What personal details should a CV include in 2026?

What happened in the Danish data breach, and why should job seekers care?

On 2 October 2026, Denmark's CPR administration spotted irregular activity in the country's central population register and established that names, addresses and national ID numbers belonging to roughly 8.8 million registered people had been pulled during September. The attackers never broke into the register directly — they abused a private Danish company's lawful access to search it, the kind of access firms can obtain for identity verification. Denmark's digitalisation minister called it a deeply serious incident and ordered a full security review of the system. The data protection authority was notified, police are investigating, and people registered with name and address protection were spared.

Here's the bridge to your job search. Full name, home address and a national ID number are precisely the fields many candidates still type at the top of a CV — and that CV doesn't sit in one place. A single applicant can upload the same file to forty employer portals, three job boards and a handful of agency databases inside a month. Each copy lives in a different vendor's system, under a different retention policy, guarded by different people with different levels of care. The Danish breach wasn't a hacker smashing through a firewall; it was one trusted company's legitimate access being misused. That is the same shape of risk every CV database carries.

The CPR number matters so much because it's load-bearing. It follows a person through healthcare, tax, banking, employment and education, which is why a name-address-ID trio can be enough to clear a lazy identity check over the phone. The register holds records on around 11 million people against a resident population closer to 6 million, so the stolen set reaches emigrants and people who have died. Your own national identifier — a Social Security number, an Aadhaar or PAN, a Teudat Zehut — works the same way at home. Not one of them makes you a stronger candidate, and not one of them belongs in a document you hand to strangers.

note placeholder

Which personal details belong on a CV, and which never do?

Five things earn their place in a CV's contact block: your full name, your city and country, one phone number, one professional email address and one link — LinkedIn, a portfolio or a code repository. Everything else is either noise or a liability. Cut the street address, the national ID number, bank details, passport or driving licence numbers, marital status, religion, the names and ages of your children, and the "references available on request" line that's been padding CVs since fax machines. A recruiter deciding whether to call you needs evidence of skill and a way to reach you. Nothing on that cut list helps with either, and several items actively hurt.

Two fields genuinely depend on where you're applying. Date of birth and a photo are standard in some markets and a red flag in others. In the US, the UK, Canada and India, leave both off — they invite age and appearance bias and tell a screener nothing useful about your work. In Israel, listing age and military service (unit, role, years) is conventional and often expected from younger candidates, though plenty of Israeli recruiters will quietly admit the birthdate stops helping you somewhere after 45. Israeli CVs usually carry no photo. Parts of continental Europe still expect a headshot. When you're unsure, mirror what that market's own job ads and application forms ask for.

There's a practical reason the cut list matters beyond privacy: every extra field is another thing a parser can mangle. Cram an ID number, a birthdate and a full postal address into a two-line header and the extraction step gets more chances to mis-assign values — your postcode landing in the phone field, your ID read as an employee number. A clean five-line contact block in the body of the document parses reliably almost everywhere. One warning, though: don't let privacy tip into theatre. Redacting employer names or swapping dates for vague durations protects nothing and reads as evasive. Be generous with professional detail and ruthless with identity data. If you'd rather not rebuild the layout by hand, an AI CV builder sets the contact block correctly and keeps it consistent across templates.

Should you put your address on your resume?

Put your city and country on your CV and leave the street address off. Recruiters and applicant tracking systems do filter on location — roughly 43% of recruiters use a location filter when they shortlist — so a CV with no geography at all can be screened out before a human reads a word of it. But those filters work on city, region and sometimes postcode. "Austin, TX" or "Tel Aviv, Israel" or "Bengaluru, India" does the entire job. No parser, in Workday or Greenhouse or anything else, scores you higher for a house number and a street name. The only thing a full address adds is a precise home location sitting in third-party systems you'll never audit.

A few variants are worth knowing. Applying out of area? "Manchester, UK — open to relocation" pre-empts the obvious objection before a recruiter forms it. Already moving? "Relocating to Berlin, January 2027" is clearer than naming either the old city or the new one alone. Fully remote role? Pair your city with "open to remote" so the filter still finds you and the hiring manager can see your time zone at a glance. For big metros, a "Greater Boston Area" style line reads naturally. Postcode is a genuine coin flip: it sharpens commute-based filters and adds a little exposure. I'd include it for an on-site job within commuting distance and skip it everywhere else.

