# AI recruitment CRM data cleanup. URL: https://levystreet.com/industries/recruitment/recruitment-crm-data-cleanup/ Updated: 2026-10-19 AI recruitment CRM data cleanup for NZ agencies: duplicates, stale records, skills tags and sensitive notes found by AI, with merges and deletions approved. ## Short answer AI recruitment CRM data cleanup uses models to find duplicate candidate records, extract consistent skills and job titles from CVs and notes, flag free-text notes that contain sensitive or discriminatory content, and list records held without consent or beyond the agency's retention policy. Nothing is merged or deleted automatically. Consultants approve merges and a privacy lead approves deletions, in line with New Zealand's Privacy Act. - Models propose; people approve every merge and deletion, because both are hard to undo. - Unsuccessful applicants' records should be destroyed unless they consented to be kept. - Since 1 May 2026, IPP3A applies to candidate information collected from third parties. - Model fees for a full pass are tens of US dollars; review time dominates. ## What a CRM cleanup fixes A recruitment CRM that has run for ten years holds the same candidate three times under different emails, job titles typed fifty ways, skills tags nobody trusts, and notes that should never have been written. Search returns junk, matching misses good people, and the agency holds personal information it has no reason to keep. AI cleanup is a one-off project followed by a lighter ongoing check. Models do the reading and comparing; people approve every change, because merges and deletions are hard to reverse. Four jobs make up most cleanups: duplicate detection, normalising titles and skills, flagging risky free-text notes, and identifying records for retention review. ## How the workflow runs - **Inputs**: Candidate records with CVs, notes, contact details, placement history, consent flags and last-activity dates; the agency's skills taxonomy; and its written retention policy. - **Systems**: The recruitment CRM through its API or a controlled export, an embedding model for similarity, a language model for pair checks, extraction and note screening, and a review interface. - **Steps**: Embed records and find likely duplicate pairs; have a model compare each pair and explain its call; extract normalised titles and skills; screen notes for sensitive content; list records past retention or without consent; queue all proposals for review. - **Human review**: Consultants approve merges for candidates they know, in batches with sampling. A privacy lead approves deletion lists and rewrites of flagged notes. Nothing changes in the CRM without a named approver. - **Outputs**: Approved merges, updated title and skills fields, rewritten or removed notes, deletion and consent-request lists, and a change log. - **Measures**: Duplicate rate before and after, share of merges reversed, records held without a consent date, flagged notes per 1,000 records, and search precision on test queries. - **Risks**: Merging two different people, deleting records you must keep, keeping records you should not, and leaking the export used for the work. ## Illustrative example: a Wellington IT recruitment agency Illustrative example, synthetic numbers: a Wellington agency has 85,000 candidate records collected over 12 years. A one-off cleanup produces 9,000 possible duplicate pairs, extracts skills for 30,000 records active in the last three years, and screens notes on every record. | Task | Model cost | People time | |---|---|---| | Embed 85,000 records (1,500 tokens each) | about US$2.55 | None | | Check 9,000 pairs (2,500 in, 150 out) | about US$2.90 | 6,000 likely merges at 30 seconds: 50 hours | | Extract skills for 30,000 records (3,000 in, 300 out) | about US$13.50 | Spot checks: 5 hours | | Screen notes on 85,000 records (1,000 in, 50 out) | about US$10.60 | 1,200 flagged notes at 2 minutes: 40 hours | | Retention review list | None | Rules agreed, 500-record sample: 10 hours | | Total | about US$30 | about 105 hours | Assumptions, at prices listed on 19 October 2026: OpenAI text-embedding-3-small at US$0.02 per million tokens ([OpenAI pricing](https://developers.openai.com/api/docs/pricing)) and Claude Haiku 5.5 at US$0.10 per million input and US$0.50 per million output tokens for prompts up to 100,000 tokens ([Anthropic pricing](https://platform.claude.com/docs/en/about-claude/pricing)). The lesson is plain: the model bill is trivial, and the cleanup is a people project with a deadline. ## NZ privacy and fairness rules - **Retention.** The [Privacy Act 2020](https://www.legislation.govt.nz/act/public/2020/31/en/latest/) says an agency must not keep personal information longer than required for the purposes it may lawfully be used for. The Privacy Commissioner's [recruitment guidance](https://www.privacy.org.nz/resources-and-learning/a-z-topics/recruitment/) adds that unsuccessful applications should be destroyed unless the applicant gave prior consent to be kept on file, and that an employer using an agency is responsible for the agency meeting those obligations. - **Accuracy.** The same Act requires reasonable steps to make sure information is accurate, up to date, complete, relevant and not misleading before it is used or disclosed. Duplicate and stale records are an accuracy problem when sent to clients. - **Indirect collection.