Before you send a candidate CV to a client, remove the candidate's direct contact details, any salary or rate expectations, referees' personal contact details, irrelevant personal data like marital status and full address, another agency's branding if it appears, and hidden file metadata or tracked changes. For some clients you also remove the name, photo, and age for blind submission. The one item you remove every single time is the candidate's direct contact details. That keeps the client coming back to you instead of going around your agency.
The rest depends on the role and the client's process. Some clients want a fully anonymised CV. Others are happy with the candidate named but expect a clean, professional document with no leftover clutter from the original file.
This post is a practical checklist, not legal advice. For your own data protection obligations, check with a qualified adviser. What follows is how experienced recruiters prepare a CV so it protects the placement, respects the candidate's data, and looks like it came from a professional agency.
Key takeaways
- Always remove the candidate's direct contact details and replace them with your agency's, so the client routes any approach back through you.
- Remove name, photo, and age only when the client uses blind or anonymised submission. Otherwise it depends on the client process.
- Strip risky or unprofessional items: salary expectations, referees' personal contacts, irrelevant personal data, and any other agency's branding.
- Always export a fresh, clean file so you drop hidden metadata and tracked changes from the original document.
- Do not strip so much that the CV loses substance. The client still needs enough to assess the candidate for the role.
Why it matters
Two things are at stake: your fee and your candidate's data. If a client can see the candidate's phone number and email, nothing stops them from contacting the candidate directly and cutting you out of the deal. Replacing the candidate's direct contact details with your agency's contact block is the simplest way to protect the introduction. Every approach then runs through you.
The second reason is data protection and professionalism. A CV is personal data. Under UK GDPR, the data minimisation principle says personal data should be adequate, relevant, and limited to what is necessary for the purpose. The ICO says you should not include irrelevant details and warns that holding more data than you need is likely to breach the principle, so you should share only what the client needs to assess the candidate for the role. Identifying details can also trigger bias before skills are read: a field experiment found CVs with White-sounding names received 50 percent more interview callbacks than identical CVs with African-American-sounding names. Removing the right details is fairer and safer, as well as tidier. This is general guidance, not legal advice.
What to remove from the CV
The candidate's direct contact details (always)
Remove the candidate's phone number, personal email, and any personal links that let a client contact them directly. Replace this with your agency's contact block. This is the one item you remove on every CV, for every client. It keeps the client coming back to you and protects your fee. Without it, a client can go straight to the candidate and bypass the agency.
Name, photo, age and other identifying details (for anonymised submission)
Remove the name, photo, date of birth or age, and similar identifiers when the client uses blind or anonymised hiring. This reduces bias at the screening stage. A field experiment found identical CVs received 50 percent more callbacks with a White-sounding name than an African-American-sounding name, so a name alone can sway a decision before skills are read. This one depends on the client process. Many clients want the candidate named, so confirm first.
Salary or rate expectations
Remove what the candidate wants to earn. Pay is something you negotiate, not something the client should read off the page. Showing a figure can price the candidate out before an interview or anchor the offer too low. Keep salary talk in your conversations with the client, not on the document.
Referees' personal contact details
Remove referees' phone numbers and emails, and usually the named referees themselves. References belong later in the process, on request, with the referee's consent. Putting their personal data on a CV that goes to a third party is both unnecessary and a data protection risk. A line saying references are available on request is enough.
Irrelevant personal data
Remove marital status, full home address, date of birth, religion, nationality where not required, and any health information. None of it helps a client assess fit for the role, and it can introduce bias or breach data minimisation. The ICO says to leave out irrelevant details and only include what is necessary for the purpose. A town or region is usually enough for location; the full street address is not needed.
Another agency's branding or logos
Remove any other recruiter logo, header, footer, or contact block if the candidate file already carries it. Sometimes a candidate sends a CV a previous agency formatted. Sending that to your client looks careless and advertises a competitor. Reformat it cleanly into your own house template so the document is unmistakably yours.
Hidden file metadata and tracked changes
Remove document metadata (author name, original company, edit history), comments, and any tracked changes in the original file. These can expose the candidate identity, a previous employer, or your own editing notes. They are easy to miss because they do not show on the page. Exporting a fresh, clean document is the reliable way to drop them rather than trusting that they are hidden.
Current employer name (when confidentiality matters)
Consider removing or generalising the current employer name when the search is confidential or the candidate is job-hunting discreetly. You can describe it as a leading retailer or a mid-size fintech instead of naming it. This is context-dependent: name it when there is no sensitivity, generalise it when discretion protects the candidate.
The removal workflow, step by step
Step 1: Reformat into your house template
Start by putting the CV into your agency standard template. A consistent layout makes it obvious what stays and what goes, and it strips any structure inherited from the original file or another agency. This is also where another agency branding disappears, because you rebuild the header and footer as your own.
Step 2: Replace the contact details
Delete the candidate's direct phone, email, and personal links. Drop in your agency contact block so every client approach routes through you. Do this on every CV without exception. Make sure you delete the original details, not just cover them with a box.
Step 3: Strip identifying or sensitive data to match the client's process
Decide per client. For blind submission, remove name, photo, age, and other identifiers. For every client, remove salary expectations, referees personal contacts, and irrelevant personal data like marital status, full address, religion, and health. Generalise the current employer if the search is confidential.
Step 4: Export a fresh, clean file
Generate a new document rather than editing and resaving the original. A fresh export drops hidden metadata, comments, and tracked changes that the old file may carry. Send a clean text-based PDF, or an editable DOCX if the client needs to add notes.
Step 5: Proofread the final document
Read the whole CV one more time. Check that no phone number, email, or other agency logo slipped through, that redaction is consistent, and that the CV still reads well. The goal is a clean, professional document that the client can act on, with you as the single point of contact.
