Can a recruiter share a candidate's interview recording or transcript with the client?

A recruiter can share a candidate's interview recording or transcript with a client only within what the candidate was told and agreed to before the interview. Under UK and EU GDPR the candidate must have been told the client is a recipient, the client becomes a controller of the copy it receives, and data minimization favors a written summary with the candidate's own quotes over the raw recording. In the US there is no single rule, but your notice, state privacy law and, for AI-analyzed video interviews, Illinois law all limit onward sharing. This is general information as of October 2026, not legal advice.

The existing guides cover consent to record and writing the submittal. This page covers the step in between: whether the recording or transcript itself may leave the agency, what to send instead, and the paperwork if you do send it.

What decides whether you can send the recording to a client?

Four questions, in this order. A "no" to any of the first three ends it.

1. What was the candidate told? If your consent line said the recording is "for our notes", sending it to a client is a new use. If it said "we may share the recording with the hiring company for this role", you have a starting point.
2. Does the client need the recording, or the evidence in it? Most hiring decisions need what the candidate said about the requirements, not 40 minutes of audio.
3. What does the law where the candidate is require? See the UK, EU and US sections below.
4. What do your terms allow? Your terms of business with the client, and the note-taker vendor's sharing settings, decide how it travels and how long the client keeps it.

What do UK and EU GDPR require?

The UK GDPR and EU GDPR use the same core articles here (UK GDPR; EU GDPR on EUR-Lex):

• Transparency about recipients. Article 13(1)(e) requires you to tell the candidate "the recipients or categories of recipients" when you collect the data. "Clients considering you for a role" is a category; it has to be in the notice before the interview, not added after.
• Purpose limitation. Article 5(1)(b) bars further processing that is incompatible with the purpose you collected the data for.
• Data minimization. Article 5(1)(c) requires data to be "limited to what is necessary". A recording contains far more than the client needs: tone, background, personal details mentioned in passing. That is the strongest argument for sending a summary.
• Accountability. Article 5(2) puts the burden on you to demonstrate compliance, which is why the log below matters.

Who is responsible once the client has it? The ICO's recruitment and selection guidance, which it marks as under review, says recruiters are "likely to act as controllers in most circumstances", and gives an example in which an agency shares a candidate's CV with an interested client at the candidate's request, making the agency and client joint controllers for identifying a role (ICO guidance). Whether the client is a separate controller or a joint controller with you, it decides what it does with its copy, so it carries its own duties on retention, security and access requests. Joint controllers must set out their responsibilities in an arrangement whose essence is available to the candidate (Article 26).

The wider sharing checks, including transfers when the client is outside the UK or EU, are in the GDPR checklist for recruiters.

What about candidates in the US?

• The recording must have been lawful first. Federal law makes it an offence to disclose the contents of a communication knowing it was intercepted unlawfully (18 U.S.C. § 2511(1)(c)). If a state required every party's consent and you did not get it, sending the file on compounds the problem; see two-party consent states.
• California applicants. The California Privacy Protection Agency says the CCPA covers California residents who are job applicants (CPPA FAQ). Its regulations require collection, use and sharing to be "reasonably necessary and proportionate" to the purpose and consistent with the person's reasonable expectations, judged partly by how clear your disclosures were (11 CCR § 7002). More in CCPA and job applicant data.
• Illinois, AI-analyzed video interviews. Where an employer asks applicants to record video interviews and uses AI to analyze them, the AI Video Interview Act says the employer may not share the videos "except with persons whose expertise or technology is necessary" to evaluate the applicant's fitness, and must delete them within 30 days of the applicant's request and tell everyone who received copies to delete theirs (820 ILCS 42/10; 42/15).

Elsewhere in the US, the practical limit is what you told the candidate. A candidate who agreed to "notes for this process" and later learns a client's whole hiring team watched the video has a fair complaint even where no statute applies.

What should you send the client instead?

Before sending even an excerpt, remove what should never reach a client, from pay history to health details; the list is in how to turn interview notes into a submittal.

If you do share the recording, how should you do it?

1. Ask the candidate specifically. Separate from the recording consent: "Acme has asked to hear your answer on the plant migration. Are you happy for me to send them that five-minute section? They'll delete it after their decision." Record the answer.
2. Name the recipients and the purpose. Who at the client will see it, for which role, and for how long.
3. Send a link, not a file. An attachment can be forwarded forever. Use an authenticated, expiring link where your tool allows it; Zoom, for example, lets the owner choose who can view a cloud recording, set an expiration date, and turn downloads on or off (Zoom support).
4. Switch off downloading and transcript access you do not need.
5. Tell the client the deletion date and ask for confirmation when it is done.
6. Log it, using the format below.

What should the client agreement say?

Your terms of business should cover any candidate material you send, and recordings in particular. An example to adapt with your counsel:

Candidate interview material. Any recording, transcript or excerpt
the Agency provides is supplied solely so the Client can assess the
named candidate for the named role. The Client shall not (a) share
it beyond the people involved in that decision, (b) use it to train
staff or any AI system, or analyze it with automated tools, or
(c) keep it longer than [30] days after its hiring decision, after
which it shall delete all copies and confirm deletion in writing.
The Client shall tell the Agency within [5] working days of any
access, deletion or other request from the candidate about this
material.

Add who is controller for what, as the GDPR checklist suggests, and how candidate requests are passed between you.

How should you log the disclosure?

Keep one line per disclosure, in the ATS or a shared register:

DISCLOSURE LOG
Candidate:           [name / ATS ID]
Role and client:     [role], [client]
What was shared:     [submittal / clip 12:40-17:55 / transcript / recording]
Recipients:          [names and job titles at client]
Date sent:           [date]   Method: [link, expires DATE / attachment]
Basis:               [notice version and date] + [candidate agreement, date, how]
Deletion due:        [date]   Deletion confirmed: [date, by whom]

The log answers the questions candidates and regulators ask: who has my interview, why, and until when. It also settles client disputes about what was sent and when, which is the same evidence that settles candidate ownership disputes.

Not legal advice. Check the rules for where the candidate and the client are before sharing.