Is a GDPR consent clause mandatory in a CV in 2026?

Yes. Without a consent clause the employer has no legal basis for processing the personal data contained in your CV. In practice, many companies automatically reject applications that lack the clause — especially large corporations and public institutions with robust compliance procedures.

What is the current wording of the GDPR clause for a CV in 2026?

The current clause should reference Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, commonly known as the GDPR. Older clauses that cite national data-protection acts predating the GDPR are outdated and should not be used. You will find ready-to-use templates (standard and extended) in the body of this article.

Can I still use an old consent clause that references a pre-GDPR national data-protection act?

No. Any clause that references a national data-protection act superseded by the GDPR has been outdated since 25 May 2018, when the GDPR came into force across the entire European Union. Using an old clause signals to the recruiter a lack of attention to detail and unfamiliarity with current regulations.

Where in the CV should I place the GDPR clause?

Place the GDPR clause at the very bottom of your CV, below the last content section. Use a smaller font size (7-9 pt) and optionally a grey text colour so the clause does not disrupt the visual layout of the document. Do not add a separate heading before the clause.

What is the difference between a standard and an extended clause?

The standard clause covers consent for data processing only within the specific recruitment process you are applying for. The extended clause additionally grants consent for the company to keep your CV for future recruitment processes. In the extended version you must include the specific company name.

Can an employer reject a CV that lacks a consent clause?

Yes, and many employers do exactly that. Processing personal data without a legal basis constitutes a GDPR violation, so companies with mature data-protection procedures automatically reject CVs that lack the clause. Adding it takes a moment; omitting it can cost you a job interview.

Does an extended clause increase my chances of getting hired?

An extended clause does not directly affect how your candidacy is evaluated, but it gives the employer the right to keep your CV for future openings. If you are not selected this time, the company may contact you when another suitable position becomes available.

Do I need a GDPR clause when sending my CV abroad?

A GDPR clause is required when you apply to a company that processes data within the European Union or the European Economic Area. If you are sending your CV to a company in the US, Canada, or Australia, the GDPR clause is not necessary — unless the company has its headquarters or a branch in the EU.

GDPR Consent Clause for CV 2026 — Current Wording Ready to Copy

What Is a GDPR Consent Clause in a CV

In 2026, the GDPR consent clause remains a mandatory element of every CV sent to employers within the European Union. A GDPR consent clause in a CV is a short statement in which you grant the prospective employer permission to process your personal data for recruitment purposes. The name comes from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, commonly known as the GDPR (General Data Protection Regulation).

By its very nature, a CV contains personal data: your first and last name, email address, phone number, and often a photograph, home address, or date of birth. For an employer to legally process this information, they need a legal basis. For data that goes beyond the minimum required by labour law, that legal basis is your consent — expressed in the clause.

From a legal standpoint, the clause fulfils the requirements of Article 6(1)(a) of the GDPR — consent of the data subject. Without it, the employer should not process data that exceeds the scope mandated by applicable labour legislation. In practice this means that a missing clause can result in your application being rejected before anyone even reads your CV.

The GDPR has been directly applicable in all EU Member States since 25 May 2018. Since that date, older consent clauses citing pre-GDPR national data-protection laws are outdated and should no longer be used.

When Do You Need a GDPR Clause in Your CV

The clause is not required in exactly the same way in every situation. Below you will find specific scenarios in which you must (or do not necessarily have to) include the clause in your CV.

Responding to a Job Posting

This is the most common scenario. When you reply to a job advertisement, the clause is mandatory. The employer needs your consent to legally process the personal data contained in your CV. This applies to postings on job boards (Indeed, LinkedIn, Glassdoor) as well as on corporate career pages. If the employer provides a specific wording for the clause in the job listing, use their version.

Speculative (Unsolicited) Applications

Sending a CV on your own initiative, without a specific job posting? The clause is especially important in this case. The company did not ask for your data, so your consent is the only legal basis on which they can process it. Without the clause the employer should delete your CV. In this situation it is worth considering an extended clause that covers future recruitment processes.

Applying Through a Job Portal

An increasing number of companies use dedicated applicant tracking systems (ATS) where the candidate fills in a form and ticks a data-processing consent checkbox. In such cases a separate clause in the body of your CV is not strictly necessary, because consent was given through the form. Nevertheless, many recruitment guides recommend including it anyway — just in case the CV is printed or forwarded outside the system.

