In answer to your questions, always get potential clients to sign a contract which covers the GDPR personal data processing requirements at a minimum, prior to giving them a copy of a consultant resume to retain. If you were sat in a meeting with them it is much simpler to record in your logs that the client had sight of the resume but was not left a copy of it in any format, than it is to keep track of which clients have a copy of which data and chasing up to ensure it is erased/destroyed when appropriate.
To ensure clients treat the resumes as confidential, make sure they are labelled in the header and footer as confidential. They could also be kept in an envelope clearly marked confidential. There could also be a footnote in small print that informs anyone with a copy, who the data controller is, and that processing is strictly subject to the terms of the 'client contract' or whatever you call it, and that it should be returned or shredded within X days of receipt for example.
If you have a computer system generate these it could even specify the client's name and the specific date it should be shredded by. Your notice could include a reminder that the personal data is protected under the E.U. General Data Protection Regulation (GDPR) 2016 and that (client name) as a data processor could be held liable in the event of unauthorised disclosure or processing, if they act outside or contrary to lawful instructions of the data controller.
Whilst this won't enforce responsible processing at least it will ensure that your business has done its best to ensure any recipients are fully aware of their responsibilities to protect the information and it would be very difficult for a client to claim they weren't aware the information was confidential or that they had legally binding responsibilities to protect it.
It's also worth noting that simply sending CV's/resumes (or other personal data) out via email (unless suitably encrypted) would not meet the requirement in GDPR recital 39 for personal data to be "processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing." Email technology whilst convenient does not offer any guarantees regarding privacy and confidentiality, therefore instead of sending resumes as email attachments it might be better to use a web-based extranet system which authenticates users before granting access to view resumes. Emails could just let clients know there is a new resume or X number of resumes waiting for them to review and give them a link/button to login.
The records of processing activities are in GDPR Article 30 on page 50, and it does not specify a retention period nor that we can choose the retention period, but simply states that data controllers make the records available to the supervisory authority when requested to do so - this may imply indefinite retention of processing records even beyond the life of the processing system (e.g. discontinued products/services), however we may need to await further clarification on this issue from supervisory authorities to be sure.