Recording Recruitment Interviews: What Are the RGPD Rules?

Do you record your interviews to get minutes and an evaluation grid? It's possible, but a candidate is neither your employee nor your client: they are applying, and refusing may feel costly to them.

It is this imbalance that dictates how you ask for their agreement, and how long you keep their data.

Can you record a recruitment interview?

Yes, but refusing must cost the candidate nothing.

A recorded interview contains the candidate's background, their motivations, their situation, sometimes things they had not planned to share. It therefore constitutes processing of personal data within the meaning of the GDPR.

In particular, you must:

• ask for the candidate's agreement before recording;
• inform them of the retention period;
• determine your legal basis;
• define the purpose of the recording;
• restrict access to the evaluation grid;
• allow them to exercise their rights.

Recording without the knowledge of the people present also falls under the French Criminal Code, which punishes "with one year's imprisonment and a fine of €45,000 the act of wilfully violating the privacy of another person by any means whatsoever: 1° by capturing, recording or transmitting, without the consent of their author, words spoken in private or confidentially" (Article 226-1).

Those who record interviews say so themselves: a recruitment firm that "holds job interviews by video" and "generates application files through note-taking during interviews" (April 2026), a sales director who "used it during interviews, two or three over the last few days, as a prompter" (January), a trainer who follows each candidate for thirty hours in person (March), a human resources consultant during "audit periods, all day long" (March). Recruitment is one of the most discussed topics before purchase: 837 demos mention it over the period.

Is a recorded interview personal data?

Yes, and particularly dense personal data.

The GDPR defines personal data as "any information relating to an identified or identifiable natural person" (Article 4, point 1).

An interview is about a named person, their background and their skills.

The transcript, the minutes and the evaluation grid are also covered.

Why does recruitment call for more precautions?

Because the person recorded is asking for something.

They are not in a position to negotiate the terms of the exchange, and refusing the recording may seem penalising to them, even when it is not. The common framework is detailed on the page recording a professional meeting.

You also carry out several successive processing operations:

record → transcribe → write the minutes → produce the grid → pass on to the committee.

One firm summed up the division of roles: "I recruit, they hire". The minutes therefore pass from one organisation to another, and the question of who receives them arises as soon as the interview takes place.

What data is recorded?

Depending on the tool used, you may keep:

• the audio of the interview;
• the transcript;
• the names of the speakers;
• the date of the interview;
• the minutes;
• the strengths and the points to explore further;
• the evaluation grid.

The grid is an assessment of a person: it deserves the same care as everything else. When it is sent to applicant tracking software, Boond or RecruitCRM, it creates a second copy there.

---

Do you have to inform the candidate before recording the interview?

Yes.

The information must be given before or at the time the data is collected. The text requires it to be provided "at the time when personal data are obtained" (GDPR, Article 13, paragraph 1).

In an interview, information alone is not enough: you also ask for their agreement.

Giving this information is established practice among recruiters, and they want to keep a record of it. A recruiter wrote on 19 January: "during interviews I have to give candidates some information, but it is rarely included in the minutes. How can I change that?". What is said to the candidate at the start is part of the minutes, and the minutes template can be set up to include it.

When should you inform them?

Before starting the recording.

In practice, you can announce it in the invitation message, then ask the question at the start. In a video conference, the invited candidate receives an email before the interview, the assistant appears under its name, and consent is timestamped when the recording starts.

The invitation prepares. Only the spoken question allows the candidate to refuse.

What should you tell them?

The CNIL states that the people concerned "must in particular be informed: of the existence of the system; of the identity of the data controller; of the purposes pursued".

You must therefore be able to explain simply:

who is recording → why → who will see the minutes → how long the data is kept.

Do you have to announce the retention period?

Yes, and this is a requirement specific to recruitment.

The CNIL states that the file "may be kept for 2 years after your last contact with the recruiter, or longer if you have given your formal agreement", and that it is "on condition of informing you and having obtained your agreement" that a recruiter may keep the data.

Do you have to say that an AI writes the minutes?

Yes.

The audio recording and the processing then carried out by the AI are two operations that are worth distinguishing.

