ChatGPT for recruiters: what a UK agency can paste in, five prompts that need no candidate data, and a one-page AI policy

The rule that settles most of it: nothing that identifies a candidate goes into a personal ChatGPT account. OpenAI's own policy page, updated 13 March 2026, says ChatGPT "improves by further training on the conversations people have with it, unless you opt out". The plans a consultant buys on a personal card are the ones that sentence describes.

That leaves a lot a recruiter can do safely. This guide sorts the uses into three piles, gives five prompts that need no candidate data, and ends with a policy short enough to print.

Which account you are typing into

Every row comes from OpenAI's pages as rendered in a browser on 1 October 2026. Two cautions. Opting out stops training on new conversations; it does not give the agency a data processing agreement. And OpenAI notes that if a user gives thumbs-up or thumbs-down feedback, the whole conversation attached to it may be used for training even after opting out.

Why the account matters to the ICO

An agency is the controller of its candidates' data. On 6 November 2024 the ICO published six questions for any recruiter using an AI tool. In short:

1. Have you completed a data protection impact assessment?
2. What is your lawful basis for processing?
3. Have you documented responsibilities and set clear processing instructions for the provider?
4. Have you checked the provider has mitigated bias?
5. Is the tool being used transparently, so candidates know?
6. How will you limit unnecessary processing?

A consultant pasting a CV into a personal account fails question 3 at once, because there is no data processing agreement with the provider and no instructions. It fails question 5 unless the privacy notice already tells candidates their CV may be sent to an AI provider. The guide to AI CV screening and the ICO takes the six questions one at a time.

Three piles

Five prompts that need no candidate data

Copy these and fill in the brackets. None of them needs a name, a CV or a client's confidential figures.

1. Job advert. "Write a job advert of no more than 250 words for a [job title] in [town]. Salary [range]. Hours [hours]. The three duties that take most of the week are [duties]. The two requirements that are essential are [requirements]. Plain UK English, no superlatives, no requirement that is not on this list. End with how to apply: [method]."
2. Search string. "Write a Boolean search string for a CV database to find a [job title]. Must have [skills], useful to have [skills], exclude [terms]. Give three versions: narrow, medium and wide, and say what each one drops."
3. Interview questions. "Write eight interview questions for a [job title] whose main duties are [duties]. Four about past work, four about how they would handle [situations]. For each, say what a strong answer would contain. No questions about age, health, family or nationality."
4. Business development email. "Write an email of no more than 120 words to the [role] of a [sector] firm with about [number] staff in [area]. We are a recruitment agency that fills [roles]. Mention that we placed [number] [roles] locally last year. One clear request: a 15-minute call. No claims you cannot support from this prompt."
5. Rule explainer. "Explain in 150 words, for a temp who has asked, what [rule] means for them. Use only the text I paste below and say so if it does not answer the question. [Paste the official guidance.]"

Check every output before it leaves the building. The model will invent a salary benchmark or a legal rule if the prompt leaves room for one. For the emails that follow a booked interview, the interview confirmation template fills in the facts without a model.

Stripping a CV before it goes in

For the second pile, on a business account only:

1. Delete the name, photograph, date of birth, address, phone number, email and any link to a social profile.
2. Delete nationality, marital status and anything about health.
3. Replace employer names with a description, such as "a regional housebuilder", if the candidate could be identified from them.
4. Paste what is left, with the brief.
5. Put the identifiers back by hand in your own system.

A one-page AI policy

• The agency's AI tools are: [list]. Personal accounts are not on the list.
• No candidate's name, contact details or CV goes into a tool that is not on the list.
• Before a tool is added, the director completes a data protection impact assessment and signs the provider's data processing addendum.
• The privacy notice names each tool that touches candidate data.
• A tool may draft and summarise. A consultant decides who is shortlisted, rejected and put forward, and records the reason.
• Outputs are checked by the person who sends them.
• This policy is reviewed every six months and when a tool changes.

An agency can count what the drafting would save with the admin scorecard. Overlyft can set up an AI assistant built to these rules: it prepares notes against the brief, and who is put forward stays the consultant's decision. This page is general information, not legal advice.