Privacy and preparation
Candidate data in ATS exports: what staffing firms must remove
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Staffing firms preparing ATS exports should remove candidate identity and contact details, equal employment opportunity answers, background and drug screening results, pay history, and anything about health or immigration status. What usually stays is the work itself: job requirements, skills, submission stages and placement outcomes, generalized so no record points back to one candidate or client contact.
Key takeaways
- Remove identity, contact, EEO self-identification and screening results from every ATS export.
- Keep role, skills, stage and outcome data in generalized form; that matching workflow is what recruiting AI teams look for.
- Recruiter notes and attached resumes hide the most personal details and need human review.
- Client contacts and hiring manager feedback are personal data too, and client agreements may restrict them.
- Counsel decides, deal by deal, which privacy laws reach your candidate records and what they require.
Why ATS exports need a field-by-field review#
An ATS export needs a field-by-field review because one candidate record mixes the firm's most useful workflow data with its most sensitive personal data. The same Bullhorn or similar ATS record that shows a job order, a submission and a placement outcome can also hold a home address, a pay rate, voluntary self-identification answers and a recruiter's private notes.
Candidates also did not choose to be part of a dataset; they applied for work. Since January 1, 2023, when the CCPA's employment exemption lapsed, California's privacy law has reached applicant data held by covered businesses, and in April 2026 the state's privacy agency opened preliminary rulemaking on how the law applies to employees, job applicants and independent contractors. Other state laws, such as Colorado's, generally exclude job applicants from their consumer definitions.
For a staffing firm the lines blur further: a candidate placed on assignment often becomes the firm's own employee, so one person can appear in applicant, employee and payroll records. The firm's candidate privacy notice shapes what people were told, and counsel should assess which rules may apply before anything is scoped.
The ATS field table, and the order to apply it#
The table groups typical ATS fields by what they reveal. Field names differ between systems, so map your own schema to these groups before building the export query.
The order of operations matters as much as the field list. Apply the suppression list for deletion requests and opt-outs first, so those candidates never enter the working copy. Then drop excluded fields in the export query itself rather than exporting everything and deleting columns afterward, which leaves full copies in downloads folders and shared drives. Bulk exports are often an admin-only function; Bullhorn's knowledge base, for example, says only admins can export candidate records from Bullhorn Automation, so name the administrator who will run the query.
Generalize next, then run automated detection on notes and activities, then draw the human review sample. Keep the query, the field mapping and the review findings together, because they are the record you will need when counsel or a buyer asks how the dataset was prepared.
| Field group | Examples | Treatment |
|---|---|---|
| Identity | Name, photo, date of birth, government ID numbers, social profile links | Remove |
| Contact | Email, phone, home address, emergency contacts | Remove; keep metro area or region only |
| EEO self-identification | Race, ethnicity, sex, veteran status and disability answers | Remove entirely |
| Screening | Background checks, drug tests, reference checks, work authorization documents | Remove entirely |
| Pay | Current and desired pay, pay history, bill and pay rates | Remove, or band only with counsel and client sign-off |
| Work history | Employers, titles, dates | Generalize to industry, role level and tenure band |
| Skills and credentials | Skills, licenses, certifications | Keep; generalize rare credentials |
| Job orders | Title, requirements, location, shift | Keep; generalize client name and site |
| Pipeline stages | Submitted, interviewed, offered, placed, rejected, with dates | Keep; shift or band dates |
| Placement outcomes | Start, extension, early end, conversion to hire | Keep, detached from identity |
| Notes and activities | Recruiter notes, call logs, emails, texts | Review by hand; remove personal details |
| Attachments | Resumes, cover letters, assessments | Exclude by default, or de-identify as a separate project |
Why recruiter notes are the hardest part#
Recruiter notes are the hardest part of an ATS export because they record what candidates said in conversation, and candidates say personal things. A note about skills and availability can sit next to a remark about a pregnancy, a visa timeline or a reason for leaving a job.
Automated detection catches names, emails and phone numbers. It does not catch a sentence explaining that a candidate needs a schedule that works around medical treatment. A human sample review is required, and a firm may decide to exclude notes from certain desks or periods entirely. Flag notes that touch these topics:
- Health, pregnancy, family plans and caregiving.
- Disability and accommodation requests.
- Immigration, visas and work authorization.
- Criminal history and screening outcomes.
- Age, or comments that imply it.
- Religion, union activity and political views.
- Salary history and reasons for leaving tied to disputes or complaints.