Do this every time
- Always replace the candidate's direct contact details with your agency's contact block.
- Confirm the client's process before deciding whether to anonymise the name, photo, and age.
- Remove salary expectations and keep pay negotiation in your own conversations.
- Replace referees personal contacts with a references available on request line.
- Cut irrelevant personal data: marital status, full address, religion, health, date of birth.
- Reformat into your house template so no other agency's branding survives.
- Export a fresh file every time to drop metadata, comments, and tracked changes.
- Proofread the final version to catch anything you missed and keep redaction consistent.
Common mistakes to avoid
Removing so much that the CV loses substance
Anonymising and tidying is good, but the client still needs to assess the person. If you strip dates, scope, achievements, or context, you leave a thin document nobody can act on. Remove identifiers and clutter, keep the evidence of what the candidate has actually done.
Leaving the current employer name when discretion matters
If a candidate is job-hunting quietly or the search is confidential, naming their current employer can expose them. Generalise it to a sector or company size when sensitivity applies, rather than leaving the full name on the page out of habit.
Hiding text instead of deleting it
Covering details with a white box or hiding a layer does not remove the data. It can still sit in the file and reappear when the client copies text or opens the document differently. Delete the content so it is gone from the output, not just out of sight.
Forgetting hidden metadata
The page can look clean while the file still carries the author name, a previous employer, comments, or tracked changes. People miss this because it never shows on screen. Export a fresh document so this hidden information does not travel with the CV.
Inconsistent redaction
Removing the name in the header but leaving it in the email address, a footer, or a reference line undoes the whole effort. If you anonymise, do it everywhere. Read the full document to make sure no identifier slipped through in a place you did not expect.
Frequently asked questions
What should you remove from a CV before sending it to a client?
Always remove the candidate's direct contact details and replace them with your agency's. Also remove salary expectations, referees' personal contacts, irrelevant personal data like marital status and full address, any other agency's branding, and hidden file metadata or tracked changes. For blind or anonymised hiring, also remove the name, photo, and age. The rest depends on the role and the client's process.
Should I remove the candidate's contact details?
Yes, on every CV. Remove the candidate's direct phone, personal email, and personal links, then replace them with your agency's contact block. This is the one item you take out every time. It means any client approach comes back through you instead of going straight to the candidate, which protects your introduction and your fee.
Do I have to remove the candidate's name?
Only if the client uses blind or anonymised hiring. Many clients want the candidate named, so confirm the process first. Removing the name can reduce bias at screening: a field experiment found identical CVs received 50 percent more interview callbacks with a White-sounding name than an African-American-sounding name. When you do anonymise, remove the photo and age too, and do it consistently across the whole document.
Is a CV personal data under GDPR?
Yes. A CV contains personal data about an identifiable person, so data protection rules apply. Under UK GDPR, the data minimisation principle says you should only include what is adequate, relevant, and necessary for the purpose. The ICO warns that holding more than you need is likely to breach the principle, so share only what the client needs to assess the candidate. This is general guidance, not legal advice; check with a qualified adviser.
Should I remove salary expectations?
Yes. Take out what the candidate wants to earn before the CV goes to a client. Pay is something you negotiate, not something the client reads off the page. A figure on the document can price the candidate out before an interview or anchor the offer too low. Keep salary discussions in your own conversations with the client.
How do I remove hidden metadata from a CV?
Do not just resave the original file, because metadata, comments, and tracked changes can survive. Export a fresh document instead. Generating a new clean PDF or DOCX drops the author name, previous employer details, edit history, and any tracked changes that the original carried. Then proofread the result to confirm nothing identifying remains on the page or in the file.
The bottom line
Preparing a CV for a client comes down to a simple split. One item leaves every time: the candidate's direct contact details, replaced by your agency's, so every approach runs through you. A second group leaves only when the client uses blind hiring: the name, photo, and age. A third group leaves because it is risky or unprofessional: salary expectations, referees' personal contacts, irrelevant personal data, another agency's branding, and hidden file metadata. Remove the right things, keep enough substance for the client to judge the candidate, export a clean file, and proofread before you send. This is general guidance rather than legal advice, but it is how you send a CV that protects your fee, respects the candidate's data, and looks like it came from a professional agency.
If you prepare candidate CVs for clients, RefineCV makes the removal step reliable. You reformat into your branded template with your own contact block, edit out anything you do not want to send, and export a fresh, clean PDF or DOCX that drops the original file metadata. See transparent pricing or compare it with other CV formatting tools. Try it free on 10 CVs, no card.
Send a clean CV, every time
RefineCV swaps in your agency contact block, lets you remove sensitive details, and exports a fresh file with no leftover metadata. Try it free with 10 CVs, no credit card.
Related reading: how to anonymise a CV for blind recruitment, how to format a candidate CV for client submission, and how to add your agency branding to a candidate CV.
Sources
- Information Commissioner's Office (ICO), Principle (c): Data minimisation (UK GDPR guidance) (Accessed 2026): Under UK GDPR, the data minimisation principle requires that personal data be adequate, relevant and limited to what is necessary for the purpose, and the ICO states organisations should not hold more data than they need or include irrelevant details, warning that holding more than necessary is likely to breach the principle.
- Marianne Bertrand and Sendhil Mullainathan, Are Emily and Greg More Employable Than Lakisha and Jamal? (NBER Working Paper No. 9873) (2004): In a field experiment, resumes with White-sounding names received 50 percent more callbacks for interviews than identical resumes with African-American-sounding names, showing that identifying details such as a name can trigger hiring bias before skills are assessed.