The European AI Regulation provides that "providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system" (Article 50, paragraph 1). These obligations have applied since 2 August 2026, and they target the provider of the system; your obligation to inform comes from the GDPR and the CNIL's guidance.

In an interview, this information matters twice over: the candidate may want to know that an automatic summary will support the decision.

You can, for example, announce:

"The interview is being recorded and an AI assistant automatically writes the minutes."

What if a second interviewer joins the interview?

You inform them when they arrive, as the candidate was informed.

And only one device records. An in-person interview held with two computers connected to the same video conference in the same room ended with an unavailable video (17 April). The second interviewer sits down; they do not log in.

---

Which legal basis should you use to record an interview?

The candidate's consent is the most suitable basis.

Legitimate interest is weaker here, because the person concerned does not belong to the organisation.

Why consent?

Because the candidate is not in an employment relationship with you.

Consent is defined as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement" (GDPR, Article 4, point 11).

The difficulty lies in the words "freely given": a candidate who fears jeopardising their application does not refuse easily. The CNIL describes this imbalance for employees in its reference framework on personnel management: "Employees are only very rarely in a position to freely give, refuse or revoke their consent, given the dependency that results from the employer/employee relationship." A candidate who is applying may find themselves in a comparable situation. How you ask the question therefore matters as much as the question itself.

How do you prove that consent?

The controller must "be able to demonstrate that the data subject has consented" (GDPR, Article 7, paragraph 1).

Consent timestamped when the interview starts makes it possible, in particular, to keep that proof.

Can the candidate withdraw their agreement?

Yes.

The GDPR provides that "it shall be as easy to withdraw as to give consent" (Article 7, paragraph 3).

Can you reject a candidate who refuses the recording?

No.

Refusing a recording says nothing about the application. Treating it as a signal would also make the consent not freely given. For an internal rollout, also allow time for consulting staff representatives: one manager explained being "still blocked by the works council (CSE)" (January).

---

How long should you keep the recording of an interview?

For as long as necessary for the purpose pursued, and no longer.

The GDPR requires data to be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed" (Article 5, paragraph 1, point e). Recruitment also has a benchmark of its own.

How long should you keep the application file?

Two years after the last contact. The CNIL states that the file "may be kept for 2 years after your last contact with the recruiter, or longer if you have given your formal agreement".

The starting point is the last contact, not the date of the interview.

Do you have to keep the audio as long as the grid?

Nothing requires it.

Once the minutes have been reviewed and the grid filled in, the original recording may no longer have the same usefulness.

For recordings of calls at work, the CNIL retains a maximum period of six months, and up to one year for analysis documents.

What about the interviews of unsuccessful candidates?

They follow the same rule as the file, with separate archiving.

The reference framework on retention periods in human resources published by the CNIL on 2 April 2026 distinguishes two periods. In the active database, the data of an unsuccessful candidate added to a CV database is kept "for up to 2 years from the last contact with the unsuccessful candidate", with their agreement or unless they object. In intermediate archiving, it is kept "for evidential purposes, for any discrimination claims: 5 years from the date on which the position was filled", on the basis of Article L. 1134-5 of the French Labour Code, which the framework classifies as an obligation. For the successful candidate, the active-database period is "the duration of the recruitment procedure until the outcome of the application", after which their data moves into personnel management.

What this means for you: the audio and the minutes of an unsuccessful candidate's interview are not deleted when the decision is made. They move into restricted archiving for five years, accessible only to authorised people, before deletion.

Is the tool's default retention enough?

No, not on its own.

At Leexi, default retention is set by the data processing agreement at a maximum of two years, which can be reduced in the settings (Article 9.1). The five years of intermediate archiving in the CNIL framework exceed this period. For an unsuccessful candidate, the minutes and the grid are therefore exported to your restricted archive before the deadline, or retention is extended on request. No recruiter has asked for this yet: it is not yet a setting that is used.

An effective policy must provide for:

interview → minutes → decision → deletion of the audio → restricted archiving → expiry.

---

Who can access the minutes of an interview?

Only the people involved in the decision.

The recruiter, the manager concerned, and the recruitment committee. Not the whole team, nor the candidate's future colleagues.