** Since 1 May 2026, [IPP3A](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ipp3a/) requires agencies that collect personal information from someone other than the person to tell them, unless an exception applies. Candidate details from referrals, clients or third-party sources added after that date need a process. - **Notes and prohibited grounds.** Section 22(2) of the [Human Rights Act 1993](https://www.legislation.govt.nz/act/public/1993/82/en/latest/) applies to anyone procuring employees for employers. Notes that record age, family plans or ethnicity against candidates invite exactly the treatment the Act prohibits. - **Re-contacting old records.** Cleanup often ends in a "still looking?" campaign. If it promotes the agency's services, the [Unsolicited Electronic Messages Act 2007](https://www.legislation.govt.nz/act/public/2007/7/en/latest/) consent and unsubscribe rules apply. ## Decisions that stay with people Consultants decide merges, because they know whether two Sarah Thompsons are one person. The privacy lead decides what is deleted, what is kept under consent and how flagged notes are rewritten. Directors own the retention policy itself. Our [AI integration](/services/ai-integration/) work keeps those approvals inside the CRM rather than in a spreadsheet on someone's laptop. ## Where cleanups go wrong - **False merges.** Common names, shared family emails and recycled phone numbers create convincing false pairs. Require two independent matching signals, such as email and CV history, before proposing a merge. - **Deleting what you must keep.** Placed candidates may have contractor, payroll or dispute records with their own retention needs. Exclude them from deletion lists by rule. - **Taxonomy drift.** The model invents new skill labels. Constrain extraction to the agency's taxonomy and route unknowns to a person. - **Flagging without fixing.** A list of 1,200 risky notes that nobody rewrites is a liability in a file. Assign owners and a date. - **Export leaks.** Cleanup copies left on laptops or shared drives are a breach waiting to happen. If one is likely to cause serious harm, the Privacy Act requires notifying the Commissioner as soon as practicable. Clean records make [candidate communication drafting](/industries/recruitment/candidate-communication-drafting/) accurate and keep [interview note summarisation](/industries/recruitment/interview-note-summarisation/) output where it belongs. The [recruitment sector guide](/industries/recruitment/) and our lesson on [connecting AI to your CRM](/learn/connecting-ai-to-your-crm/) cover the ongoing setup. ## Questions people ask ### Can AI safely merge duplicate candidate records? It can find them far faster than people and explain why two records look like the same person. Merges should still be approved by a consultant, because merging two different people combines their CVs, notes and contact history, which is a privacy breach as well as a data error. Start with high-confidence pairs and sample them before approving in batches. ### How long can a recruitment agency keep candidate data in New Zealand? The Privacy Act says personal information must not be kept longer than needed for the purposes it may lawfully be used for. The Privacy Commissioner's recruitment guidance says unsuccessful applications should be securely destroyed unless the candidate consented to being kept on file. Set a written retention policy, record consent with a date, and get advice on edge cases. ### What counts as sensitive content in recruiter notes? Comments on age, health, pregnancy or family plans, religion, ethnicity, sexual orientation, appearance or accent, and personal opinions about a candidate's character that are not tied to evidence. Notes like these are risky if a candidate requests their information, and some relate to prohibited grounds under the Human Rights Act 1993. Flag them for a person to rewrite or remove. ### Should we clean the CRM before adding AI search or matching? Yes. Matching and search systems inherit every duplicate, stale record and biased note in the database. A cleanup first gives better results and reduces the personal information exposed to the new system. It is also a good time to confirm which records you are entitled to keep and contact. ### What if the cleanup copy of the data leaks? A cleanup usually involves exports, which are a common source of breaches. Keep work inside the CRM or a controlled environment, use model providers that do not retain or train on the data, and delete exports when done. If a breach is likely to cause serious harm, the Privacy Act requires notifying the Commissioner as soon as practicable. ## Sources - [Recruitment](https://www.privacy.org.nz/resources-and-learning/a-z-topics/recruitment/) - [IPP3A: notification requirements for indirect collection of personal information](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ipp3a/) - [Privacy Act 2020](https://www.legislation.govt.nz/act/public/2020/31/en/latest/) - [Human Rights Act 1993](https://www.legislation.govt.nz/act/public/1993/82/en/latest/) - [Unsolicited Electronic Messages Act 2007](https://www.legislation.govt.nz/act/public/2007/7/en/latest/) - [API pricing](https://developers.openai.com/api/docs/pricing) - [Claude API pricing](https://platform.claude.com/docs/en/about-claude/pricing) Published by Levy Street (https://levystreet.com), Wellington, New Zealand.