Regardless of the scenario, the general rule is: it is always safer to include the clause. Adding it costs you one line of text, while omitting it may cost you a job interview.

How to Write a GDPR Clause Yourself

Writing a GDPR clause on your own is not difficult, but it does require familiarity with a few legal and formal principles. Below you will find a detailed step-by-step guide.

What the Law Says About Data-Processing Consent

Before you draft the clause, it is worth understanding its legal foundations. The key provisions are:

Article 6(1)(a) GDPR — consent of the data subject is one of the six legal bases for processing personal data. This is the provision referenced by the consent clause in a CV.
Article 7 GDPR — sets out the conditions for valid consent. Consent must be freely given, specific, informed, and unambiguous. A clause in your CV meets these conditions because you decide to include it voluntarily.
National labour legislation — in many EU countries, labour law specifies which data an employer may request from a candidate (name, date of birth, contact details, education, qualifications, employment history). Data beyond this list (e.g. a photograph, hobbies) requires separate consent.

In practice, this means the clause should clearly express consent to the processing of personal data and reference the GDPR as the legal basis.

Elements of a Proper Consent Clause

A correct GDPR consent clause should contain the following elements:

Expression of consent — a clear declaration, e.g. a sentence beginning with a phrase such as: I hereby consent to the processing of my personal data.
Purpose of processing — an indication that the data will be processed for recruitment purposes, for a specific position.
Legal basis — a reference to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, i.e. the GDPR.
Optional: extension to future recruitment — if you want the company to retain your CV for future openings, add an appropriate statement and include the company name.

Standard Clause Step by Step

To draft a standard consent clause on your own, follow these steps:

Start with the expression of consent: Write a sentence beginning with a formulation such as: I hereby consent to the processing of my personal data.
State the purpose: Add that the data is to be processed for the purpose of the recruitment process for the position you are applying for.
Provide the legal basis: Finish with a reference to the GDPR, citing the full name of the regulation: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
Check for accuracy: Make sure you are not referencing an outdated national act, that the regulation number is correct (2016/679, not 2016/697), and that the date is right (27 April 2016).

A finished standard clause should be a single, concise sentence spanning 2-3 lines of text in a smaller font.

Extended Clause Step by Step

The extended clause requires one additional element:

Draft the standard clause following the steps above.
Add the extension: After the part about the current recruitment process, insert a statement granting consent for future recruitment processes conducted by the given company.
Insert the company name: Make sure to include the full, official company name. Do not leave an empty bracket — this is one of the most common mistakes.
Remember to update it: Each time you apply to a different company, change the company name in the extended clause to match the specific employer.

GDPR Clause in English

If you are sending a CV in English, the consent clause should also be in English. Key principles:

The English-language name for the regulation is GDPR (General Data Protection Regulation).
A GDPR clause is only required when the company processes data within the EU/EEA. In English-speaking countries such as the US, post-Brexit UK, Canada, or Australia, a GDPR clause is not needed — unless the company has operations in the EU.
The language of the clause should match the language of the entire CV. Do not mix a clause in one language with a CV written in another.

Where to Place the Clause in Your CV

Placement matters from both an aesthetic and a readability perspective:

Best location: the bottom of the last page. The clause should sit below the last content section of your CV. This is a widely accepted convention that recruiters know and expect.
Never place the clause in the header, in the middle of the CV, or between content sections. Doing so disrupts the document layout and draws attention away from key information.
If your CV runs to two pages, place the clause at the bottom of the second page.

How to Format the Clause

The clause is a formal element, not a content element. It should be visible but should not dominate the document:

Font size: 7-9 pt, smaller than the main body text of the CV.
Text colour: a subtle grey (e.g. #666 or #777) instead of full black.
No separate heading: do not add a title before the clause. The statement itself is sufficient.
Length: the clause should fit in 1-3 lines. Do not make it longer than necessary.

