Protecting personal data during job searches and interviews

By Edith Utete | 8h ago

In some cases, candidates are required to fill out forms with compulsory information requested by the employer. While job-searching and interviewing sometimes require sharing personal information, it is crucial to take steps to protect your privacy, as well as other people’s personal information to avoid risks like identity theft or data misuse.

One area that poses high-risks in the modern workplace is the hiring process. Many job seekers use a similar template often borrowed from relatives and friends, where they incorporate personally identifiable information that should be safeguarded in the digital world.

Most of these documents are now shared online, mostly via email and in some cases, through WhatsApp. In some cases, candidates are required to fill out forms with compulsory information requested by the employer. While job-searching and interviewing sometimes require sharing personal information, it is crucial to take steps to protect your privacy, as well as other people’s personal information to avoid risks like identity theft or data misuse.

Job candidates

Here are some pointers for safeguarding personal data during job searches:

Do not include your national identity or passport number on your Curriculum Vitae (CV). This information should only be shared after you have secured the job and only for clearly stipulated legal purposes that are in line with the position offered.

Instead, create a “cyber-safe” version that limits the contact information to your name and a professional email address. Some virtual job platforms allow you to set your profile to “semi-private”, concealing your contact information.

Where a prospective employer specifically requests this information, it is in the prospective employee’s interest to ensure that there is clarity on the relevance of such requests.

lNever provide sensitive details such as your national identity number, bank account information or passwords during the initial stages of a job application. Legitimate employers will only request such information after an offer is made and for background checks or payroll purposes.
Be wary of job postings or recruiters that ask for personal information upfront, as this is a common tactic used in scams.
Do not include your driver’s licence number on your CV or application letter. It is sufficient to state that you are the holder of a clean class 4 drivers licence.
Do not state your exact date of birth. It is sufficient to state that you are 45 years old (or whatever your actual age is) though leaving that out completely would be ideal unless the job advert specifically requires that you state your age.
Avoid using one email address for both personal and professional purposes. Use a separate email account specifically for job applications. This helps reduce spam and phishing risks while keeping your primary email secure.

You should also choose a professional email address such as [email protected], to maintain credibility while protecting your personal inbox.

Do not include personal details of references such as their name, occupation, physical address, email address and telephone number without their express consent for each and every job application. It is good practice to alert the references about the names of organisations that you are sharing their personal details with.
Avoid posting your CV on public online forums or job boards that allow access by anyone. As a precautionary step, it is best to use platforms that allow you to have control over who can view or access your information.
Familiarise yourself with the privacy policies of job boards and companies you interact with. Understand how your data will be used and stored.
It is also essential to research the legitimacy of job boards and companies before sharing your personal data. Scammers often pose as recruiters to collect personal information.
Avoid sending sensitive information via unencrypted email. If you must share personal details, use secure file-sharing platforms or encrypted email services.
When participating in virtual interviews, ensure that your surroundings do not reveal personal information such as family photos or documents where your address is visible.
Keep track of all the organisations and individuals who have received your resume/CV. This can help you identify potential risks if a company experiences a data breach.
Use different versions of your resume for different applications and take note of which version was sent to each employer. This makes it easier to trace any misuse of your data.
Request the destruction or return of your application letter, resume/CV and any other personally identifiable information that you may have shared where your application is not successful.
As you use professional online platforms such as LinkedIn to get professional visibility, enable two-factor authentication to add an extra layer of security to your accounts.
Be cautious of offers that seem too good to be true or require upfront payments, as these are often scams.

Recruiter obligations

Keep Reading

Understand and comply with data protection laws which dictate how candidates’ personal information should be collected, stored and processed.
Limit access to candidate data as this minimises the risk of unauthorised data exposure. Only allow recruiters and authorised personnel to access candidate data. Use role-based permissions in your applicant tracking system (ATS).
The less data you collect, the lower the risk of exposure. Avoid requesting sensitive information during the early stages of recruitment. Collect only what is essential for evaluating candidates.
Be transparent about the usage and storage of candidate data to build trust and confidence in your recruitment processes and systems. Provide a privacy policy that outlines your data protection practices.

Protecting personal data during job searches and interviews

Avoid asking for detailed information about references. Only ask for just what you need to conduct your due diligence exercise. For instance, if you are going to communicate with references via email, there is no need to ask for their physical address. In addition, it may be best to only request these details from shortlisted candidates that you are actually interested in potentially recruiting.
Technology is a double-edged sword — it can streamline recruitment processes while also exposing data to cyber threats. Use encrypted systems for storing and transmitting candidate data.
During interviews, especially virtual ones, ensure the platform being used is secure and reputable.

Regularly update software and systems to patch vulnerabilities.

Unsecured communication can expose candidate data to interception. Use encrypted email services or secure file-sharing platforms to exchange sensitive documents.

Avoid discussing personal information over unsecured channels like public WiFi or unencrypted messaging apps.

Do not send bulk emails that carbon copy (Cc) all recipients which may expose personal email addresses. Use the blind copy (Bcc) function instead.
Human error is a leading cause of data breaches. Provide regular training to recruiters on data protection best practices, including recognising phishing attempts and securely handling candidate information.
Holding onto data longer than necessary increases the risk of breaches. Establish a clear policy for retaining and deleting candidate data. Delete data for unsuccessful candidates after a set period unless they consent to being considered for future roles.
A swift response can mitigate the damage caused by a breach. Have a data breach response plan in place and notify affected candidates promptly as you take appropriate steps to secure compromised systems.
Periodically review your recruitment systems and processes to ensure compliance with data protection laws and identify areas for improvement. Regular security audits help identify vulnerabilities in your data protection practices.

Safeguarding the personal information of job candidates is not just a legal obligation — it is a critical component of ethical and professional recruitment.

Utete is an attorney and digital wellness consultant with 15 years’ experience in consulting and spearheading policy and legislative reform in the areas of broadcasting, digitalisation, regulation of the radio frequency spectrum and intellectual property protection for innovation. As co-founder of Digital Wellness Africa, she is also a Digital Media Use and Online Safety expert, raising awareness, educating and empowering children, parents and educators in the areas of digital skills and smartphone productivity, digital citizenship, cybersecurity, digital reputation management and digital well-being. Utete believes in the power of technology to transform and empower communities and the ability of users to become significant producers of valuable digital assets and not mere consumers. These weekly articles are coordinated by Lovemore Kadenge, an independent consultant, managing consultant of Zawale Consultants (Pvt) Limited, past president of the Zimbabwe Economics Society and past president of the Chartered Governance & Accountancy Institute in Zimbabwe. — [email protected] or mobile: +263 772 382 852.