Kariora Your data rights when you apply for a job
Your CV is personal data. What information should you see before applying, what does consent actually mean, and how do you get your data deleted? A candidate's guide.
Everything you share when applying for a job — your CV, contact details, screening answers — is personal data, and data protection law gives you concrete rights over it. In Türkiye that framework is the Personal Data Protection Law (KVKK); in the EU it's the GDPR. The principles below are common to modern data protection regimes; we note KVKK specifics where they matter.
This article is general information, not legal advice.
What you should see at apply time
A privacy notice. The data controller (the company or platform you apply through) must tell you why your data is processed, who it may be shared with, and what rights you have. If the application form doesn't link to such a notice, that's a red flag.
Explicit consent — where required. Some processing depends on your explicit consent. When you tick a consent box, read what you're agreeing to: is it evaluating your application for this job, or also keeping you in a talent pool for future roles? These are separate purposes, and properly built systems ask for them separately.
No forced bundling. Declining the talent pool must not block your current application from being considered.
Your core rights
As a data subject you can typically ask the controller to:
- Confirm and inform: whether your data is processed, and details if so
- Check the purpose: what your data is used for, and whether use matches purpose
- Correct: fix incomplete or inaccurate data
- Delete: erase your data when the reasons for processing no longer apply
- Know about transfers: learn which third parties your data has been shared with
- Object to purely automated decisions: challenge an outcome against you produced solely by automated processing
That last right matters especially in hiring: you can object to your application being decided by automation alone. Well-designed hiring systems remove that risk by construction — the software produces suggestions, and a person makes the decision. (For applications made through Kariora, this is a system rule: rejection is never decided automatically.)
Retention: your data shouldn't live forever
Personal data may be kept only as long as its purpose requires. On the employer side that means defined retention policies: when the period ends or you request it, your data must be deleted. Deletion should mean real erasure — including the CV file itself — not just hiding the record from view.
Practical tips
- Open the privacy notice — especially the "purpose" and "transfers" sections.
- Evaluate consent boxes one by one. If you don't want to stay in a talent pool, don't tick that box.
- Keep special-category data off your CV. Health information, religion and similar sensitive data are almost never needed in an application; don't volunteer them.
- Make requests in writing through the channel the controller names; statutory response periods then apply.
- If you get no answer, escalation paths exist — in Türkiye, a complaint to the Personal Data Protection Authority.
What platforms owe you
Your rights only work in practice when the system is built for them: versioned consent texts, separate consents for separate purposes, defined retention periods, real deletion and auditable records. Kariora Careers is built on these principles — consent is asked explicitly at apply time, and a deletion request removes your data including the CV file.
Curious how your data is used during evaluation? Our guide on how AI screens your CV explains the process from the candidate's side.