The Challenge
A 500-person technology company receives 800 CVs per month for open engineering roles. Research shows that names, addresses, educational institutions, and dates of birth trigger systematic unconscious bias in early-stage screening. The HR team wants to implement blind first-round review but lacks budget for an enterprise HR anonymization platform. They also have a GDPR obligation to minimize candidate data exposure: hiring managers should only see skills and experience — not personal identifiers — during the initial scoring phase.
The Solution
HR installs anonym.plus on the recruiting coordinator's workstation. A custom HR Blind Review preset is created targeting: PERSON, EMAIL_ADDRESS, PHONE_NUMBER, LOCATION, DATE_TIME, NRP (nationality/religion/political data), and two custom entities: university name patterns and LinkedIn URL patterns. Batch mode processes the weekly CV batches (DOCX and PDF). Anonymized CVs are distributed to hiring managers for structured scoring. After scoring, the coordinator deanonymizes shortlisted candidates for interview scheduling.
The Results
- Blind first-round review implemented without enterprise software budget — €399 one-time cost
- Hiring managers score candidates on skills, experience, and competencies only
- GDPR data minimization satisfied — personal identifiers not accessible to unauthorized personnel during screening
- Candidate data never leaves the company's network — all processing local
- Deanonymization in one click for shortlisted candidates — no manual work to restore original CVs
- Audit trail of which CVs were anonymized, when, and with which preset
Bias-Triggering Entities Removed
- PERSON — candidate name (gender and ethnic bias risk)
- EMAIL_ADDRESS — often contains name; may reveal nationality or religion
- PHONE_NUMBER — country code reveals nationality
- LOCATION — home address (socioeconomic background signal)
- DATE_TIME — date of birth (age discrimination risk)
- NRP — nationality, religion, political affiliation
- Custom: university names — prestige bias; defined via regex patterns
- Custom: LinkedIn/social URLs — profile photos and demographic signals
GDPR Compliance for Candidate Data
GDPR applies to all candidate personal data from the moment of CV receipt. Key obligations for HR teams:
- Art. 5(1)(c) — Data minimization: Hiring managers should only access personal data necessary for the recruitment decision. Blind review limits access to skills and experience during initial screening.
- Art. 5(1)(e) — Storage limitation: Rejected candidates' data must be deleted after a defined period (typically 6–12 months depending on jurisdiction). Anonymizing rejected CVs is an alternative to deletion that preserves aggregate insights while removing personal data.
- Art. 9 — Special categories: If CVs contain health information, disability status, union membership, or religious symbols, these are special-category data requiring explicit handling. NRP entity type detection covers these categories.
Process your first CV batch. Batch processing guide →
Frequently Asked Questions
What data should be removed from CVs for blind recruitment?
Name, email, phone, home address, date of birth, nationality, university names, LinkedIn URLs, and any indicators of gender, religion, or political affiliation. anonym.plus covers all built-in categories and custom entity regex for institution names and social URLs.
Can I recover original candidate names after blind scoring?
Yes. Use the Encrypt operator instead of Replace for candidate names. After scoring, deanonymize shortlisted CVs in one click using the stored encryption key. Replace-redacted data cannot be recovered — use Encrypt for any identifiers you may need later.