Recording job interviews in Bahrain: the PDPL's written consent rule, disclosure to clients and Penal Code Article 372

Recording a job interview with a candidate in Bahrain requires the candidate's consent, and under the Personal Data Protection Law (Law No. 30 of 2018, the PDPL) consent must be "written, explicit, clear, and specific to the processing of certain data" and freely given after the candidate is told the purpose (Article 24). The PDPL also bars disclosing personal data without consent or a judicial order (Article 9), which governs sending a recording to a client. Article 372 of the Penal Code fines eavesdropping on a telephone call, and Article 75 of the Telecommunications Law punishes eavesdropping through a telecom network with a fine of up to 10,000 dinars. This is the position as of November 2026.

This page adds Bahrain to our Gulf series alongside the United Arab Emirates, Saudi Arabia, Qatar and Kuwait. It is for recruiters, agency consultants and hiring managers who interview candidates located in Bahrain by video or phone, including from the US. It focuses on three points of Bahrain's law that change how you run an interview: a written consent standard, a prior notification duty, and a published list of transfer countries that includes the United States.

Bahrain's rules at a glance

Is it legal to record a job interview in Bahrain?

Yes, with consent. Article 372 of the Penal Code imposes "a fine not exceeding twenty dinars" on anyone who opens a letter or telegram without the addressee's consent "or eavesdrops on a telephone call," and up to six months in prison or a fine of up to fifty dinars where the offender discloses the call to someone other than the person it was meant for, without permission, in a way likely to harm others (our translation). Article 370 punishes publishing "news, pictures or comments relating to the secrets of the private or family life of individuals, even if true," where that would harm them.

Article 75 of the Telecommunications Law adds a fine of up to 10,000 dinars for anyone who uses telecommunications equipment or a network with intent to "eavesdrop on, or disclose the confidentiality of, any calls or data relating to the content of any message," unless authorized by the Public Prosecution or a court (our translation). Neither law says whether a party to the call can eavesdrop on it, and we found no official guidance on the point. An interview recorded openly with the candidate's agreement is far from eavesdropping; a hidden recording is not. Consent removes the question, and the PDPL requires it anyway.

What does the PDPL require before you record?

The PDPL applies to processing by automatic means, which covers a recorded or transcribed interview (Article 2). Article 4 says "processing Personal data is prohibited without the data subject's consent," unless processing is necessary for one of five purposes, including "taking steps at the request of the data subject with the purpose of entering into a contract" and the controller's legitimate interests where these do not conflict with the person's fundamental rights. The Authority's own overview of the law describes the basic rule as not processing personal data "without seeking the data subject's written and explicit consent."

Where you rely on consent, Article 24 sets the standard: given by a person with full legal capacity, "written, explicit, clear, and specific to the processing of certain data," and "freely given by the data subject after being advised of the intended purpose or purposes of the processing," with the consequences of refusing where relevant. The candidate may withdraw it at any time. A spoken yes on the recording helps, but it is not obviously "written," so ask the candidate to confirm in writing before the call, for example by replying to the invitation.

Article 17 requires telling the candidate, when you collect the data, your full name and field of activity, the purposes, the recipients or their categories, whether answering is mandatory or optional and the consequences of not answering, and the right to see and correct the data. Article 3 requires the data to be "adequate, relevant and not excessive" and not kept in identifiable form once the purpose is achieved.

Can an agency send the recording to its client?

Only with the candidate's consent. Article 9(1) says "the Data Controller must not disclose any personal data without the data subject's consent or in execution of a judicial order issued by a competent court, Public Prosecution, investigation judge or Military Prosecution." An agency that plans to share a recording, a transcript or quotes with a client should name the client, or at least the category of client, in the consent request. For vendors such as a transcription or note-taking service, Article 8(3) requires a processor with sufficient safeguards and "a written contract" under which it acts only on your instructions and meets equivalent security and confidentiality duties. Sending the client a written summary with the candidate's key quotes, rather than the audio, keeps the disclosure smaller.

What about health, religion and criminal records?

Article 1 defines sensitive personal data as information revealing "race, ethnical origin, political or philosophical opinions, religious beliefs, affiliation to union, personal criminal record, or any information in relation to his health or sexual status." Article 5 prohibits processing it without consent, subject to exceptions; the employment exception covers obligations "with respect to those working under his authority in the course of employment," which a candidate is not yet. Article 7 separately prohibits processing data on criminal proceedings and judgments outside listed cases. Do not ask about these subjects, keep anything volunteered out of notes and scorecards, and delete audio that captured them early. Article 15 also requires the Authority's prior written authorization for automatic processing of "biometric data necessary for the verification of an individual's identity," which matters if a tool matches faces or voiceprints to identity documents.

Do you need to notify the Personal Data Protection Authority?

