AI recruitment CRM data cleanup.

What a CRM cleanup fixes

A recruitment CRM that has run for ten years holds the same candidate three times under different emails, job titles typed fifty ways, skills tags nobody trusts, and notes that should never have been written. Search returns junk, matching misses good people, and the agency holds personal information it has no reason to keep. AI cleanup is a one-off project followed by a lighter ongoing check. Models do the reading and comparing; people approve every change, because merges and deletions are hard to reverse.

Four jobs make up most cleanups: duplicate detection, normalising titles and skills, flagging risky free-text notes, and identifying records for retention review.

How the workflow runs

Inputs

Candidate records with CVs, notes, contact details, placement history, consent flags and last-activity dates; the agency’s skills taxonomy; and its written retention policy.

Systems

The recruitment CRM through its API or a controlled export, an embedding model for similarity, a language model for pair checks, extraction and note screening, and a review interface.

Steps

Embed records and find likely duplicate pairs; have a model compare each pair and explain its call; extract normalised titles and skills; screen notes for sensitive content; list records past retention or without consent; queue all proposals for review.

Human review

Consultants approve merges for candidates they know, in batches with sampling. A privacy lead approves deletion lists and rewrites of flagged notes. Nothing changes in the CRM without a named approver.

Outputs

Approved merges, updated title and skills fields, rewritten or removed notes, deletion and consent-request lists, and a change log.

Measures

Duplicate rate before and after, share of merges reversed, records held without a consent date, flagged notes per 1,000 records, and search precision on test queries.

Risks

Merging two different people, deleting records you must keep, keeping records you should not, and leaking the export used for the work.

Illustrative example: a Wellington IT recruitment agency

Illustrative example, synthetic numbers: a Wellington agency has 85,000 candidate records collected over 12 years. A one-off cleanup produces 9,000 possible duplicate pairs, extracts skills for 30,000 records active in the last three years, and screens notes on every record.

Assumptions, at prices listed on 19 October 2026: OpenAI text-embedding-3-small at US$0.02 per million tokens (OpenAI pricing) and Claude Haiku 5.5 at US$0.10 per million input and US$0.50 per million output tokens for prompts up to 100,000 tokens (Anthropic pricing). The lesson is plain: the model bill is trivial, and the cleanup is a people project with a deadline.

NZ privacy and fairness rules

• Retention. The Privacy Act 2020 says an agency must not keep personal information longer than required for the purposes it may lawfully be used for. The Privacy Commissioner’s recruitment guidance adds that unsuccessful applications should be destroyed unless the applicant gave prior consent to be kept on file, and that an employer using an agency is responsible for the agency meeting those obligations.
• Accuracy. The same Act requires reasonable steps to make sure information is accurate, up to date, complete, relevant and not misleading before it is used or disclosed. Duplicate and stale records are an accuracy problem when sent to clients.
• Indirect collection. Since 1 May 2026, IPP3A requires agencies that collect personal information from someone other than the person to tell them, unless an exception applies. Candidate details from referrals, clients or third-party sources added after that date need a process.
• Notes and prohibited grounds. Section 22(2) of the Human Rights Act 1993 applies to anyone procuring employees for employers. Notes that record age, family plans or ethnicity against candidates invite exactly the treatment the Act prohibits.
• Re-contacting old records. Cleanup often ends in a “still looking?” campaign. If it promotes the agency’s services, the Unsolicited Electronic Messages Act 2007 consent and unsubscribe rules apply.

Decisions that stay with people

Consultants decide merges, because they know whether two Sarah Thompsons are one person. The privacy lead decides what is deleted, what is kept under consent and how flagged notes are rewritten. Directors own the retention policy itself. Our AI integration work keeps those approvals inside the CRM rather than in a spreadsheet on someone’s laptop.

Where cleanups go wrong

• False merges. Common names, shared family emails and recycled phone numbers create convincing false pairs. Require two independent matching signals, such as email and CV history, before proposing a merge.
• Deleting what you must keep. Placed candidates may have contractor, payroll or dispute records with their own retention needs. Exclude them from deletion lists by rule.
• Taxonomy drift. The model invents new skill labels. Constrain extraction to the agency’s taxonomy and route unknowns to a person.
• Flagging without fixing. A list of 1,200 risky notes that nobody rewrites is a liability in a file. Assign owners and a date.
• Export leaks. Cleanup copies left on laptops or shared drives are a breach waiting to happen. If one is likely to cause serious harm, the Privacy Act requires notifying the Commissioner as soon as practicable.

Clean records make candidate communication drafting accurate and keep interview note summarisation output where it belongs. The recruitment sector guide and our lesson on connecting AI to your CRM cover the ongoing setup.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.