Candidate Data Privacy in Hiring: Interview Recordings, Retention and Responsibility

Every recorded interview turns into personal data that your company answers for. Most teams only find out where it lives, and for how long, when a candidate asks.

21 August 2026. 9 minute read. Updated 26 October 2026

Every recorded interview leaves a small archive behind. There is the video file, the audio track, a machine transcript, a set of scores, a few reviewer notes and usually a log of who opened what. Candidate data privacy in hiring is the duty to know where each of those pieces sits, who can see it, how long it stays and how a candidate can get it back or have it erased. The vendor stores the files. The legal duty stays with the employer that asked for the interview.

In November 2024 the Information Commissioner, the data protection regulator for the United Kingdom, published the results of its audits of companies that build and sell AI recruitment tools. It found tools collecting far more personal information than they needed and keeping it indefinitely to build large databases of potential candidates, without those candidates knowing. The regulator made almost 300 recommendations to the firms it audited. That is the pattern any hiring team should design against.

What does a recorded interview leave behind?

Follow one interview from the candidate side. A final year student opens a link on her phone at nine in the evening, allows the camera and microphone, and answers five questions. The platform uploads the video in pieces as she speaks. A speech to text step turns the audio into text, a scoring step reads that text against your rubric, and a reviewer on your team watches two of her answers the next morning and writes a short note.

By lunch the same person exists in several places. The raw video sits in file storage. The transcript and scores sit in a database, and both sit again in backups that rotate on their own schedule. If the platform uses an outside speech service, the audio may pass through that provider too. Then come the copies your own team makes, such as a shortlist exported to a spreadsheet or a transcript pasted into an email to the hiring manager.

This matters on the day a candidate asks for deletion. In many tools the delete button removes the main database record and very little else. Ask any vendor to describe deletion as an ordered list of systems with a number of days against each one, backups included. A clear answer takes five minutes. A vague one usually means the work has never been done.

Access is the other half of the picture. Support and engineering staff at the vendor can normally open recordings to fix problems, which is reasonable. What you want is a log of every such access, kept long enough to check, and a vendor who can tell you which of its people opened a named candidate file last quarter.

Who is responsible for candidate data, the employer or the vendor?

The employer carries the responsibility. Under the European Union General Data Protection Regulation the employer is the controller, because it decides why and how candidates are assessed, and the interview platform is a processor acting on its instructions. Guidance from the UK Information Commissioner on Article 28 sets out what the contract between them must contain. The processor may act only on documented instructions, needs written authorisation before it brings in a sub processor, must help the controller answer access and erasure requests, and at the end of the contract must delete or return all personal data, as the controller chooses.

The same guidance makes a point that vendors sometimes miss. A processor that starts deciding the purposes of processing for itself, for example by using your candidate interviews to improve its own models, is treated as a controller for that processing. You then have a supplier doing something your privacy notice never told candidates about.

India uses different words for a similar split. Under section 8(1) of the Digital Personal Data Protection Act, 2023, the Data Fiduciary, which in hiring is the employer, is responsible for complying with the Act, including for processing that a Data Processor carries out on its behalf. Section 8(5) requires reasonable security safeguards to prevent a personal data breach, and the Schedule to the Act sets the penalty for failing that duty at up to two hundred and fifty crore rupees. No clause in a vendor agreement moves that exposure off the employer.

How long should you keep interview recordings and transcripts?

Keep each item only as long as you can explain in writing. Neither the GDPR nor the DPDP Act gives one fixed number of days for hiring records, so the employer has to choose a period and record the reason. The audit by the Information Commissioner is a useful reminder of the worst choice, which is no limit at all.

Most recruiters who have run hiring at volume settle on a split. The raw video is the most sensitive item and the least useful once a decision is made, so it expires first. The transcript, the scores, the rubric version and the decision note are what you need if a candidate later asks why they were turned down, so they stay longer. Everything should expire on a timer rather than when somebody remembers to run a clean up.

Item	Why you keep it	A common default
Raw video and audio	Reviewers watching answers while the role is open	Delete 60 to 90 days after the role closes
Transcript and scores	Explaining or reviewing the decision later	Keep for your legal claim period, then delete
Reviewer notes and decision record	Showing that a person made the call	Same period as the transcript
Exports and spreadsheets	Short term shortlisting	Delete when the role closes

Tell candidates the period before they record. The Information Commissioner recommended that candidates receive clear privacy information that includes a retention period, and a promise printed in the invitation is far easier to keep than one buried in a policy page.

What rights do candidates have under the DPDP Rules and the GDPR?

In India, the Digital Personal Data Protection Rules, 2025 were notified in November 2025 with an eighteen month period for phased compliance. The Press Information Bureau summary of the Rules lists what a Data Principal can do, which includes knowing what data is collected and why, getting a copy, correcting or updating it, asking for erasure in certain situations and nominating another person to act for them. It also says a Data Fiduciary must answer access, correction, updating or erasure requests within a maximum of ninety days.

