A small company has built a ChatGPT project to shortlist applicants. It has tested it with made-up CVs and it works: it summarises experience, compares it with the job description and returns a score. The next step looks obvious: upload CVs to ChatGPT, this time the real ones arriving through LinkedIn or a university job board. The short answer is that this can be lawful. However, receiving a CV for a vacancy does not authorise any processing you like. And telling the candidate does not, on its own, solve everything else.
There are really two separate questions, and each needs its own review:
- Can the company put that personal data into the AI service it has contracted?
- Can it use what the AI returns to prioritise or reject candidates?
In this article we will discuss...
First question: can you upload CVs to ChatGPT?
There is a legal basis, but it has limits
To handle an application the person has submitted, the usual basis is Article 6(1)(b) GDPR: pre-contractual steps taken at the data subject’s request. So you do not need consent for the whole process, as the Spanish Data Protection Agency (AEPD) points out in its guide on employment relationships.
That said, this basis covers what is needed to assess that application for that vacancy. On its own it does not cover additional profiling or reusing the CV for other openings. Nor does it cover the provider using the files to train its models. The principles in Article 5, such as data minimisation and storage limitation, apply to every use. We cover the basics in using LinkedIn candidate CVs under the GDPR.
A lawful source does not mean a lawful use
A CV arriving through LinkedIn or a university explains how it got to you, not what you can do with it. Check who collected it and what information the candidate received (Articles 13 and 14). Check, too, whether that information mentions that an AI tool will analyse the application. And if the company searches for profiles itself, there is not even a candidate request to rely on.
The AI service is a supplier, and it must be vetted as one
Before you upload CVs to ChatGPT, remember that the company is disclosing data to a third party that processes it on its behalf. That party will usually be a processor under Article 28. So review the contract and whether files are used for training. It also matters how long they are kept, who can access them, which security measures apply (Article 32) and where they are processed. If data leaves the European Economic Area, Articles 44 to 49 come into play.
A post on the AEPD Lab blog puts it well: a free account is not the same as a business account with contractual guarantees. But a paid plan does not guarantee compliance by itself either. What counts are the actual guarantees and settings, as we explain in why paying for AI won’t protect your customers’ data.
Deleting the name is not enough either. Career history, employers and dates are often enough to identify someone. Reducing data is good minimisation, but the CV is still personal data.
Second question: can the AI prioritise or reject candidates?
This is where Article 22 GDPR comes in. It gives people the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them. In fact, Recital 71 gives e-recruiting practices without any human intervention as an example.
Moreover, scoring someone’s fit for a role is usually profiling under Article 4(4), which expressly includes evaluating performance at work. What matters is what the project does with that evaluation.
Five uses that look the same but are not
| Use | Example | Initial legal assessment |
|---|---|---|
| Extract or summarise | A sheet with education, experience and languages. | Acceptable support if the rest of the GDPR is met. |
| Assess suitability | Strengths and gaps against the job; the recruiter reads the full CV. | Usually already profiling. Acceptable with real review, transparency and bias controls. |
| Score and rank | A 0–100 score and a ranking; a person reviews every application. | May be acceptable if the review is effective. Likely high-risk under the AI Act. |
| Reject automatically | Only the top ten, or those above 70 points, move forward. | May be an Article 22 decision: it needs an exception and safeguards. |
| Rubber-stamp | Someone clicks “approve” without opening the CVs. | There is a person, but it may still be an automated decision. |
A human hiring decision at the end does not cure an earlier automated rejection
Many companies reason that “a person makes the final decision”. But whoever interviews five finalists has decided nothing about the two hundred the AI set aside earlier. For those applications, the relevant decision was automated.
The guidelines on automated decision-making, endorsed by the European Data Protection Board, are clear. You cannot avoid Article 22 by fabricating human involvement. Oversight must be meaningful, not a token gesture. And it must be carried out by someone with the authority and competence to change the decision.
The Court of Justice added a nuance in the SCHUFA judgment (C-634/21). An automated score can itself be an automated decision when a third party draws strongly on it. That case concerned creditworthiness, so applying it to recruitment needs analysis. Still, the lesson holds: calling a score that decides in practice a “recommendation” does not change what it is.
Article 22 exceptions are not a formality
Article 22(2) allows three exceptions: necessity for entering into a contract, authorisation by law, or explicit consent. For the first and third, the company must at least guarantee human intervention, the right to express a point of view and the right to contest.
- Contractual necessity. The guidelines accept that tens of thousands of applications may justify automated filtering. But the company must show there are no less intrusive means. Saving a few hours on two hundred CVs will hardly do.
- A little-known nuance. The AEPD guide accepts, read restrictively, an automated first screening in processes with many candidates. Its example is excluding those who lack an essential requirement, such as a required degree. By contrast, a “fit” score produced by a language model is not an objective, verifiable requirement.
- Explicit consent. Sending a CV is not consenting to automated decisions. Moreover, the imbalance between the parties casts doubt on whether consent is freely given.
- Legitimate interest. It is not an Article 22 exception.
In addition, Article 22(4) restricts the use of special categories of data (Article 9) in these decisions. And where Article 22 decisions exist, Articles 13(2)(f), 14(2)(g) and 15(1)(h) require meaningful information about the logic involved and its consequences.