Recruiter, manager, human resources

Each has their own level, set per team.

The need for exceptional access does exist. A manager wrote on 3 March: "for urgent HR reasons I need access to the following conversation". Emergency access should be provided for in the rules, together with the person authorised to grant it, rather than improvised.

Customers themselves put the sensitivity of these exchanges into words. On 8 April, a customer could not separate, in their analyses, the overall data from "sensitive personal discussions, such as one-to-one meetings about pay". A recruitment interview belongs to this category.

Who can view the audio, the transcript and the grid?

The three files do not necessarily meet the same need.

You can, for example:

• share the grid with the recruitment committee;
• limit access to the transcript;
• keep the audio only for genuinely justified needs.

The applicant tracking software

According to its own access rights.

The grid sent to Boond or RecruitCRM inherits the access rights of the application file. An HR report that receives the wrong template goes in there too: a customer reported on 10 April that "the steering committee script appears even though it should not be associated with the HR report". The minutes template decides what goes into the candidate's file.

Should the data be encrypted?

Security must be appropriate to the risk.

The GDPR requires "appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: (a) the pseudonymisation and encryption of personal data" (Article 32, paragraph 1).

---

What are the candidate's rights?

The people recorded have the rights provided for by the GDPR. Recruitment adds nothing specific to them, and the erasure requests received by Leexi over the period concerned other meetings.

Can they request access to their data?

Yes.

The candidate has "the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed" (GDPR, Article 15, paragraph 1). This may concern the audio, the transcript, the minutes and the evaluation grid.

Can they request rectification?

Yes.

The data subject has "the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her" (GDPR, Article 16).

This is particularly important with an automatic transcript.

An AI can mistranscribe:

• a proper name;
• a qualification;
• a date;
• a technical answer;
• the identity of the person who spoke.

Can they request erasure?

Yes, under the conditions laid down by the GDPR.

The data subject has "the right to obtain from the controller the erasure of personal data concerning him or her without undue delay" (GDPR, Article 17, paragraph 1).

The CNIL also recommends informing the candidate of this right at the time of the interview.

Can they object to the recording?

Yes, and in an interview this takes the form of a refusal, before or during the exchange.

The data subject has "the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1)" (GDPR, Article 21, paragraph 1).

You then stop the recording and take notes.

How quickly must you respond?

In principle, within one month. The controller responds "without undue delay and in any event within one month of receipt of the request" (GDPR, Article 12, paragraph 3).

---

What obligations apply when the AI takes the notes?

The AI adds a processing operation on top of the simple recording.

The way it works can be summarised as follows:

audio → transcript → analysis → minutes → evaluation grid.

What does the AI actually do?

It can:

• transcribe the interview;
• identify the speakers;
• pick out the strengths;
• pick out the points to explore further;
• produce minutes;
• fill in an evaluation grid.

Can the decision rest on this summary?

The summary is a support, not a decision.

It is reviewed and corrected before being passed on to the people who decide.

Two cases show why. On 16 April, a recruiter noticed that a statement "is included in every set of minutes, even when I don't mention it to the candidate", and asked how to make it appear only when it had actually been said. On 3 June, a transcript of a training meeting on recruitment contained "an unexplained string of numbers", attributed to several speakers and never spoken. Interview minutes containing a sentence the candidate did not say are inaccurate data, and they can weigh on a decision.

Which minutes template should you use?

The interview template, and it should be checked before the first candidate.

One recruiter could not find the template created in the "recruitment interview, HR" category (2 January). Another saw a steering committee template applied to an HR report (10 April). The template decides the sections of the minutes, and therefore what you keep about the candidate.

Where is the data stored?

This is one of the first questions to ask your provider.

At Leexi, recordings, transcripts and minutes stay in the Paris region, on AWS. Above a certain volume of licences, hosting at Scaleway can be chosen. Leexi's ten sub-processors are named in Article 6.1 of its data processing agreement, with their role and their hosting region.

Who processes the data?

The provider of the tool acts as a processor within the framework provided for by the GDPR.

Your applicant tracking software is a second processor. Leexi's compliance file details its own processing chain.

