A job platform wants too much personal information: decide what to share

Confirm whether the request comes from a recruitment service

The Ministry of Human Resources and Social Security's explanation of the online recruitment regulation treats the protection of applicant information as a service obligation of recruitment platforms. This gives you a basis to ask who receives your data and why. However, this explanation does not resolve every privacy dispute, nor does it prove that all screening information is unnecessary. If the request comes from a platform, the service obligation applies; if it comes directly from an employer, different rules may apply.

List each data field and its purpose

For each field requested, note whether it relates to skills, contact details, identity, finances, or family. Ask which fields are mandatory, the reason for each, who can view them, and whether a less detailed response is possible. For a publicly searchable CV, you can use a professional contact method without exposing your home address or bank account. This list helps you decide what to share now and what can wait until later.

Verify the recipient before uploading

Before uploading any document, independently check the platform's domain name and the intended recipient, especially if a chat conversation moves to an unfamiliar form. Ask whether the request comes from the platform itself or from a specific employer. Keep a record of the requested fields and the explanation given. When taking screenshots, avoid capturing other applicants' information. This verification step reduces the risk of sending data to an unauthorized party.

If information was shared too widely

If you believe your information was shared too widely, record what you supplied, when, through which channel, and any evidence of later use. Ask the verified service about its correction, removal, or complaint process, and retain the response. If your access credentials were exposed, change them promptly. Do not send additional identity documents to an unverified person who offers to remove your data for a fee. Verify any claimed removal service independently before sharing more information.

Separate application, identity check, and payroll

Separate the purpose of an initial application from any later identity or payroll process. Ask why a particular field is needed now, who receives it and whether a less detailed version is sufficient. Do not turn a practical preference about timing into a universal legal rule that identity checks are allowed only after an offer. Sensitive information should go through a verified channel appropriate to its actual purpose.

Example: a new form asks for unrelated details

Hypothetical illustration: after submitting a public CV, an applicant receives a new link asking for full identity and bank details. The message does not explain the stage or recipient. Contact the company through an independently verified channel: “Is this your form, what is each field used for, and can I supply the necessary information through your verified process?” Retain the form request without exposing the data publicly. The question tests authenticity and necessity before another upload.

Next steps if the issue remains unresolved

If the platform or employer does not provide satisfactory answers, you can file a complaint with the relevant authorities, such as the local human resources and social security bureau, or seek legal advice. Bring your records of the data requested, the explanations given, and any evidence of misuse. If you need a specialist, describe the specific records and questions you have. Do not assume that a complaint will succeed, but documenting the issue is essential.

Need to take the next step?

More from this country