Client contacts and job orders carry their own obligations#
Client contacts and job orders carry obligations to the firm's clients. Hiring manager names, emails and feedback are personal data, and client agreements often treat job details, bill rates and the client's identity as confidential. Generalize the client to industry and size band, remove contacts, and check master service agreements for confidentiality and data-use clauses.
Hiring manager feedback is valuable because it explains why a submission failed, but it can be blunt and can touch protected characteristics. Treat it with the same review as recruiter notes.
Niche desks and rare skills: re-identification without a name#
Niche desks create re-identification risk even after every name is gone. A placement record for a rare certification in a small metro, an executive search for one named role, or a contractor placed at a client with a handful of staff can point to one person through the combination of skill, place, time and client industry.
Generalize harder where pools are small. Widen location to region, band dates to quarter, group rare credentials into a family, and suppress records from desks whose volume is too low to hide anyone. Executive search records are often better left out of a first scope altogether, since the roles themselves are frequently public.
What stays valuable after removal#
What remains after removal is the matching workflow: what a client asked for, whose skills were submitted, how far each candidate got and what happened after placement. That is the part AI teams building recruiting and workforce tools tend to care about, and it survives de-identification well.
| Retained record | What it shows |
|---|---|
| Job requirements linked to submissions | How skills were matched to a request |
| Stage progression | Where candidates drop out of a process |
| Generalized rejection reasons | Common mismatch patterns |
| Placement outcomes | Which matches lasted and which ended early |
| Time-to-fill bands | How process timing varies by role and region |
Illustrative: a light industrial and IT staffing firm#
Illustrative: a fictional staffing firm with light industrial and IT desks runs a cloud ATS and a separate onboarding and payroll system. Its CEO wanted to know whether submission and placement history could be licensed.
The team scoped only the ATS. They removed identity, contact, EEO and screening fields, dropped pay, generalized employers and clients to industry, and kept job requirements, skills, stages and placement outcomes. Resumes and onboarding records stayed out. Notes from the light industrial desk were excluded after a review sample found frequent health and scheduling details, while IT desk notes stayed in after hand review. Before the firm approved the scope, the CEO had counsel compare the candidate privacy notice with the planned use and confirm that client agreements allowed generalized job order data.
Agreeing the field table with SourceX#
With SourceX, the ATS field table is agreed before any export is built. The fit check needs only descriptive answers, such as which ATS you run, which desks and years are in question, and whether notes and attachments exist.
Rights then reviews candidate notices and client agreements, and Preparation applies the agreed field treatment and a hand-reviewed notes sample. The privacy record in the SourceX Evidence Packet lists every field group as removed, generalized or kept, and the firm approves it before Delivery in the SourceX five-step transaction.
Frequently asked questions
Can we include resumes if names and contact details are removed?
Removing names is not enough. Resumes combine employers, dates, schools and locations that can identify a person together. Firms often leave resumes out of a first scope and treat any later resume set as its own de-identification project with a stricter review.
Do candidates who were never placed need different treatment?
Their records are personal data like anyone else's, and the same removal rules apply. Firms should also run a suppression list before export, so candidates who asked to be deleted or opted out of further contact are left out entirely.
Are background check results ever usable?
Treat them as excluded. The Fair Credit Reporting Act generally limits how consumer reports obtained for employment purposes may be used, and screening results are among the most sensitive records a firm holds. Even aggregated pass and fail figures can reveal more than intended.
What about candidates outside the US?
Candidates in other countries may fall under other laws, such as GDPR for people in the EU. The simplest approach is often to filter the export to US candidates and US job orders, and let counsel decide whether anything else belongs in scope.
Do timesheets and VMS records belong in the same scope?
Usually not. Timesheets, payroll and client vendor management system records sit outside the ATS and carry pay, hours, cost centers and client billing terms. Treat them as a separate scope with their own rights and privacy review, and leave them out of a first ATS package.
Does licensing ATS data affect our candidate privacy notice?
It may. A notice written for recruiting purposes might not describe licensing de-identified records. Counsel should compare the notice with the planned use and decide whether an update is needed, and when.
Sources
- The California legislature ended its 2022 session without extending the CCPA employee and business-to-business exemptions, so they expired on January 1, 2023. Source
- The California Privacy Protection Agency initiated preliminary rulemaking on April 20, 2026 focused on how the CCPA applies to personal information of employees, job applicants and independent contractors. Source
- The Colorado Attorney General states that the Colorado Privacy Act does not cover personal data of individuals acting in a commercial or employment context, such as a job applicant. Source
- Bullhorn's knowledge base says Bullhorn Automation users can export candidate, sales contact or company records to CSV from a saved list or custom search, and only admins can run the export. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.