The GDPR goes further on automated decisions. Article 22 gives a person the right not to be subject to a decision based solely on automated processing where the decision has legal or similarly significant effects. Guidance from the UK Information Commissioner names online recruiting with no human involvement as an example of a similarly significant effect.

For a hiring team the working rule is plain. If a score can end a candidacy before any person looks at the evidence, you are standing close to that line. Put a named reviewer between every score and every rejection, and keep a record showing that the reviewer actually read the answers. Our guide on how one way video interviews work covers where that review step fits.

Does the EU AI Act apply to interview tools?

It does for anyone hiring into the European Union. Annex III of the AI Act lists AI systems meant for the recruitment or selection of people, including those that analyse and filter job applications and evaluate candidates, as high risk. On 29 June 2026 the Council of the European Union gave final approval to a simplification package that sets 2 December 2027 as the start date for stand alone high risk systems. Plan to that date and treat the extra time as time to build the process properly.

One part of the Act already bites. Article 5(1)(f) prohibits AI systems that infer the emotions of a person in the workplace and in education institutions, except for medical or safety reasons. A vendor that offers to read confidence, enthusiasm or stress from a face or a voice is selling something you should keep well away from candidates hired into the European Union.

Questions to ask an interview vendor before you sign

List every system that holds a recording, transcript, score or log for a single candidate, including backups and outside providers.
Name each sub processor, what it receives and how long it keeps it.
When we delete a candidate, tell us which systems are cleared, in what order and within how many days.
Tell us whether you use our candidate interviews to train, test or improve any model, including through human review of transcripts.
Tell us which of your staff can open a recording, and show us the log of who opened a named file.
Tell us where the data is stored and from which locations your staff and sub processors can reach it.
Show us how to set different retention periods for video and for transcripts.
Tell us whether anything is scored from facial expression, voice tone or emotional state.
Show us how to export one full candidate record, with transcript, scores and rubric version, to answer an access request.
Tell us how quickly you will notify us of a breach and what that notice will contain.

Write the answers on training and deletion into the contract as warranties. A page on a website can change next month without anyone telling you. A signed clause gives you something to point to. If you are still comparing tools, our checklist on how to choose a video interview platform covers the rest of the evaluation.

A candidate notice you can adapt

Show the notice on screen before the first question, in words a candidate can read in under a minute. A version that suits most roles reads like this.

This interview is recorded. We keep the video and audio, a written transcript and scores against the criteria for this role. A named person on our hiring team reads the transcript and scores before any decision is made. We delete the video 90 days after the role closes and keep the transcript and scores for [period] so we can answer questions about the decision. You can ask for a copy, a correction or deletion, or ask to speak with a person instead. Write to [address] and we will reply within [number] days.

Only promise what the platform lets you deliver. If you cannot export a transcript without raising a support ticket, the access promise will be hard to keep, so test it before the notice goes live. It also helps to know what the scores themselves are based on, which our guide on how AI scores an interview explains.

Most of this work is unglamorous. Someone has to know where the copies are, decide how long they live, make the deletion actually run and write the notice in plain words. Done at the buying stage, it takes a few weeks. Done after a complaint, it takes a great deal longer, and the candidate who trusted you with a recording of themselves has already lost faith in the process.

Sources

02 Questions

Questions this guide answers.

Who is responsible for candidate data privacy, the employer or the interview vendor?

The employer is responsible. Under the DPDP Act, 2023 the employer is the Data Fiduciary and stays responsible even for processing a vendor does on its behalf, and under the GDPR the employer is the controller. A contract can set out what the vendor must do, but it cannot move the legal duty off the employer.

How long should an employer keep candidate interview recordings?

Keep the raw video only while the role is open and for a short period after, commonly 60 to 90 days, and keep transcripts, scores and decision notes for your legal claim period. Neither the DPDP Act nor the GDPR sets one fixed number of days for hiring records, so write down the period you choose and the reason. Tell candidates the period before they record.

How quickly must an employer answer a candidate request to see or delete their data in India?

The Press Information Bureau summary of the DPDP Rules, 2025 says a Data Fiduciary must answer access, correction, updating or erasure requests within a maximum of ninety days. The Rules were notified in November 2025 with an eighteen month period for phased compliance. Build the export and deletion steps now so you are not doing them by hand later.

Can an AI interview score reject a candidate on its own?

Under the GDPR, Article 22 gives people the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects, and UK guidance names online recruiting with no human involvement as an example. The safe practice everywhere is to have a named reviewer read the evidence before any rejection. Keep a record that the review happened.

Is emotion detection in interviews allowed under the EU AI Act?

It is prohibited for candidates in the European Union. Article 5(1)(f) of the AI Act prohibits AI systems that infer the emotions of a person in the workplace and in education institutions, except for medical or safety reasons. Ask any vendor in writing whether it scores anything from facial expression or voice tone.

What should a candidate privacy notice for a video interview say?

It should say what is recorded, who reviews it before a decision, how long each item is kept and how to ask for a copy, correction or deletion. Show it on screen before the first question, in plain words. Only promise what your platform can actually deliver.

03 Next step

Spend less.Hire best.

Four hiring modules. Free trial with one real candidate.

Talk to us