Documents to request from job candidates in France: what is allowed during recruitment, and when

Forty applications for a sales role, and a form inherited from the last hiring round. It asks for the CV, the cover letter, a photo, marital status, social security number and bank details "to save time when we hire". Nobody has read it in years, yet half of that form is a problem.

This article is for small business owners, recruiters and recruitment firms hiring in France. The rules below are French, and apply to any employer recruiting for a job in France; quotes from French official sources are our translation. It covers the candidate stage, before the hiring decision: what you can ask for, when, what is banned, how long to keep files, and a message you can send as it is. What comes next, once the contract is signed, is covered in our article on onboarding documents for new employees in France.

What is a recruiter allowed to ask for?

The rule fits in one sentence, from article L1221-6 of the French Labour Code (opens in a new tab) (in French): information requested from a candidate "may only be aimed at assessing their ability to hold the job offered or their professional aptitudes". It "must have a direct and necessary link with the job offered or with the assessment of professional aptitudes". In return, the candidate "must answer these requests in good faith".

The article covers information requested "in any form whatsoever", so it applies to documents too. The CNIL, France's data protection authority, says so plainly in its recruitment guide (opens in a new tab) (in French): "the collection of supporting documents must follow the same logic of minimisation as the collection of other data".

Two more articles complete the picture. The candidate "is expressly informed, before they are used, of the recruitment methods and techniques applied to them" (article L1221-8 (opens in a new tab), in French): tests, questionnaires, role plays. And "no personal information about a job candidate may be collected by a system that has not been brought to their attention beforehand" (article L1221-9 (opens in a new tab), in French).

Which documents should you request, and at which stage?

The CNIL distinguishes two phases. Selection, where you check skills. Then the signing of the contract, where you collect what hiring requires. So the list of documents to request from job candidates changes as the process moves on.

With the application:

• the CV;
• the cover letter, if you actually use it;
• a portfolio or work samples, for jobs where that's the best evidence (design, writing, software development, architecture).

For shortlisted candidates, and only if the job requires it:

• a copy of a diploma, title or certification required for the role (the CNIL lists "diplomas and titles" among the qualifications a recruiter may check);
• a driving licence, if the job involves driving: the French administration gives this very example, the employer may ask the candidate whether they hold one "as long as the job requires it" (entreprendre.service-public.gouv.fr (opens in a new tab), in French);
• a certificate of employment from a previous employer, which according to the CNIL "is in principle enough to prove the candidate's professional experience".

A useful example from the CNIL guide: payslips. They show salary, absences, sometimes strike days, and bank details. The CNIL concludes that "these documents should not be requested from the candidate". If a candidate sends one on their own to prove their pay level, ask them to mask the rest.

What should you never ask a candidate for?

In its guide for small businesses (opens in a new tab) (in French), the CNIL gives examples. It is forbidden to ask a candidate for "their social security number and bank details (except in the specific case of temporary work agencies acting as employer)", for "information about members of their family", whether they want children, or their body measurements, except for a few very specific jobs announced in the job ad. It adds that during an interview, "asking for a candidate's place of residence is unlawful, except where they have to take part in an on-call rota".

The French administration sums it up: the employer "must not ask questions about the candidate's personal situation regarding their health, family situation, trade union membership, sex life, housing or leisure activities" (source (opens in a new tab), in French).

Three items keep turning up on inherited forms:

• Bank details and social security number. Needed at hiring, not before. The CNIL states that "this information must not be requested from all candidates (some of whom the recruiter knows will not be selected) during the selection phase".
• A photo. France's Defender of Rights (opens in a new tab) (in French) writes that "requiring, for example, a photo on a CV can only be exceptional". Physical appearance is one of the grounds of discrimination banned by article L1132-1 of the French Labour Code (opens in a new tab) (in French), alongside origin, age, family situation, pregnancy, health and many others.
• A criminal record extract. Unless a specific text applies to the job, the CNIL says a recruiter "will in principle not be able to obtain a criminal record extract from a candidate". If the job genuinely justifies it, they may look at the paper bulletin no. 3 "without keeping it or making a copy", and only note that the check was done.

For identity documents, the same minimisation logic applies: they belong to hiring, not selection. We cover what the CNIL says in our article on asking for a copy of an ID.

Can you call previous employers?

Yes, on one condition. For the CNIL, "collecting references from the candidate's professional circle (managers, colleagues, internship supervisors, clients, suppliers, etc.) is allowed as long as the candidate has been informed beforehand".

In practice, ask the candidate for one or two contacts, and tell them when you will call. You get references they agree to, and you stay within the rules. Calling their current employer behind their back could cost them their job: never do it.

What message should you send a shortlisted candidate?

A good message says what is requested, why, and what will happen to the file if they aren't selected. Adapt it to the role:

Hello [First name],

Thank you for our conversation on [date]. Your application for the [job title] role is moving to the next stage.

For the next step, please send me the following by [day and date]:

1. A copy of your [diploma or certification required for the role]
2. [Three work samples / your portfolio]
3. Contact details for one or two people who can speak about your work (I will only contact the people you name, and I'll let you know beforehand)

The next step will be [an interview with / a 45-minute exercise on] on [date].

No other document is needed at this stage. If your application isn't successful, your file will be deleted [timeframe], unless you agree that we keep it for future roles.

Kind regards,
[Your name]

And what not to send:

Hello,

To complete your file, please send us: CV with photo, copy of your ID card, health insurance card, bank details, your last 3 payslips and a form stating your marital status and number of children.

Regards

Almost every line of that second message is questionable at this stage, for the reasons above.

How long can you keep the CVs of unsuccessful candidates?

Not forever. According to the CNIL (opens in a new tab) (in French), keeping a candidate's CV and cover letter for a "talent pool" is possible "provided the retention period does not in principle exceed two years and the candidate has been informed, from the last contact with that candidate".

Its guide also recommends that the recruiter ask for the candidate's consent to this talent pool, and allows keeping applications for up to three months after the recruitment ends, so you can explain the reasons for a rejection. The CNIL's answer to candidates (opens in a new tab) (in French) points the same way: keeping the file is possible "on condition of informing you and having obtained your agreement".

In practice, set a simple rule and write it in your message: deletion at the end of the recruitment, or two years at most with the candidate's agreement. And delete the attachments sitting in your inbox too.

What should you tell unsuccessful candidates?

A reply, even a short one. It's a matter of respect, and it's the right moment to tell them what happens to their file:

Hello [First name],

Thank you for the time you put into your application for the [job title] role. We have chosen another candidate.

We would like to keep your CV for future roles, for two years at most. If you agree, just reply "yes" to this message. If we don't hear from you, we will delete it.

All the best,
[Your name]

To follow up with a candidate who hasn't sent a promised document, you'll find ready-made wording in our reminder email templates.

If you're hiring several people at once, Please Send It sends each shortlisted candidate their own upload link with your list of documents, follows up with those whose file is incomplete, and files everything by candidate.