The screening task needs the project example. Does it need the whole file?

Look at what is going into the upload

A recruiter has a resume, references, a portfolio screenshot and an email about availability. The task is to find evidence of project coordination. Uploading the whole bundle is easy, but most of it does not answer that question.

The phone number is for communication. References’ contact details belong to a different step. The screenshot may expose client information. None should enter the assessment simply because it arrived with the application.

NIST’s Privacy Framework includes data minimization and processing inventories. SP 800-122 recommends minimizing the collection, use and retention of personally identifiable information. These are risk-management references, not a legal retention schedule for your organisation.[nist-privacy][nist-pii]

Keep the context that explains the work

In this invented implementation-coordinator application, the useful passage describes supplier dependencies, changed requirements and escalation. Keep dates and responsibility details needed to understand that passage. Keep the original in the approved recruiting record.

Scroll sideways to read the full table.

Only create a reduced copy if your process can preserve and check it reliably. Removing context indiscriminately can create another problem: the reviewer sees a fragment and misunderstands the responsibility. Compare the copy with the original before using it.

A reduced copy is not necessarily anonymous. A distinctive career history or project can identify somebody even after their name has been removed.

Draw the route past the model

The architecture diagram includes the places people often leave out: generated assessments, exports and logs. An input can be deleted while a summary remains in interview notes or a downloaded spreadsheet.

For each destination, record the purpose, fields, authorised users and policy owner. Ask the service owner about subprocessors, support access, storage, deletion and whether inputs or outputs are used for model training. An unanswered question is a blocker to that proposed route, not permission to assume the answer.

NIST treats inventory and mapping as part of identifying privacy risk. Make the map describe your actual services and people before you send candidate information. The diagram here is a reference workflow, not a statement about Pebble’s infrastructure.[nist-privacy]

Check hidden content too. Comments, revision history, filenames, embedded images and extracted text may contain information absent from the preview. Verify what the service receives rather than relying on the page you can see.

The summary needs the same care as the application

An AI assessment can copy facts and add inferences. Limit who can forward or export it. If a reviewer corrects an ownership claim, decide how that correction reaches interview notes and other copies. Deleting the input will not fix a misleading summary already in circulation.

Keep administrative information used by other processes separate from the evidence used to assess the work. Do not fill a missing project example with unrelated personal information from public profiles.

Assign retention and disposal to the responsible owner under your approved policy. Ask how originals, assessment copies, outputs, exports and backups are handled. There is no universal period prescribed here.

Before the next upload, answer this: which piece of information helps the reviewer assess the agreed work, and which piece is travelling only because it was convenient to include? That question gives you a practical starting point for reducing the input.