Recording interviews under UK GDPR: lawful basis, notice and retention

Under the UK GDPR you can record or transcribe a job interview if you have a lawful basis, tell the candidate clearly before or at the start, collect no more than you need, keep it only as long as necessary and handle the candidate's requests about their data. Consent is not the only lawful basis: the ICO's draft recruitment guidance says consent is unlikely to be appropriate at most stages of recruitment, and legitimate interests is the usual alternative. If AI evaluates candidates, you will very likely need a data protection impact assessment first.

This guide covers each of those steps for UK recruiters, with a worked legitimate interests example and a privacy notice section you can adapt, then sets out what is different in the EU, including the EU AI Act's dates as amended in 2026.

The six obligations, in one table

The ICO's recruitment and selection guidance went to consultation from December 2023 to March 2024 and was still marked as draft and under review in September 2026, with a final version listed by the ICO for winter 2026. It is the regulator's clearest statement on recruitment, but treat it as draft.

Choosing a lawful basis: legitimate interests, not consent

The ICO's general guidance on consent says that if you are "processing employee data, or are in any other position of power over an individual, you should look for another basis for processing, such as 'public task' or 'legitimate interests'" (When is consent appropriate?). Its draft recruitment guidance applies that to candidates: because "there is likely to be an imbalance of power between the candidate and the employer or recruiter, consent is unlikely to be an appropriate lawful basis to use at most stages of the recruitment process." Employers are not banned from using consent, but it must be freely given and withdrawable without detriment, which is hard to show for someone who wants the job.

This is not a contradiction of the usual advice to ask candidates at the start of a call. Offering a genuine choice about the recording is good practice and supports the balancing test, and in a call with someone in a US all-party consent state it may be legally required. You can offer that choice while relying on legitimate interests as your UK GDPR basis. Wording for the spoken line is in the interview recording consent script.

The Data (Use and Access) Act 2025 added "recognised legitimate interests," in force since 5 February 2026. The ICO's guidance describes five pre-approved public interest purposes such as crime, safeguarding and emergencies. Recruitment is not one of them, so ordinary legitimate interests and its balancing test still apply.

A worked legitimate interests assessment

The ICO says the UK GDPR does not require a written legitimate interests assessment, but that you should do one anyway. An invented example for an agency that transcribes screening calls:

Legitimate interests assessment: transcription of candidate screening calls
Organisation: [Example Recruitment Ltd]   Date: [date]   Owner: [name]

1. Purpose test
   Interest: an accurate record of what candidates tell us, so we can assess
   them fairly against the role and represent them accurately to clients.
   Benefit to candidates: fewer misquotes; recruiter listens instead of typing.

2. Necessity test
   Could we do this without the transcript? Handwritten notes are the
   alternative, but are less accurate and slower. We do not keep audio or
   video; we keep a transcript and notes only.
   Minimisation: transcripts for the role applied for; no use for
   unrelated marketing or profiling.

3. Balancing test
   Reasonable expectations: candidates are told in the invite and at the start
   of the call, before anything is captured.
   Impact: interview content can include sensitive information. Recruiter
   offers to pause; candidates can object and are then assessed from
   handwritten notes with no detriment.
   Safeguards: access limited to [roles]; retention [period]; no solely
   automated decisions; supplier contract under Article 28.

Outcome: legitimate interests applies, subject to the safeguards above.
Review: [date], or sooner if the tool starts scoring candidates.

Special category data

Candidates sometimes mention health conditions, disabilities, religion or other special category data. According to the ICO, you can only process special category data if you meet a condition in Article 9 of the UK GDPR, "together with any associated DPA Schedule 1 conditions where required" (What are the rules on special category data?). Plan for this in your assessment, and give interviewers a simple rule: offer to pause, and do not probe.

Is recording necessary at all?

Data minimization is where recording interviews is most often challenged. The ICO's draft guidance on interviewing says "you must not collect excessive information about candidates at interview. For example, it is not usually necessary to make a video recording of each candidate's interview performance." Its guidance on monitoring workers, written for staff rather than candidates but a useful comparison, describes audio recording as more privacy-intrusive than purely visual recording and says it needs "a much greater justification."

Practical conclusions you can draw from that:

• Decide what you need. If the purpose is accurate notes, a transcript meets it with less data than audio or video.
• Write the reason down in your assessment, not only in the vendor's marketing.
• Don't record every interview by default because the tool allows it. Record where the purpose applies.
• Offer a real alternative to candidates who object.

Telling candidates: privacy notice and timing

You must provide privacy information at the time you collect the data, so candidates need it before or at the start of the interview, not in a follow-up. The ICO's list of what to include covers your identity and contact details, the purposes and lawful basis, the legitimate interests relied on, recipients, retention periods, rights, any automated decision-making and the right to complain. The right to object "must be explicitly brought to people's attention clearly and separately."

An example section for your candidate privacy notice, to adapt:

Interview recordings and transcripts

What we do: with your knowledge, we [transcribe / record] [screening calls /
interviews] using [tool]. [We keep a transcript and notes; we do not keep
audio or video.]