Possibly. Article 14(1) requires the data controller to "give prior notice to the Authority of any wholly or partially automated processing operation." The exemptions include an "employer processing data in relation to his employees' data" to the extent necessary, and controllers that have appointed a data protection guardian. Candidates are not employees, so check whether your recruitment processing needs a notification. Under Order No. 44 of 2022 it is filed on the form on the Authority's website, and the Order says notification "does not waive the Data Controller's obligation to obtain the Data Subject's consent." Processing without a required notification is a crime under Article 58. According to the Authority, the Ministry of Justice, Islamic Affairs and Waqf was designated by Royal Decree No. 78 of 2019 to carry out the Authority's duties.

What if you interview a candidate in Bahrain from the US?

Article 2 applies the PDPL to every person habitually resident or with a place of business in Bahrain, and to anyone outside Bahrain who "processes data by using means situated in the Kingdom." A Bahraini client or agency in the process is covered; whether a US recruiter with no Bahraini presence is covered depends on that last test, so follow the law rather than argue about it. The Penal Code protects the candidate's side of the call, and your own state's law governs your side; see two-party consent states.

For US-hosted tools, Article 12 allows transfers to countries on the Authority's list, and the record attached to Order No. 42 of 2022 lists the United States of America alongside the United Kingdom, the EU member states, Saudi Arabia, the UAE and Kuwait, among others. Transfers to listed countries need no prior authorization; your notice, processor contract and security duties still apply.

Can candidates get the recording, and what are the penalties?

Article 18 requires the controller, on a request with proof of identity and "free of charge," to tell the candidate within 15 working days whether their data is being processed and, if so, to describe "all the data being processed," its source, the purpose and the recipients. Article 23 lets the candidate ask for unlawful or inaccurate data to be rectified, blocked or erased, with an answer within ten working days. Article 22 gives a right to ask for a decision "based solely on automated processing" that assesses "performance at work, financial standing, credit-worthiness, reliability or conduct" to be reconsidered in a way that is not solely automated. Our guide to candidate data access requests covers what to send.

The Authority may order a violation stopped and impose a daily penalty of up to BD 1,000 (BD 2,000 for a repeat within three years) and an administrative penalty of up to BD 20,000 (Article 55). Article 58 makes it a crime, punishable by up to one year in prison and/or a fine of BD 1,000 to 20,000, to process sensitive data in breach of Article 5, to transfer data in breach of Articles 12 and 13, or to process without a required notification or authorization; Article 59 doubles the fine limits for companies. Candidates may also claim compensation (Article 57).

Can you use AI note takers or transcription?

Yes, with written consent that names the tool's purpose, a written processor contract under Article 8, a check that the vendor's country is on the Order No. 42 list, and short retention. Keep a person in the hiring decision because of Article 22, and avoid voiceprint or face-matching features unless you have the Article 15 authorization. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews with candidates in Bahrain

قبل أن نبدأ: كما ورد في الدعوة التي وافقت عليها كتابياً، أودّ
[تسجيل هذه المقابلة / استخدام برنامج يحوّل المحادثة إلى نص مكتوب]
لتوثيق إجاباتك بدقة. سيُستخدم [التسجيل / النص] لهذا التوظيف فقط،
ولن يطّلع عليه إلا [العميل / مدير التوظيف]، ويُحفظ لدى [مزوّد الخدمة،
البلد]، وسيُحذف خلال [المدة] من اتخاذ القرار. هل ما زلت موافقاً؟ يمكنك
سحب موافقتك أو طلب إيقاف التسجيل في أي وقت، ولن يؤثر ذلك على طلبك.

(Before we start: as set out in the invitation you agreed to in
writing, I'd like to [record this interview / use software that turns
the conversation into text] to document your answers accurately. The
[recording / text] will be used for this recruitment only; only [the
client / the hiring manager] will see it; it is stored by [vendor,
country] and will be deleted within [period] of the decision. Do you
still agree? You can withdraw your consent or ask me to stop recording
at any time, and it won't affect your application.)

Put the full Article 17 information in the invitation and ask the candidate to reply "I agree" before the call, so the written consent comes first. More wording is in the interview recording consent script.

Checklist before you record interviews in Bahrain

• Written consent received before the call; spoken confirmation at the start; withdrawal honored.
• Article 17 information in the invitation, including every client or vendor who receives the recording.
• No questions on health, religion, ethnicity or criminal records; volunteered details kept out of notes.
• Need for an Article 14 notification checked, or a data protection guardian appointed.
• Written processor contracts; vendor countries checked against the Order No. 42 list.
• No biometric identity matching without Article 15 authorization; a person makes the hiring decision.
• Access requests answered within 15 working days; recordings deleted once the purpose is achieved.