Introduction: the file you compile on yourself
You've sent forty applications this quarter. Each one contained your full name, your postal address, your date of birth, your personal phone number, a photo, a detailed history of your last twelve years, the names of your former employers and, in a third of cases, a "driving licence" tick box and another for "marital status".
You were hired by exactly one of those companies. The other thirty-nine are keeping the file.
That's the paradox of job hunting: it's the only moment in adult life when we willingly hand strangers a file more complete than the one held by our own bank. And we do it in bulk, under pressure, without negotiating.
Yet French law is more protective here than elsewhere. The Labour Code has explicitly regulated recruitment since the 1992 Aubry law. The GDPR layers on top of it. The CNIL publishes precise recommendations. The problem isn't a lack of rules: it's that nobody knows them — neither candidates nor half the recruiters.
This guide sorts out what can legally be asked of you, what gets asked anyway, and what you can refuse without torpedoing your application.
What the law actually allows a recruiter to collect
The "direct and necessary link" rule
It all comes down to article L. 1221-6 of the French Labour Code:
"Information requested from a job applicant, in whatever form, may have no purpose other than assessing their ability to fill the position offered or their professional aptitudes. Such information must bear a direct and necessary link to the position offered."
Two words matter: direct and necessary. Not "useful", not "nice to have on file". Necessary.
The candidate, the same article adds, "is required to answer these requests in good faith". In other words: the duty of sincerity applies only to legitimate questions. To an illegitimate question, you owe no truth whatsoever — employment case law is consistent on this point, and a lie about a subject unrelated to the job does not amount to the kind of fraud that would void a contract.
What flies and what doesn't
| Information requested | Status | Why |
|---|---|---|
| Qualifications, experience, skills | Legitimate | Core of professional assessment |
| Salary expectations | Legitimate | Contractual negotiation |
| Driving licence | Legitimate if the job requires it | Direct link required |
| Date of birth | Tolerated, rarely necessary | Useful for payroll, not for screening |
| Photograph | Never mandatory | Proven driver of discrimination |
| Marital status, children, pregnancy | Prohibited | Discrimination (art. L. 1132-1) |
| Ethnic origin, religion, sexual orientation | Prohibited | Sensitive data (art. 9 GDPR) |
| Trade union or political affiliation | Prohibited | Sensitive data |
| Health status, disability | Prohibited for recruiters | Occupational physician's remit only |
| Social security number | Prohibited at application stage | Only upon hiring |
| Criminal record extract | Prohibited except regulated jobs | Exhaustive list |
| Bank details | Prohibited at application stage | No legitimate purpose |
The CNIL regularly restates this framework in its guidance on recruitment: collection must remain proportionate to the purpose, and the absence of a photo or date of birth on a CV cannot, in itself, be grounds for rejecting an application.
Retention periods
This is the most frequently breached rule, and the easiest to enforce.
The CNIL uses two years from the last contact with the candidate as its benchmark for files kept in a CV database, and only if the candidate has been informed. After that, the file must be deleted. For an unsuccessful candidate whose details you don't wish to keep, deletion should happen promptly once the position is closed.
In practice? Applicant tracking systems hold profiles dating back eight or ten years, complete with recruiters' notes from the time. Those notes are part of your personal data: you have a right of access to them.
What actually happens while you wait for an answer
Silent sourcing
Your CV is just the front door. What happens next is rarely documented in the job ad.
- The name search. Your name gets typed into a search engine. This is legal — public information stays public — but the recruiter may only use elements bearing a direct link to the job. Discovering your voluntary work or your opinions on social media and using it to reject your application amounts to discrimination.
- Professional networks. Viewing your profile is routine. Cross-referencing your past roles with your connections to call "a mutual friend" without your consent, however, sidesteps the rule on contacting references, which requires that you be informed first.
- Reference checking. Calling your current employer without warning you is a classic blunder, and potentially devastating if your search is confidential. The CNIL and professional practice agree: the candidate must be informed, and must supply the list of contactable people themselves.
Tests, questionnaires and asynchronous video interviews
Over the past five years, the asynchronous video interview has become commonplace: you answer alone, facing a camera, to questions displayed on screen, with a timed preparation window.
This format generates a brand-new type of data: your face, your voice and your speech patterns, recorded and stored. Three questions are worth asking before you agree.
- Who hosts the video, and for how long? The answer must appear in the provider's privacy notice.
- Is the video analysed automatically? So-called "emotional" analysis and automated scoring of non-verbal language rest on highly disputed scientific foundations, and fall under the automated decision-making rules of article 22 of the GDPR: you have the right to obtain human intervention.
- The European AI Act classifies AI systems used for screening applications and evaluating candidates as high-risk uses, with transparency and human oversight obligations. Explicitly asking whether an automated system is involved in the selection is neither aggressive nor far-fetched: it's exercising a right.
On the practical side, if you sit these interviews regularly, two accessories change everything: an adhesive webcam cover that guarantees nothing is filming between sessions, and a neutral background — a plain wall, a tidy bookcase, or a portable screen. A bedroom filmed in wide angle tells the story of your home, your standard of living and sometimes your family life. That wasn't the question you were asked.
Personality tests
They are legal, subject to three cumulative conditions restated by the CNIL: they must be relevant to the position, be disclosed to the candidate before they are taken, and be followed by feedback on the results. You can ask to receive your results: that's a right of access, not a favour.
Building an application that says enough, and no more
The minimum viable CV
The idea isn't to hide, but to hand over only what serves to assess your work.