In Leexi's case, OpenAI provides the language model and Leexi runs it via Azure France, in a closed circuit.

Do you need a DPA with the provider?

Yes, when the provider acts as a processor.

Article 28 of the GDPR provides that "processing by a processor shall be governed by a contract or other legal act […] that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller" (paragraph 3).

Leexi's DPA is public, in version 2.0 since 6 July 2026 (English version, detailed on the page DPA and AI note-taking tool). It sets default retention at a maximum of two years, which can be reduced on request or in the settings (Article 9.1), the return or deletion of all data at the end of the contract (Article 11.2), and notification of a data breach within 24 hours (Article 5.4).

Does the AI use your interviews to train its models?

That depends on the provider.

At Leexi, conversations do not train any model, on all accounts. The commitment is set out in the privacy policy and in the compliance FAQ, and detailed on the page no AI training on your meetings.

---

How do you ask a candidate for their agreement before recording?

You can use simple, precise wording. What you say at the start appears in the transcript, and the minutes template can include it in a dedicated section.

At the start of an interview

"Before we start: I'm recording the interview and an AI assistant writes the minutes, so that I can listen to you instead of taking notes. The minutes are shared with the people involved in the decision. Your data is kept for two years after our last contact, and you can ask for it to be deleted at any time. Is that OK with you?"

For a technical interview

"As with the other candidates, I'm recording our conversation so that I can go back over your technical answers with the team. If you'd rather I took notes by hand, that's possible and it changes nothing about your application."

For a final interview

"The conversation is being recorded and the minutes will go to the recruitment committee. You can ask me for a copy of what concerns you. Is that all right?"

---

What mistakes should you avoid?

1. Asking the question in a way that makes refusing awkward

"You don't mind, do you?" doesn't really leave a choice.

2. Not announcing the retention period

The CNIL makes it a condition of keeping the file, not optional information.

3. Letting the evaluation grid circulate widely

It is an assessment of a person; it is restricted to those involved in the decision.

4. Using a minutes template designed for another purpose

A steering committee template in an HR report (10 April). It introduces unrelated sections and attributes to the recruiter actions that belong to the candidate.

5. Letting the template add a statement the candidate did not make

A statement included in every set of minutes, even when the recruiter did not mention it (16 April). It should be removed from the template before the next interview.

6. Losing the information given to the candidate

The information given at the start is "rarely included in the minutes" (19 January). It is your proof that the candidate was informed, and it should be kept with the grid.

7. Recording an in-person interview with two computers in the same video call

Video unavailable (17 April). An interview in a room is recorded from a single device, and the rules for in-person recording apply.

---

How do you record an interview with Leexi?

Once the GDPR framework is defined, using the tool comes down to a few steps.

1. Join the interview

Leexi can join your video interviews from your calendar, and a pre-screening interview by phone follows the rules for recording a call. For a face-to-face interview, the recording can be started from the mobile app, and the rules for in-person meetings apply.

2. Adapt the minutes to the type of interview

The format can be configured depending on whether it is a first conversation, a technical interview or a final interview, with a section for the information given to the candidate.

3. Produce the evaluation grid

The grid covers in particular the strengths, the points to explore further and the points requiring attention. The full workflow is described on the page AI note-taking for recruitment.

4. Collect consent

Consent can be recorded and timestamped, and the settings can be adapted per team and per country.

5. Send to the applicant tracking software

The minutes and the grid can be added to the candidate's file in Boond or RecruitCRM, or exported to another tool.

6. Control the data

Leexi states in particular hosting in the Paris region, a Scaleway option, model execution via Azure France in a closed circuit, encryption of data in transit and at rest, and no training on your conversations. The retention period is set in the settings, and the interview can be exported before the deadline if your archiving requires it.

---

What difficulties do users actually encounter?

Legal questions are not the only difficulties encountered in practice.

Out of 1,141 requests received by Leexi support between January and June 2026, 4 concern recording recruitment interviews. The reasons include the minutes template not producing what the recruiter expects, information given to the candidate that does not appear in the minutes, emergency access requested for an HR reason, and an assistant excluded from the meeting.

