As a recruiter or HR professional you share CVs every day — with hiring managers, panel members, and external clients. What often gets overlooked: every time you forward a complete CV, you're distributing personal data that the candidate may not want widely shared, and that under GDPR you arguably shouldn't be distributing unnecessarily.
This guide explains what CV anonymisation means in practice, why it matters legally and ethically, which data you should remove, and how to do it using a browser-based tool with free basic redaction.
📌 In a hurry? Go straight to the tool: nullifycv.com — upload a PDF or DOCX, choose your redaction profile, download the redacted file. Basic redaction is free with no account; CV processing stays in your browser.
What is CV anonymisation?
CV anonymisation — also called CV redaction or blind CV processing — is the systematic removal of personally identifying information from a CV before it is shared with evaluators. The goal is twofold: candidates are assessed on their skills and experience rather than demographic characteristics, and the distribution of personal data is limited in line with GDPR principles.
There are two categories of data to remove:
- Direct identifiers: name, email address, phone number, home address, postcode
- Indirect identifiers (bias signals): graduation year (age proxy), school name (prestige bias), city (demographic proxy), gender pronouns, profile photo
Why CV anonymisation matters
1. Unconscious bias is well documented
Research consistently shows that identical CVs receive different treatment based on superficial personal characteristics. Candidates with non-Western-sounding names receive significantly fewer callbacks than candidates with identical qualifications and a Western-sounding name. Similar effects have been demonstrated for gender, age, postcode, and school prestige.
Removing personal data before CVs reach the scoring panel interrupts this bias at the source. You don't need to change human psychology — you simply remove the data that triggers the bias.
2. GDPR requires data minimisation
GDPR Article 5(1)(c) states that personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed." When a hiring panel needs to assess whether a candidate has the right skills and experience, they don't need the candidate's home address or phone number. Sharing a complete CV with those details to a panel of five people creates unnecessary data exposure.
3. Right to erasure becomes simpler
Under GDPR Article 17, candidates have the right to request deletion of their personal data. If you've forwarded a complete CV to ten people internally, honouring an erasure request becomes complex. An anonymised copy shared with the panel may still contain identifying information — making erasure requests far simpler to manage.
4. A documented, defensible process
Increasingly, organisations in both the private and public sector are asked to account for their recruitment processes. A documented blind hiring workflow, including audit logs of the anonymisation, provides a strong foundation for that accountability.
What to remove from a CV
Standard PII removal (minimum recommended)
- Full name
- Email address
- Phone number
- Home address and postcode
- Graduation year
Bias stripping (recommended for structured blind hiring)
Everything in standard PII, plus:
- School and university names (keep degree type and field of study)
- Gender pronouns in bio sections
- LinkedIn and personal website URLs
- Profile photos
Full blind review
Everything above, plus:
- Religious organisation memberships
- File metadata (author name embedded in DOCX properties)
- All location signals including city names
How to anonymise a CV — step by step
Method 1: Manual redaction (slow, error-prone)
Open the CV in a PDF editor or Word, manually select each piece of PII and delete or cover it with a black box. This takes 5-15 minutes per CV, is inconsistent across reviewers, and creates no audit trail. Not recommended for teams processing more than a handful of applications.
Method 2: NullifyCV (free, fast, private)
NullifyCV processes CVs entirely in your browser — no files are ever uploaded to any server. Here's how it works:
- Upload your CV — drag a PDF or DOCX onto the tool at nullifycv.com
- Choose your redaction mode — Standard PII, Bias Strip, Client Submission, or EEOC Blind Review
- Download the anonymised file — for PDFs, you receive the original with black redaction bars drawn directly over the PII positions. The layout, fonts, and formatting are preserved.
- Download the workflow log — an application-generated JSON file listing detected items and confidence values. It can support internal recordkeeping after review.
Processing time depends on your document and device. Because processing happens locally in your browser using pdf.js and pdf-lib, the tool is designed for local document processing — your candidates' data never leaves your device.
Try NullifyCV free
Try basic CV redaction with no account. The redaction workflow processes the CV on your device.
Try the tool →Frequently asked questions
Does CV anonymisation make our hiring process GDPR compliant?
Anonymising CVs before internal distribution supports GDPR data minimisation principles under Article 5(1)(c). Whether your overall hiring process is fully GDPR compliant depends on many other factors — consult your Data Protection Officer for a formal assessment.
What file formats are supported?
PDF and DOCX files are fully supported. For PDFs with a text layer, black redaction bars are drawn directly onto the original file preserving layout. Scanned PDFs (image-only) should be exported as DOCX first.
Can I process multiple CVs at once?
Basic single-file redaction is free. Annual batch access (€49/year) supports unlimited processing with up to 200 CVs per batch, redaction settings, ZIP downloads and application-generated workflow logs.