There are real exceptions. Government and public-sector applications, some defence contractors and certain regulated roles ask for a residential address on the form itself. Fill that in — it's a requirement, not a convention — but put it in the form field, not in the CV you also attach to twelve other applications. Security clearance and background checks will eventually want addresses going back years, and that's fine: those requests arrive through a verified employer channel, once you're a serious candidate, with a named contact and a retention notice attached. The difference between that and a PDF sitting on a job board is the difference between showing your passport at a border and leaving it on a café table.

How long do ATS databases keep your CV after you apply?

Assume your CV stays searchable for years, not weeks. In practice most applicant tracking systems default to retaining candidate records somewhere between two and seven years, and retention is a configurable setting — some platforms let an administrator choose anything from one month to five years, with automatic deletion switched on or off. US employers face a floor rather than a ceiling: federal rules require hiring records, CVs included, to be kept at least one year, and two years for educational institutions, state and local government and certain federal contractors. Nothing obliges them to stop at the minimum, and most don't. That isn't necessarily negligence — a candidate rejected in March is a ready-made shortlist in November.

Europe works differently, and more vaguely than people expect. The GDPR sets no fixed retention period at all; it requires only that personal data be kept no longer than necessary for the purpose it was collected for. In practice, UK and German employers often settle on roughly six months after a rejection, which covers the window for a discrimination claim. French guidance has long permitted up to two years from last contact, provided candidates are told at the point of collection. Past a year or two, an employer generally needs your consent rather than a legitimate interest to justify holding the file. The common failure isn't a bad policy, though — it's a policy nobody enforces, because automatic deletion was never turned on.

Job boards are a separate exposure, and usually a longer-lived one. When you upload a CV to a board, you're often not applying to a single employer at all; you're publishing a profile that any recruiter with a database subscription can search, download and keep on their own laptop indefinitely. Withdrawing an application doesn't delete your record either — it moves you out of the active pipeline while the file stays exactly where it was. If you want it gone, you have to ask: a written erasure request under the GDPR, the UK GDPR, the CCPA or your local law, sent to the employer's privacy contact. It works more often than people assume. It also can't claw back copies already downloaded.

How do leaked CV details fuel fake recruiter scams, and what should you check before sending?

Stolen name-address-ID combinations make fake recruiter approaches believable, and believability is the entire scam. The FBI has documented a consistent playbook: criminals register a lookalike domain for a real company, post openings on legitimate job boards, then email applicants as "talent acquisition" and run interviews over a teleconferencing app. Some listings exist purely to harvest CVs in bulk, which are then packaged and sold on. When an approach already contains your correct address and employment history, your instinct to verify weakens — the pitch has texture it could never have manufactured. That's precisely where a breach of a population register and an ordinary job search intersect.

The money moment is fake onboarding. After a few rounds of polished, professional contact comes an offer letter, then "paperwork": tax forms that harvest a Social Security number, a direct deposit setup requesting routing and account numbers, an equipment provisioning fee you'll be reimbursed for. In India, scammers phone candidates about invented openings specifically to extract a PAN number, precisely because it isn't normally on a CV and so a request for it feels like genuine verification. In 2026 the video stage got harder to read, with deepfaked recruiters appearing on calls — watch for lip-sync lag, unnatural facial movement and an inability to answer basic questions about the company. One rule covers all of it: identity documents and bank details only after a signed offer, through a channel you initiated.

So here's the pre-send pass, and it takes two minutes. Open your CV and check: contact block in the body of the document rather than a header or footer; name, city, country, phone, email and one professional link; no street address, no ID number, no bank details, no passport number; date of birth and photo only if your market genuinely expects them; nothing important trapped inside an image, an icon or a text box. Then confirm a machine reads the file the way you intended — a free CV analysis returns an ATS compatibility score and a visual layout breakdown, which is the fastest way to catch a contact block that looks immaculate on screen and extracts into nonsense.

Frequently asked questions