None of them asks whether recording is allowed. Yet the topic comes up in 837 demos over the period.

This gives another reading of the problem:

the question is not only "am I allowed to record?"

You also need to know:

which template is applied → what appears in the grid → who receives it → how long it is kept.

---

Recording a recruitment interview: what to remember

Before recording an interview, check these six points:

• Agreement: did the candidate say yes, without refusing costing them anything?
• Announced period: do they know how long their data is kept?
• Legal basis: is consent indeed the basis you rely on?
• Retention: is the audio deleted once the grid is filled in, and is five-year archiving planned for unsuccessful candidates?
• Access: who receives the evaluation grid?
• Processors: do you know who processes the data, including your applicant tracking software?

If an AI is involved, add a seventh point:

does the candidate know that an AI system processes the recording to produce the minutes?

Frequently asked questions

Can you reject a candidate who refuses the recording?

No. A refusal says nothing about the application, and treating it as a signal would make the consent not freely given within the meaning of Article 4, point 11 of the GDPR. Plan for handwritten notes as an announced alternative, and tell the candidate that this choice changes nothing about their application.

What should you tell the candidate before starting the recording?

Who is recording, why, who will see the minutes, how long the data is kept, and that an AI writes the summary. The CNIL makes information on the retention period a condition of keeping the file. The recording then contains this announcement, and the minutes template can include it in a dedicated section.

How long should you keep an unsuccessful candidate's interview?

Two years from the last contact in the active database if it is added to a CV database, then five years "from the date on which the position was filled" in intermediate archiving, for evidential purposes in the event of a discrimination claim (CNIL framework of 2 April 2026, Article L. 1134-5 of the French Labour Code). The tool's default retention of two years does not cover this archiving on its own: export or extend.

Can the AI-generated evaluation grid be the basis for the decision?

It serves as a support; it is reviewed and corrected before being passed on to the people who decide. A minutes template can add a statement the candidate did not make, and a transcript can attribute words to the wrong person: these are inaccurate data within the meaning of Article 16, and they would weigh on a decision.

Who can access the minutes of an interview?

Only the people involved in the decision: the recruiter, the manager concerned, the recruitment committee. The grid sent to applicant tracking software inherits the access rights of the file. Emergency access should be provided for in the rules, together with the person authorised to grant it, rather than improvised.

Can a candidate obtain a copy of their interview?

Yes, under the right of access (GDPR, Article 15), which may cover the audio, the transcript, the minutes and the evaluation grid concerning them. You respond within one month (Article 12, paragraph 3). The CNIL recommends informing the candidate of this right at the time of the interview.

Does an in-person interview follow the same rules?

Yes, with one difference in practice: no assistant is visible, agreement is asked for orally, only one device records, and the second interviewer sits down without logging in. A pre-screening interview by phone falls under the rules specific to calls. The details are on the pages recording in person and recording a phone call.

---

In summary

Recording a recruitment interview is possible.

But the right reflex is not only to ask:

"Am I allowed to record?"

You should instead check the whole chain, all the way to the grid that will be used to decide:

ask for agreement → announce the period → record → transcribe → produce the grid → restrict access → archive → delete.

It is this complete chain that must be governed by your data protection policy.

Do your interviews deserve structured minutes? Try Leexi on your next interview

Sources

Texts taken from primary sources on 22 August 2026.

• GDPR, Articles 4, 5, 6, 7, 12, 13, 15, 16, 17, 21, 28 and 32
• French Criminal Code, Article 226-1
• CNIL, Recruitment and retention of the application file
• CNIL, Listening to and recording calls in the workplace
• European Artificial Intelligence Regulation, Article 50
• Leexi, Data Processing Agreement, version 2.0 in force from 6 July 2026
• CNIL, Reference framework on the processing of personal data carried out for personnel management purposes, adopted on 21 November 2019, amended on 23 May 2022 (consulted on 2 September 2026)
• CNIL, Reference framework on retention periods for personal data, human resources management, 2 April 2026 (consulted on 2 September 2026)

Usage data: Leexi customer requests and sales conversations, January to June 2026, anonymised.

This page describes the applicable framework. It does not constitute legal advice.

Try Leexi for free