What you can remove without harm:
- The photo. Not required. The Défenseur des droits' studies on hiring discrimination testing show, campaign after campaign, the effect of name and appearance on callback rates. Removing the photo is both an act of self-protection and a political gesture.
- Your full postal address. "Lyon" or "north of Paris" is enough to assess geographical feasibility. Your street number says nothing about your skills, but a great deal about your neighbourhood — and address-based discrimination has been a prohibited ground since 2014.
- Your date of birth. It only becomes useful at contract stage.
- Marital status. Of no professional interest, ever.
What you can compartmentalise:
- A phone number dedicated to job hunting. A second line, physical or eSIM, keeps your personal number out of agency databases where it could be resold or recycled into cold calling. A dual-SIM mobile phone makes this painless, and lets you switch the "work" line off at weekends.
- A dedicated email address. It lets you instantly spot which agency shared your details, and shut everything down once you're hired.
The PDF that says too much
Your CV is probably a PDF exported from a word processor. Open its properties: it often contains your computer's name, your user account name, the software used, sometimes the title of an older file ("CV_application_competitor_v3"), and the exact creation date.
Three habits:
- Check the metadata before sending (the "Document Properties" menu in your PDF reader).
- Name the file properly:
Firstname-Lastname-CV-2026.pdf, notCV_latest_version_checked_by_mum.pdf. - If you send scanned documents (diplomas, certificates), redact anything unnecessary: social security number, address, ID document number. A portable document scanner handles this far better than a phone snapshot, which often captures your kitchen in the background and embeds GPS coordinates.
Simple rule: a recruiter never needs a copy of your ID before the contract is signed. A request to scan your identity card, bank details or health insurance card at the application stage is a classic scam signal, regularly reported on the Cybermalveillance.gouv.fr platform.
Job hunting while employed: discreet mode
This is the trickiest situation. You're looking, but your current employer must not find out.
The most common leaks
| Leak | Mechanism | Countermeasure |
|---|---|---|
| Professional profile updated | Automatic notification to contacts | Turn off update broadcasting before editing |
| "Open to opportunities" badge | Visible depending on settings | Restrict to recruiters, never "everyone" |
| Applying from your work computer | Browsing history, network logs, work email | Personal devices and connections only |
| Reference contacted without consent | Recruiter in a hurry | State it in writing from the first exchange |
| Repeated absences at the same times | Human observation | Spread out interviews, favour video calls away from the office |
The golden rule: never apply from a tool provided by your employer. Computer, phone, email, company wifi. Employers have the right to inspect files and connections presumed to be work-related, and a simple connection log can be enough to arouse suspicion. If you must handle applications during your breaks, do it from your own device, tethered to mobile data. A privacy screen filter also keeps prying eyes at bay in an open-plan office or on a train.
The sentence to write in your very first message
"My search is confidential. Please do not contact any references or my current employer without my prior written consent."
It costs one line, and it constitutes dated evidence if the rule is broken.
After the rejection: making the file disappear
This is the step almost nobody takes, and it's the most effective one.
Your rights, in concrete terms
The GDPR gives you four levers you can use against an employer or an agency:
- Right of access (art. 15): obtain a copy of all the data held about you, including recruiters' notes, scoring grids and test results. Many candidates don't realise that comments written in the recruitment software are disclosable.
- Right to rectification (art. 16): correct inaccurate information.
- Right to erasure (art. 17): request deletion of the file once the application is closed.
- Right to object (art. 21): refuse to be kept in the CV database.
The data controller has one month to respond, extendable by two months in complex cases. If there's no reply, a complaint can be filed with the CNIL online, free of charge, in a few minutes.
The template message
Subject: Request for erasure of my personal data (art. 17 GDPR)
Dear Sir or Madam,
I applied on [date] for the position of [job title] within your organisation. As my application was unsuccessful, I request the erasure of all personal data concerning me: CV, cover letter, correspondence, notes, test results and any recordings.
Please confirm this deletion within one month, in accordance with article 12 of the GDPR.
An email is sufficient. Keep a copy.
A reasonable rhythm
There's no need to write to every company the day after a rejection. A quarterly thirty-minute session is enough: you go back through your list of applications and send the requests in one batch. Keeping that list in a spiral notebook or a simple spreadsheet means you don't depend on a third-party platform to know who holds what about you.
The case of platforms and agencies
The big job boards are not recruiters: they are intermediaries whose business model rests on profiles circulating. Three precautions.
- Check your CV's visibility. "Visible to all recruiters" often means: visible to any company with a subscription, including your own.
- Don't fill in optional fields. Marital status, number of children, exact current salary: these boxes are targeting fields, not evaluation criteria.
- Delete the account, don't let it lie dormant. An inactive profile stays indexed and keeps getting scraped by automated sourcing tools.
As for the too-good-to-be-true offers arriving by text or messaging app — "work from home, €2,000 a week, send your bank details" — they are now among the most frequently reported scam vectors. No serious employer recruits via an unsolicited message, and none asks for money or bank details before hiring.
Conclusion: applying is not surrendering
An application is a professional proposal, not a sworn statement. You're offering skills in exchange for pay; neither your health, nor your family, nor your face is part of the transaction.
The power imbalance is real, and nobody will pretend that a job seeker under pressure negotiates as an equal. But most surplus data isn't demanded at all: it's handed over in advance, out of habit, because a form happened to include a box. Removing a photo, replacing a full address with a city, using a dedicated phone line and sending four erasure emails per quarter costs almost nothing and loses you no interviews.
What you don't hand over can't be kept for eight years in a piece of software, resold, or exposed in a data breach. It's the only protection that depends on nobody but you.
