How to Redact a CV: A Practical Guide to Protecting Privacy and Reducing Bias

As a rule, CV redaction has one of two purposes. And it is better to separate them because they usually need slightly different approaches.

A large body of field research shows that identity cues on a CV measurably change how it's evaluated, independent of qualifications.

• One famous study, run by the reps of the National Bureau of Economic Research, tested this directly. Researchers sent out nearly 5,000 resumes that were 100% fake to real job postings. The point here is that they were changing nothing but the name at the top. Resumes with white-sounding names like "Emily" or "Greg" got about 50% more callbacks than the exact same resume with a Black-sounding name like "Lakisha" or "Jamal."
• In 2021, there was one more study. It was done by economists at UC Berkeley and the University of Chicago. Smart researchers found that resumes with Black-sounding names still got around 10% fewer callbacks than identical resumes with white-sounding names. The gap became much smaller over the years, but it definitely hasn't disappeared.
• Gender bias shows up too. Several studies on blind hiring found that the exact same resume is more likely to get a callback when it has a man's name on it instead of a woman's. And a PwC survey found that roughly one in five women say they've experienced gender discrimination during the hiring process.
• Performed by the Department for Work and Pensions, the UK government study tested this out directly. In 29% of cases, white applicants were those who were favored over ethnic-minority applicants. Plus, the study also showed that people with Indian-sounding names had to send out almost twice as many applications as individuals with white-sounding names simply to get the same number of callbacks.
• Time pressure compounds the problem: If we take a look at The Ladders research, we will see that the average recruiter spends only about six seconds on an initial CV scan. In other words, it is the process that is just long enough to register a name, a photo, an age, or a school, and not long enough to weigh actual qualifications.

Where identity cues are stripped out, the effect is real but uneven. A Swedish field study (Åslund & Skans, 2012\) on anonymized applications found the interview-invitation rate for female candidates rose from 16% to 38% (matching the male rate) once names and other identifiers were hidden. Other studies are more cautious: Harvard Business Review–cited research that found fully blind recruitment increased diversity by only about 4%, and one Yale-linked study even found a 7% *drop* in diversity in certain contexts, likely because reviewers filled the information gap with assumptions of their own. The honest summary from recent research is that blind CV screening works best as one part of a wider bias-mitigation process (pairing it with structured interviews and consistent scoring) rather than as a fix on its own.

Here's the tricky part: without meaning to, your CV ends up being one of the richest single pages of personal information you'll ever hand over – your full name, phone number, home address, email, date of birth, education history, and sometimes even a signature or ID scan.

• This isn't just a theoretical risk. In mid-2025, security researchers at Cybernews found a badly secured cloud storage folder connected to LiveCareer, a resume-building website. More than 5.1 million resumes and CVs had been left exposed, some going back to 2016\. Experts called it a "goldmine" for identity thieves and scammers.
• Experts in the field of identity theft routinely warn that a resume that has a Social Security number, the number of a driver's license, or date of birth should never be submitted. The point is that these fields have no legitimate hiring purpose and only add breach risk. Kroll Advisory Solutions' Brian Lapidus has put it plainly: this kind of data "should never appear on a resume."
• Cybersecurity firm Incogni's research describes a resume as, from an attacker's perspective, "everything an attacker needs" to run spear-phishing campaigns or build a fake identity — because it bundles full name, contact details, work history, and education in one place.

Not every CV needs the same level of redaction – the most common redaction targets fall into a few tiers:

• National ID / Social Security number
• Driver's license number
• Bank account or payment details
• Full date of birth (a birth month/year is sometimes acceptable if age verification is legally required)

• Decide the scope before you start. Match the redaction level to the purpose. A CV being anonymized for an internal blind-screening trial needs different treatment than one being cleaned up before a candidate posts it to a public job board. Decide up front what's in scope so you're not making inconsistent calls document by document.
• Don't just cover text with a black box. This is the most common redaction mistake – and a serious one. Just slapping a black box, highlight, or strikethrough over text in a Word doc or PDF doesn't actually remove it – the text is usually still sitting there underneath. Anyone can choose it and bring it back. 100% complete redaction means the text is genuinely deleted from the file. To cut a long story, it is not just covered up so it seems to be hidden. If you're working with a PDF, use a CV redaction software that permanently removes the underlying text and image data – not just a drawing tool that paints over it.
• Replace, don't just delete, where structure matters. Simply deleting a name can leave an awkward blank or break formatting. Best practice (as used by anonymized-recruiting platforms) is to replace identifying details with a neutral placeholder ("Candidate 014" instead of a name, "University A" instead of a named institution) so the document still reads naturally and reviewers aren't distracted by obvious gaps.
• Check metadata, not just visible text. Both Word and PDF files are full of hidden metadata. The latter comprises author name, company, file path, sometimes tracked-changes history, and so on, that can simply show exactly what you just redacted from the visible page to the whole world. Strip document properties and inspect for embedded revision history before sharing the file.
• Have someone outside the hiring decision do it (or automate it). Manual redaction done by a person who will later see the same candidate again defeats the purpose. Doing this by hand takes about 5 minutes per CV. That's fine if you're only dealing with a handful, but it adds up fast — redacting 100 CVs manually could eat up around 8 hours of someone's day. For that reason, loads of organizations choose to work with applicant tracking systems (like Taleo or Greenhouse) or dedicated anonymization software as an alternative. The best part is that it gets the job done in a more consistent manner. No need to count on one person's judgment every single time.
• Remember redaction is not a permanent fix – it is the first-pass tool. Blind screening only protects the initial review. Once a candidate reaches a phone screen or interview, identity becomes visible again, and bias can re-enter the process. Pair CV redaction with structured interview questions and consistent scoring criteria if the underlying goal is fairer hiring outcomes overall – anonymizing the CV alone won't get you there.

CV redaction sits at the intersection of two real, well-documented problems: hiring decisions that are measurably swayed by a name or a photo in six seconds of screen time, and resumes that double as an identity thief's shopping list. Done properly – genuine deletion rather than cosmetic masking, consistent scope, and metadata scrubbed clean – redaction meaningfully reduces both risks. Done carelessly, with a black highlighter and no attention to what's hiding underneath, it protects no one.