Recruiting runs on documents that arrive in every possible format, get read by both software and people, and contain personal data with real legal weight attached. A recruiter handles more CVs in a month than most people read documents in a year, and the difference between a workflow that copes and one that does not is mostly a handful of decisions about formats, parsing and retention. This covers the document side of the job.
The CV format problem, from both directions
As a recipient, you get PDFs, Word files, Pages exports, Google Docs links, scanned photographs of printed CVs, and the occasional plain text. PDF is the majority and the most awkward to extract from reliably, for the same reason it is the most consistent to read: it records positions, not structure.
As an advisor to candidates, the answer people want is a simple one, and the honest answer is conditional. A PDF preserves the layout exactly and looks the same everywhere. A .docx is easier for an applicant tracking system to parse and easier for an agency recruiter to edit before forwarding. Where the posting specifies a format, follow it; where it does not, PDF is the safer default in 2026 because modern parsers handle text-based PDFs well. The full argument is in PDF vs DOCX for resumes.
What genuinely matters more than the format:
- The PDF must contain real text, not an image. A CV exported to PDF from Word is fine; a CV that is a scan or a photograph is invisible to every parser.
- Single column beats two columns for parsing, because column detection is where extraction most often fails.
- Tables, text boxes and headers/footers confuse parsers. A name in a header is frequently not extracted at all.
- Standard section headings — Experience, Education, Skills — help enormously, because parsers look for them.
- Fancy design templates parse worst and are the format candidates are most often sold.
Parsing CVs at volume
If you are running an ATS or building any automated screening, extraction quality determines everything downstream.
Text-based CVs extract with the standard toolchain — pdftotext -layout, or a library like pdfplumber or PyMuPDF. The -layout flag preserves horizontal positioning, which helps considerably with two-column CVs. See how to convert PDF to text.
Scanned or image CVs need OCR first. Detect them by checking whether extraction returns fewer than, say, 100 characters for a document with pages, and route those to an OCR step — PDF OCR explained.
Structured extraction — pulling out name, contact details, employers, dates, skills — is where classical parsing struggles and language models do genuinely well, because a CV is semi-structured in a way that resists rules and suits models. See AI data extraction from PDFs and multimodal LLMs and PDF documents.
Two cautions. Sending candidate CVs to a third-party AI service is a transfer of personal data and needs to be covered by your privacy notice and your data processing agreements — not an afterthought. And automated screening of candidates attracts specific legal scrutiny in several jurisdictions, including EU AI Act obligations for employment-related systems and New York City's bias-audit requirements for automated employment decision tools. Whatever you build, the extraction is the easy part.
Redacting for blind screening
Anonymised screening — removing name, gender markers, photograph, age indicators, university, and address before a hiring manager sees the CV — is a well-evidenced way to reduce bias, and it is a document-processing task.
The critical point: it must be real redaction. Drawing a black box over a name leaves the name in the file, extractable with a copy-paste, and the person you were protecting from bias is one keyboard shortcut away. The failure modes are set out in PDF redaction failures and how to avoid them; the correct procedure is in how to redact text in a PDF.
Also strip metadata. A CV's document properties routinely contain the candidate's name in the Author field even after the visible name is removed — see how to strip metadata from a PDF and how to anonymise PDF documents.
At volume, this is a scripted step, not a manual one. At low volume, ask candidates for an anonymised version alongside the full one; several organisations do this and it costs nothing.
The candidate pack
Recruiters routinely assemble a submission pack: CV, cover letter, right-to-work documents, references, assessment results, interview notes. Practical handling:
- Merge into one file per candidate for the hiring manager, with bookmarks per section so they can navigate. How to combine PDF files and how to add bookmarks to a PDF.
- Keep the originals separately. The merged pack is a convenience copy; the individual documents are the record.
- Number the pages across the pack if it will be discussed in a panel — the principle behind Bates numbering applies to any bundle people argue about.
- Never merge interview notes into the pack sent to the candidate. This is a recurring and avoidable incident.
Offers and contracts
The signing end of the process:
- Send offers as PDFs, not editable documents. An offer letter that arrives as a .docx invites a negotiation you did not intend to have in track changes.
- Use a proper e-signature service rather than asking for a printed, signed, scanned copy. It is faster, produces a better audit trail, and the candidate can complete it on a phone. Background: digital signatures vs electronic signatures and is it legal to sign documents electronically.
- Keep the executed copy as the record, with its audit certificate. See PDF for business contracts.
- Watch cross-border requirements. Employment contracts in some jurisdictions have form requirements that electronic signature does not satisfy — Germany's written-form requirement for post-contractual non-compete clauses is the classic example. E-signature laws around the world.
Data protection, which is the real risk
A recruitment database is a large collection of personal data belonging to people who mostly do not work for you, including sensitive categories — right-to-work documents contain nationality and identity data, and unsolicited CVs frequently contain health information, photographs and dates of birth nobody asked for.
The obligations that bite in practice:
Retention. You cannot keep CVs indefinitely because they might be useful someday. Set a period — typically 6 to 24 months for unsuccessful candidates, longer where you have a legal reason such as defending a discrimination claim — tell candidates what it is, and actually delete at the end of it. "Actually delete" includes the copies in email, in the shared drive, and in the merged packs sent to hiring managers. See document retention policies.
Access requests. A candidate can ask for everything you hold about them, including interview notes. Write notes on that assumption. This alone is a good reason to keep assessment notes factual and job-related.
Right-to-work and identity documents. Retain only what the law requires, for only as long as it requires, and store it more securely than the CV. Copies of passports sitting in an inbox are the single most common recruitment data incident.
Sharing with clients or hiring managers. Every forward is a copy you no longer control. Prefer an access-controlled link over an attachment, with expiry — sending documents securely by email and how to share a PDF securely.
The general framework: GDPR and PDF documents.
Practical setup
A workable arrangement for a small team:
- One intake channel. Applications into the ATS or one mailbox, not into individual inboxes, so retention and access are manageable.
- A consistent naming convention at intake:
2026-08-05_Surname_Firstname_RoleRef.pdf. See naming and versioning shared files. - Automatic OCR on anything that arrives without a text layer, so everything is searchable.
- A redaction step for blind screening, scripted if volume justifies it.
- A deletion job that runs on schedule against the retention rule, and a record that it ran.
- Right-to-work documents in a separate, access-restricted location with a shorter retention clock.
None of this is exotic. It is the difference between a document set you can defend and a shared drive nobody wants to audit.
Summary
Ask for text-based, single-column CVs and route image ones through OCR; extract structure with a model rather than rules, while treating that as a data transfer with legal consequences. Redact properly for blind screening — a black box is not redaction, and the metadata still names the candidate. Send offers as PDFs through a real e-signature service. And put as much effort into the deletion schedule as the intake process, because retention is where recruitment document handling actually goes wrong.
