Sensitive data in ATS records: EEO, disability and salary history

Where does sensitive data live in an ATS?#

Sensitive data in an ATS lives in structured fields, custom fields, free-text notes, attachments and connected integrations. The EEO section is the obvious place, but recruiters and onboarding coordinators record sensitive details wherever the workflow puts them, including in fields that were never designed for it.

Bullhorn, Greenhouse, iCIMS, Workday Recruiting and other platforms differ in how they separate EEO data from the candidate profile, and many firms have added custom fields over the years without a privacy review. A field inventory, built with the ATS administrator, is the only reliable way to know what is actually stored.

• 1EEO and voluntary self-identification sections.
• 2Custom fields added by past administrators, including dropdowns for availability, restrictions and pay.
• 3Recruiter notes, call logs and interview feedback.
• 4Attached resumes, cover letters, references and onboarding packets.
• 5Screening integrations: background checks, drug testing, assessments and work authorization.
• 6Email and SMS threads synced to the candidate record.
• 7Offer records: compensation, pay expectations and prior pay.

Field inventory with handling rules#

The field inventory below sets a handling rule and a default for each common source of sensitive data. The defaults are deliberately conservative; a firm can loosen one only with a documented reason and counsel's agreement.

Why EEO and disability data are excluded by default#

EEO and disability data are excluded by default because they describe protected characteristics, and their legitimate role in a staffing workflow is compliance reporting kept apart from hiring decisions. Using them for anything else, including model training, raises the risk that a protected trait influences outcomes or becomes linkable to a person.

Accommodation records add a medical dimension. They often sit in notes rather than fields, written in recruiters' own words, which is why a scan of structured fields alone gives false comfort. Laws such as the ADA and Title VII, along with state equivalents, may apply to how these records are kept and used; counsel assesses which apply to your firm and clients.

Read this as general information rather than legal advice. Obligations shift with the state, the client contract and whether the firm or its client counts as the employer on a given placement.

Salary history: a field that may not belong at all#

Salary history is a field that may not belong in the ATS at all. Many states and cities restrict employers from asking about or relying on a candidate's prior pay, and some of those rules may reach staffing firms acting for clients. Firms that still carry a current salary field often inherited it from an older intake form.

For AI and licensing, prior pay is excluded. Pay expectations and offered rates are different: they are useful market signals in aggregate, but they are personal and commercially sensitive. If they are used at all, they are banded, separated from identities and reviewed with counsel, and small groups that could point to one person are suppressed.

Detecting sensitive details in free text#

Detecting sensitive details in free text takes automated scanning plus human review. Presidio, an MIT-licensed toolkit for finding and masking personal data, mixes entity recognition, pattern matching, rules and checksum tests to catch names, contact details and ID numbers. Its maintainers are explicit that a scan like this can miss sensitive items, which is why layered controls are needed.

Context is where tools struggle. A note saying a candidate needs Fridays off for treatment contains no classic identifier but discloses health information. Give reviewers a list of topics to look for, sample notes by recruiter and by year, and exclude whole note fields when the error rate in a sample stays high after redaction.

Synced email and SMS threads deserve the same treatment as notes. Candidates explain gaps, health issues, family situations and immigration questions in messages, and those threads are often attached to the record automatically. Unless they have been reviewed, leave them out of any dataset built for analytics or AI.

Screening results and identity documents#

Screening results and identity documents are the records most likely to arrive through integrations rather than recruiter entry. Background check reports, drug test outcomes and assessment scores flow in from vendors, and work authorization documents are often uploaded during onboarding, so they can sit in the ATS without anyone deciding they should.

These records carry their own rules. Background checks are consumer reports, and the FCRA and state laws that may apply limit how they are used and shared. Identity and I-9 materials are usually expected to be stored apart from hiring files. Map each integration, confirm where its outputs land, and exclude them from every export used for analytics or AI by default.

Illustrative: a light industrial staffing firm sets exclusion defaults#

Illustrative: a fictional light industrial staffing firm wants to analyze its order-to-placement history and later consider licensing de-identified workflow records. Its ATS holds onboarding packets with I-9 materials, drug test results from a screening integration, EEO self-identification and a legacy last-pay-rate custom field.

The privacy lead writes field-level rules. EEO data, screening results, identity documents, accommodation notes and prior pay are excluded at export; candidate IDs are replaced with stable pseudonyms; recruiter notes go through scanning and reviewer sampling. The legacy pay field is removed from the intake form. What remains, job orders, shift requirements, submittals, starts and assignment ends, is what the analysis uses.

How SourceX handles sensitive ATS fields#

SourceX starts from exclusion for sensitive ATS fields. During Preparation in the SourceX five-step transaction, EEO data, accommodation details, screening results, identity documents and prior pay are removed, and free-text fields are reviewed before anything is considered for licensing.

The privacy record in the SourceX Evidence Packet lists the fields excluded and the methods used, and the supplier approves the prepared result before Delivery. The first assessment looks only at metadata about the ATS, so no candidate record changes hands at that stage.