Most Common Mistakes in CV Consent Clauses

The consent clause seems like a simple element, but in practice it is a source of many errors. Here are seven of the most common mistakes you should avoid:

Using an outdated clause — referencing a pre-GDPR national data-protection act is the single most common mistake. Such legislation was superseded by the GDPR in May 2018. Using an old clause immediately signals to the recruiter that the candidate is copying text from outdated sources.
Omitting the clause entirely — skipping the clause in the belief that it is an unnecessary formality is a serious mistake. Many companies (especially corporations and public institutions) automatically reject CVs without a clause. One line of text costs nothing; its absence can cost you a job interview.
Typos and errors in the regulation number — a wrong date (e.g. 2017 instead of 2016), an incorrect number (e.g. 2016/697 instead of 2016/679), or typos in key words undermine your credibility. Always verify the clause before sending your CV.
An excessively long clause — multi-paragraph statements that take up half a page are overkill. The clause should be concise and span no more than 2-3 lines. The recruiter does not expect the full text of the regulation in your CV.
Missing company name in the extended clause — if you choose the extended version covering future recruitment, you must include the specific company name. Leaving an empty bracket or using a vague formulation means the clause is incomplete and legally questionable.
Placing the clause only in the cover letter — the clause should appear in your CV because the CV is the document that contains your personal data. Not every employer requires a cover letter, and the CV is the primary document that always reaches the recruiter.
Mixing languages — a clause in one language inside a CV written in another looks unprofessional and suggests carelessness. The clause must be in the same language as the rest of the document.

Ready-to-Use GDPR Clause Templates for Your CV (up to date for 2026)

Below you will find ready-made clauses that you can copy and paste directly into your CV. Choose the appropriate version depending on your situation.

Standard Template

Use this version when applying for a specific position and you do not need to extend the consent to future recruitment:

I hereby consent to the processing of my personal data for the purpose of the recruitment process for the position I am applying for, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

This clause is sufficient in the vast majority of cases. If you are unsure which version to choose, use this one.

Extended Template

Use this version when you want the employer to retain your CV for future recruitment processes. Remember to replace the bracket with the actual company name:

I hereby consent to the processing of my personal data for the purpose of the recruitment process for the position I am applying for and for future recruitment processes conducted by [company name], in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

The extended clause is especially useful when sending a speculative application or when applying to a company where you would like to work in various roles.

English Template

For CVs written in English, directed at companies processing data within the EU:

I hereby consent to the processing of my personal data for the purpose of the recruitment process for the position I am applying for, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

How to Speed Up Adding a Consent Clause

Manually crafting a GDPR clause every time you send out a CV can be time-consuming — especially when you need to remember the current wording, swap the company name for the extended version, and ensure proper formatting. AI-powered tools can simplify this process significantly.

Modern CV builders with built-in AI automatically add the correct GDPR clause, match its language to the rest of the document, and place it in the right position. This means you no longer have to remember the regulation number, verify dates, or worry about typos. You can focus on the substantive content of your CV while the formal details are handled automatically.

How to Use CV AI to Add a GDPR Clause

CV AI is a tool that automates the entire CV-creation process, including adding the correct GDPR consent clause. Here is how it works in practice:

Go to cv-ai.pl and start building your CV. You can upload an existing document (PDF, DOCX) so the AI can analyse its content and suggest improvements, or you can start from scratch by filling in a step-by-step form. In both cases the system automatically adds the appropriate GDPR clause, matched to the language of your CV. If you need the extended version, simply provide the company name and the AI will generate the correct wording.

Once you have finished editing, you export your CV as a PDF ready to send to employers. The clause is placed at the bottom of the document, formatted in a smaller font and the appropriate colour — in line with the best practices described in this article. The entire process takes just a few minutes and eliminates the risk of formal errors.

Summary

A GDPR consent clause is a mandatory element of every job application in 2026 when applying within the EU. The regulations have not changed since 2025, so the current CV clause for 2025 and 2026 has identical wording. Although it is a short piece of text, its absence or incorrect wording can result in your candidacy being rejected. The most important rules to remember:

Always use the current clause referencing the GDPR (Regulation 2016/679), never an outdated national data-protection act.
Choose the right version — standard for a specific recruitment process, or extended (with the company name) for future processes.
Place the clause at the bottom of your CV, in a smaller font, without a separate heading.
Match the language of the clause to the language of the CV — never mix a clause in one language with a document written in another.
Avoid the most common mistakes — outdated wording, typos in the regulation number, or an empty bracket in the extended clause.

If you want to be sure that your CV is complete and compliant with current legal requirements, try CV AI. The tool takes care of every formal detail, including the correct GDPR clause, so you can focus on what matters most: landing the job you want.