Why: to keep an accurate record of what you tell us so we can assess your
application fairly and represent you accurately to [our client / the hiring
team].

Lawful basis: our legitimate interests in accurate, fair assessment of
candidates. You can ask for our assessment of those interests.

Who sees it: [roles]; [client, only the parts relevant to your application];
our transcription provider, [name], which acts on our instructions.
[International transfers: where and safeguards.]

How long: [period, e.g. X months after the role is filled], then deleted.

Your choice: you can object before or during the interview. We will stop
and take handwritten notes instead, and it will not affect your application.

Your rights: access, rectification, erasure, restriction and objection.
Contact [address]. You can complain to us and to the ICO.

Automated decisions: [we do not make decisions about you based solely on
automated processing] / [describe, with how to request human review].

When you need a DPIA

The ICO's list of processing likely to result in high risk includes "innovative technology," including AI, where combined with any of the European criteria such as "evaluation or scoring" or "systematic monitoring," and decisions about access to an opportunity that rely to any extent on automated decision-making. The draft recruitment guidance gives using AI to help make recruitment decisions as an example, and for virtual interviews says you should consider the need for a DPIA.

A useful DPIA for interview tools answers: what is captured and where it is processed; who can access it; retention; how candidates are told and can object; whether any output influences selection and how a person reviews it; bias testing; and what happens when the vendor changes the product.

Retention and candidate rights

Retention

"The UK GDPR does not set specific time limits for different types of data," according to the ICO's storage limitation guidance. The draft recruitment guidance says the law does not specify timescales for recruitment records, and suggests that without a clear business reason you should not keep unsuccessful candidates' records beyond the period in which they could bring a claim arising from the recruitment. Agencies should also check their record-keeping duties under the Employment Agencies Act 1973. Pick a period, write down why, and delete on schedule.

Rights

• Access. Candidates can make a subject access request for recordings, transcripts and interview notes. Respond without undue delay and within one month, extendable by up to two further months for complex requests.
• Objection and erasure. Where you rely on legitimate interests, candidates can object, and erasure applies where there is no overriding legitimate interest.
• Automated decisions. New Articles 22A to 22D, inserted by section 80 of the Data (Use and Access) Act 2025 and in force since 5 February 2026, require safeguards for significant decisions based solely on automated processing, including letting people make representations, obtain human intervention and contest the decision. Stricter limits apply where special category data is involved.
• Complaints. Since 19 June 2026, controllers must make it easy to complain, for example with an electronic form, and acknowledge complaints within 30 days (section 103).

Commencement dates are from SI 2026/82. The ICO consulted on draft automated decision-making guidance in spring 2026, with a final version listed for winter 2026.

What is different in the EU

GDPR

The EU GDPR's lawful bases and principles are the same in substance (Regulation (EU) 2016/679). The European Data Protection Board's consent guidelines say it is "problematic for employers to process personal data of current or future employees on the basis of consent as it is unlikely to be freely given." The main practical difference is Article 88, which allows each Member State to set more specific rules for employment data, including recruitment. National law may also give works councils or employee representatives a say over recording or monitoring technology. Check the rules in each country you hire in.

EU AI Act

• High-risk category. Annex III, point 4(a) of the AI Act (Regulation (EU) 2024/1689) lists "AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates." Whether a tool that only transcribes is in scope depends on its intended purpose; the official sources we checked do not settle that.
• Emotion recognition. Article 5(1)(f) prohibits AI that infers emotions "in the areas of workplace and education institutions," except for medical or safety reasons, and has applied since 2 February 2025. If a tool claims to read candidates' emotions, take advice before using it with EU candidates.
• When high-risk obligations apply. The original date for Annex III systems was 2 August 2026. The Digital Omnibus on AI, adopted as Regulation (EU) 2026/1744 and in force since 27 July 2026, moved it to 2 December 2027 for Annex III systems (and 2 August 2028 for Annex I). It did not change Annex III or Article 5(1)(f).
• Employer duties. When the high-risk rules apply, Article 26(7) requires deployers who are employers to inform workers' representatives and affected workers before putting a high-risk system into service in the workplace.

Checklist before you record UK or EU interviews

• Purpose written down, and the least intrusive format chosen: transcript, audio or video.
• Lawful basis chosen and a legitimate interests assessment on file.
• Plan for special category data that comes up in interviews.
• Candidate privacy notice updated, with the right to object stated clearly and separately.
• Notice in the invite, and a spoken line at the start with a genuine option to decline.
• DPIA completed if AI, scoring or video analysis is involved.
• Supplier contract and international transfer safeguards in place for the recording or transcription provider.
• Retention period set, with a reason, and deletion scheduled.
• Process to find and supply recordings and transcripts for a subject access request within one month.
• For automated decisions: safeguards for human intervention and contesting the decision.
• For EU hiring: national employment rules and works council duties checked; AI Act classification reviewed before December 2027.