described in abstract terms ("Dutch bank", "international consultancy firm").
• Education.
• Certifications.

How to do it quickly

1. Open the PDF in PDF Redact or another tool with true redaction support.
2. Use pattern matching for phone numbers and email addresses.
3. Manually select any name references.
4. Strip metadata (see stripping metadata).
5. Export as a new file.

How to build a process

• Use a shared template for redaction patterns so everyone follows the same approach.
• Apply a four-eyes principle for sensitive cases.
• Keep both the original and the redacted version with an audit trail link.

See also: redaction guide, external parties access.