GDPR Clause on a CV: Do You Need One? (Wording for 2026)
In most of Europe nobody puts a data-protection clause on a CV, and a recruiter in London or Berlin would find one odd. In Poland and Italy, though, a line of consent at the bottom of the page is so common that many candidates think a CV is incomplete without it. The rules changed in 2018 with the GDPR (and again in Poland in 2019), but many templates still carry formulas citing laws that no longer apply. This guide explains where the clause is expected, what it actually does, and the wording to use today.
What a GDPR clause on a CV is
It's a short sentence, usually in small print at the foot of the CV, in which you agree that the employer may process the personal data in your application for recruitment. Under the GDPR an employer needs a legal basis to process your data. For the basic information in a CV, that basis normally comes from the law or from the steps taken before signing a contract, so your consent isn't strictly required. Consent matters for anything beyond that:
- Data the employer isn't entitled to ask for, such as a photo, hobbies or other personal details you chose to include
- Keeping your CV for future recruitment processes, not just the one you applied for
- Employers who still ask for the clause in the job ad, in which case you should include it
So the clause isn't a magic formula that makes an application valid. It's a simple way of giving consent where consent is actually needed.
Do you need a GDPR clause? Country by country
Whether you should add one depends almost entirely on where the job is:
| Country | Is it used? | What to do |
|---|---|---|
| Poland | Very common | Add the current RODO clause, especially if your CV has a photo or you want to be considered for future roles |
| Italy | Common | Optional since 2018; many candidates still add a one-line authorisation |
| UK, Ireland | Not used | Leave it out |
| Germany, Austria, Switzerland | Not used | Leave it out |
| France, Spain, Portugal, Netherlands, Belgium | Not used | Leave it out |
| Romania | Rare | Leave it out of the CV; some public-sector employers ask you to sign a separate consent form |
Poland: the current RODO clause
Since 4 May 2019, article 22¹ of the Polish Labour Code lists the data an employer may ask a candidate for: name, date of birth, contact details, education, professional qualifications and employment history. Processing that data doesn't need your consent. For anything else you include, such as a photo, and for future recruitment, consent is the cleanest basis. A short, current version reads:
- Wyrażam zgodę na przetwarzanie moich danych osobowych przez [nazwa firmy] w celu prowadzenia rekrutacji na aplikowane przeze mnie stanowisko.
- Many employers and templates use a longer version that names the regulation: Wyrażam zgodę na przetwarzanie moich danych osobowych dla potrzeb niezbędnych do realizacji procesu rekrutacji zgodnie z Rozporządzeniem Parlamentu Europejskiego i Rady (UE) 2016/679 z dnia 27 kwietnia 2016 r. (RODO).
- Replace [nazwa firmy] with the employer's name. If the ad gives its own clause, copy that one instead.
Either version is fine. What matters is that it refers to the GDPR (RODO in Polish), not to the old 1997 Polish data protection act.
Italy: the privacy authorisation
Italian law has said since 2018 (article 111-bis of the Privacy Code, added by Legislative Decree 101/2018) that consent isn't required for the data in a CV you send to apply for a job. The employer must give you its privacy notice at the first contact instead. Even so, a closing authorisation is still widely used, and some job ads ask for it. A current version reads:
- Autorizzo il trattamento dei miei dati personali presenti nel curriculum vitae ai sensi del Regolamento UE 2016/679 (GDPR) e del D.Lgs. 196/2003, come modificato dal D.Lgs. 101/2018.
- Avoid the old formula that cites only Legislative Decree 196/2003. It predates the GDPR.
If the ad doesn't mention it, adding the line does no harm. If it does, use the employer's wording.
The clause for future recruitment
Consent for one recruitment ends with that recruitment. If you'd like the employer to keep your CV and contact you about other roles, add a second sentence. In Polish:
- Wyrażam również zgodę na przetwarzanie moich danych osobowych przez [nazwa firmy] w celu przyszłych procesów rekrutacyjnych.
- In Italian you can extend the authorisation with: anche per future selezioni di personale.
Add it only if you mean it. You can withdraw consent at any time by writing to the employer.
The clause in English, for international employers
Companies in Poland that recruit in English often expect the clause in English too. A widely used version:
- I hereby consent to the processing of my personal data by [company name] for the purposes of the recruitment process, in accordance with Regulation (EU) 2016/679 (GDPR).
- For future recruitment, add: I also consent to the processing of my personal data for the purposes of future recruitment processes.
Use the English clause only for jobs in Poland or Italy. On a CV for the UK, Ireland or the US, leave it out entirely.
How to write your CV in English for employers abroadWhere to put it and how it should look
The clause is a formality, so it should be visible but quiet:
- At the very bottom of the last page, below everything else
- In the same font as the rest of the CV, one or two sizes smaller, in plain text rather than a scanned image
- Without a signature: a PDF sent by email doesn't need one
- Inside the CV file itself, not only in the email, so it travels with the document
If the clause pushes your CV onto a second page, tighten the content above it rather than shrinking the clause until it's unreadable.
Why to send your CV as a PDFMistakes to avoid
Most problems with the clause come from copying an old template:
- Citing the Polish act of 29 August 1997 on personal data protection, which was replaced by the GDPR in 2018
- Citing only the Italian Legislative Decree 196/2003, without the GDPR
- Leaving another company's name in the clause from your previous application
- Adding the clause to CVs for countries where it isn't used, where it looks like a template you didn't adapt
- Giving consent for future recruitment when you don't want to be contacted again
A quick check before sending: the right law, the right company name, and only in a country where it belongs.
Other common CV mistakes and how to avoid themFrequently asked questions
Is a GDPR clause on a CV mandatory?
No. In Poland the employer can process your basic data without consent, and in Italy consent for CV data isn't required. The clause is still useful in Poland when your CV includes extra data such as a photo, when the ad asks for it, or when you want to be considered for future roles.
What is the current wording of the RODO clause for a CV in Poland?
A short current version is: Wyrażam zgodę na przetwarzanie moich danych osobowych przez [nazwa firmy] w celu prowadzenia rekrutacji na aplikowane przeze mnie stanowisko. Replace the brackets with the employer's name, and use the employer's own clause if the ad provides one.
Should I put a GDPR clause on a CV for the UK or Germany?
No. Data-protection clauses aren't part of CV conventions in the UK, Ireland, Germany or most other European countries, and recruiters there may read one as a template you forgot to adapt.
Where does the GDPR clause go on a CV?
At the very bottom of the last page, in plain text, in the same font as the rest of the CV and slightly smaller. It doesn't need a signature.
Can I withdraw my consent after sending my CV?
Yes. Under the GDPR you can withdraw consent at any time, for example by emailing the employer. Withdrawal doesn't affect processing that happened before it.