# ChatGPT for recruiters: what a UK agency can paste in, five prompts that need no candidate data, and a one-page AI policy

> Which ChatGPT plan trains on what you paste, what a UK recruiter can put in under data protection law, five prompts with no candidate data, and a policy.

- Page to cite: https://aeolookup.com/recruitment/chatgpt-for-recruiters-uk-gdpr-prompts-ai-policy/
- Publisher: AEO Lookup (https://aeolookup.com/)
- Section: Recruitment agencies, Screening, shortlists and scheduling
- Published 1 October 2026
- Key fact: OpenAI's policy page, updated 13 March 2026, says conversations on its plans for individuals may be used to train its models unless the user opts out, and its business privacy page offers a data processing addendum only for ChatGPT Business, ChatGPT Enterprise and the API; so a CV pasted into a consultant's personal £20-a-month Plus account has left the agency with no data processing agreement covering it.
- Sources: OpenAI, "How your data is used to improve model performance" (updated 13 March 2026), the OpenAI help article of the same name, "Enterprise privacy at OpenAI" (updated 8 January 2026) and the ChatGPT pricing page, all read in a browser on 2026-10-01; ICO, "Thinking of using AI to assist recruitment? Our key data protection considerations" (6 November 2024), read 2026-10-01. Not legal advice.

The rule that settles most of it: nothing that identifies a candidate goes into a personal ChatGPT account. OpenAI's own policy page, updated 13 March 2026, says ChatGPT "improves by further training on the conversations people have with it, unless you opt out". The plans a consultant buys on a personal card are the ones that sentence describes.

That leaves a lot a recruiter can do safely. This guide sorts the uses into three piles, gives five prompts that need no candidate data, and ends with a policy short enough to print.

## Which account you are typing into

| | Plans for individuals (Free, Go, Plus, Pro) | Business plans (Business, Enterprise) and the API |
|---|---|---|
| Used to train OpenAI's models | Yes by default, unless you opt out | Not by default |
| How to stop it | Turn off "Improve the model for everyone" under Settings, Data controls, or use Temporary Chat | Nothing to switch off |
| Data processing addendum | Not listed as available | Available on request through OpenAI's form |
| Price on 1 October 2026 | Plus was shown as £20 a month | Not read: the Business price sits behind a tab our browser check could not open |

Every row comes from OpenAI's pages as rendered in a browser on 1 October 2026. Two cautions. Opting out stops training on new conversations; it does not give the agency a data processing agreement. And OpenAI notes that if a user gives thumbs-up or thumbs-down feedback, the whole conversation attached to it may be used for training even after opting out.

## Why the account matters to the ICO

An agency is the controller of its candidates' data. On 6 November 2024 the ICO published six questions for any recruiter using an AI tool. In short:

1. Have you completed a data protection impact assessment?
2. What is your lawful basis for processing?
3. Have you documented responsibilities and set clear processing instructions for the provider?
4. Have you checked the provider has mitigated bias?
5. Is the tool being used transparently, so candidates know?
6. How will you limit unnecessary processing?

A consultant pasting a CV into a personal account fails question 3 at once, because there is no data processing agreement with the provider and no instructions. It fails question 5 unless the privacy notice already tells candidates their CV may be sent to an AI provider. The [guide to AI CV screening and the ICO](https://aeolookup.com/recruitment/ai-cv-screening-ico-rules-recruitment-agencies/) takes the six questions one at a time.

## Three piles

| Pile | What goes in it | Condition |
|---|---|---|
| Fine on any account | Job adverts from a client brief, search strings, interview question banks, business development emails to a company, plain-English summaries of public rules | No person can be identified from what you paste |
| Business account only | Tidying a CV into the house format, summarising a CV against a brief, drafting candidate feedback from the consultant's own notes | Addendum signed, privacy notice says so, identifiers removed first |
| Never handed over as a decision | Ranking applicants, rejecting them, deciding who is put forward | A model may prepare notes; the consultant reads them, decides, and can say why |

## Five prompts that need no candidate data

Copy these and fill in the brackets. None of them needs a name, a CV or a client's confidential figures.

1. **Job advert.** "Write a job advert of no more than 250 words for a [job title] in [town]. Salary [range]. Hours [hours]. The three duties that take most of the week are [duties]. The two requirements that are essential are [requirements]. Plain UK English, no superlatives, no requirement that is not on this list. End with how to apply: [method]."
2. **Search string.** "Write a Boolean search string for a CV database to find a [job title]. Must have [skills], useful to have [skills], exclude [terms]. Give three versions: narrow, medium and wide, and say what each one drops."
3. **Interview questions.** "Write eight interview questions for a [job title] whose main duties are [duties]. Four about past work, four about how they would handle [situations]. For each, say what a strong answer would contain. No questions about age, health, family or nationality."
4. **Business development email.** "Write an email of no more than 120 words to the [role] of a [sector] firm with about [number] staff in [area]. We are a recruitment agency that fills [roles]. Mention that we placed [number] [roles] locally last year. One clear request: a 15-minute call. No claims you cannot support from this prompt."
5. **Rule explainer.** "Explain in 150 words, for a temp who has asked, what [rule] means for them. Use only the text I paste below and say so if it does not answer the question. [Paste the official guidance.]"

Check every output before it leaves the building. The model will invent a salary benchmark or a legal rule if the prompt leaves room for one. For the emails that follow a booked interview, the [interview confirmation template](https://aeolookup.com/recruitment/interview-confirmation-email-template-recruiter/) fills in the facts without a model.

## Stripping a CV before it goes in

For the second pile, on a business account only:

1. Delete the name, photograph, date of birth, address, phone number, email and any link to a social profile.
2. Delete nationality, marital status and anything about health.
3. Replace employer names with a description, such as "a regional housebuilder", if the candidate could be identified from them.
4. Paste what is left, with the brief.
5. Put the identifiers back by hand in your own system.

## A one-page AI policy

- The agency's AI tools are: [list]. Personal accounts are not on the list.
- No candidate's name, contact details or CV goes into a tool that is not on the list.
- Before a tool is added, the director completes a data protection impact assessment and signs the provider's data processing addendum.
- The privacy notice names each tool that touches candidate data.
- A tool may draft and summarise. A consultant decides who is shortlisted, rejected and put forward, and records the reason.
- Outputs are checked by the person who sends them.
- This policy is reviewed every six months and when a tool changes.

An agency can count what the drafting would save with the [admin scorecard](https://aeolookup.com/recruitment/admin-scorecard-recruitment-agency-hours-ai/). Overlyft ![](https://aeolookup.com/img/d/ours-badge.png) can set up an AI assistant built to these rules: it prepares notes against the brief, and who is put forward stays the consultant's decision. This page is general information, not legal advice.

---
![](https://aeolookup.com/img/d/owner-line.png)

General information for UK small firms, not legal, tax or financial advice.