AI Act and recruitment: high risk
Regulation (EU) 2024/1689 lists in Annex III, point 4(a), systems intended to analyse and filter job applications and to evaluate candidates. That is why Article 6(2) treats them as high-risk.
Article 6(3) provides an exception for narrow or preparatory tasks that do not materially influence the decision. However, an Annex III system that profiles natural persons is always high-risk. A project that scores candidates will hardly fit the exception.
What applies today and what arrives in 2027
Following Regulation (EU) 2026/1744, the Digital Omnibus on AI, Article 113 postpones the high-risk obligations for Annex III systems to 2 December 2027. That delay does not suspend the GDPR, which applies in full today.
In Spain, Article 64.4.d) of the Workers’ Statute also applies already. Works councils and staff delegates must be informed of the parameters, rules and instructions of algorithms that affect access to employment. We explain this in what Spanish employers must tell staff about algorithms.
From December 2027, organisations using these systems will take on the obligations in Article 26. These include human oversight by people with competence and authority, relevant input data and logs kept for at least six months. They will also have to inform workers’ representatives and affected candidates.
The risk of building your own agent
This is the point most often missed. ChatGPT is a general-purpose AI system. If a company configures it to screen candidates, it may be changing its intended purpose so that it becomes a high-risk system. In that case, Article 25(1)(c) would treat the company as a provider, with far heavier obligations. This does not happen automatically: it depends on what is built and how it is used.
By contrast, the fundamental rights impact assessment in Article 27 does not apply to every private company that hires. It applies to public bodies, private entities providing public services and certain uses under point 5 of Annex III.
Bias, errors and invented information
Spain’s Law 15/2022 on equal treatment prohibits, in Article 9, discriminatory exclusions in access to employment, including criteria and systems that discriminate indirectly. Using AI does not shift that responsibility to the provider.
Direct variables are obvious: age, sex, nationality or disability. Indirect ones, however, are trickier:
- Graduation year, which reveals age.
- Career breaks, often linked to maternity or caring.
- Name, postcode or university, which can act as proxies for origin.
On top of this come the errors of generative models. They can misread a two-column PDF or attribute experience that does not exist. They can also score the same CV differently on two runs. So test first: repeat an analysis, change only the name or add a career gap, and compare. You should also measure the effect of the rejection threshold.
Is a DPIA needed?
Under the AEPD list, a DPIA is generally required when processing meets two or more criteria. These include profiling, automated decisions and innovative technology. A project that scores applications usually meets several.
Our view is to carry out the DPIA before you upload CVs to ChatGPT with real data, and to record the processing in the record of processing activities (Article 30). If high risk remains, prior consultation under Article 36 should be considered.
What the AEPD said in an almost identical case
Warning AI-00009-2026 (file EXP202600427) concerns a tool designed to score CVs and help prioritise applications, not yet deployed in Spain. The company claimed the final decision would always be human.
The AEPD neither fined the company nor banned AI. It used Article 58(2)(a) GDPR, which allows a warning where intended processing is likely to infringe the Regulation. Specifically, it required data protection by design (Articles 24 and 25), a risk analysis and a DPIA if the risk is high. It also asked for transparency (Articles 12 to 14) and an assessment of whether Article 22 applies. Furthermore, it stressed that human intervention must be effective and not determined in practice by the automated output.
Checklist before you upload CVs to ChatGPT
- Contract: processing agreement, training use and sub-processors.
- Data uses: specific purpose and any reuse.
- Settings: memory, history, shared projects and training opt-out.
- Access: who sees the CVs and the results.
- Retention: periods for CVs and for files stored in the tool.
- Transfers: where data is processed and with what safeguards.
- Criteria: written, justified instructions without discriminatory variables.
- Oversight: who reviews each application and what happens to those at the bottom.
- Information: wording in the job ad, on LinkedIn and with the university.
- Worker representatives: information under Article 64.4.d) of the Workers’ Statute.
- DPIA: before the first real CV.
Meanwhile, the prudent course is to keep testing with fictitious CVs.
How Auratech Legal Solutions can help
Using ChatGPT for recruitment can be viable if it is designed properly. Our artificial intelligence lawyers can review the project and its instructions. We also analyse the provider and the selection workflow, and determine which safeguards are needed before real data is used. We do not give automatic sign-off: we will tell you which use is viable and on what conditions. Tell us about your project.
Frequently asked questions
Do we need the candidate’s consent to analyse their CV with AI?
Generally, no. For an application submitted by the candidate, the basis is Article 6(1)(b) GDPR. Keeping the CV for future vacancies is a different matter, as is relying on explicit consent for a solely automated rejection, which raises serious doubts.
Is it enough to say in the job ad that we use AI?
No. Informing candidates is mandatory, but it does not fix an insufficient legal basis or disproportionate processing. Nor does it make lawful an automated rejection that fits no exception.
If I remove the name and photo, is the CV still personal data?
Usually yes. Experience, employers and dates often make the person identifiable. It is minimisation, not anonymisation.
Is a business account enough to upload CVs to ChatGPT?
It is an important step, but not enough. You need to review the processing terms, settings, retention and transfers. And the company remains responsible for how it uses the output.
Do the AI Act obligations for recruitment already apply?
The Annex III high-risk obligations apply from 2 December 2027. Meanwhile, the GDPR and, in Spain, Article 64.4.d) of the Workers’ Statute already apply.
This article provides general information and is not a substitute for legal advice on a specific case.
