Recording job interviews in Colombia: prior authorization under Law 1581, Article 192 and the SIC

Recording a job interview with a candidate in Colombia requires the candidate's prior authorization in practice. Colombia's data protection law, Statutory Law 1581 of 2012, makes "prior, express and informed" authorization the default for any processing of personal data, it has no general legitimate-interest alternative, and none of its exceptions covers recruiting; the authorization can be spoken, but you must be able to prove it. The Penal Code's offense of unlawful interception (Article 192) is aimed at people who intercept communications addressed to someone else, and the regulator is the Superintendence of Industry and Commerce (SIC). This is the position as of November 2026.

This page adds Colombia to our country series alongside Mexico, Brazil and Singapore. It is for US and Colombian recruiters, nearshore staffing teams and hiring managers who interview candidates located in Colombia by video or phone. Quotations from Colombian sources are our translations from Spanish.

Colombia's rules at a glance

Is it a crime to record a job interview in Colombia?

Article 15 of the Constitution says: "Correspondence and other forms of private communication are inviolable. They may be intercepted or recorded only by court order, in the cases and with the formalities established by law." The same article is the root of Colombia's data protection law.

The criminal rule is narrower. Article 192 of the Penal Code (Law 599 of 2000) punishes anyone who "unlawfully removes, hides, misplaces, destroys, intercepts, controls or prevents a private communication addressed to another person, or improperly learns its content," with 16 to 54 months in prison, rising to 32 to 72 months if the offender reveals the content or uses it for their own or another's benefit or to someone's harm. A candidate's answers are addressed to the interviewer, so on its wording the offense targets eavesdroppers rather than a participant. A note-taking bot that joins a call unannounced is closer to what it describes.

The Constitutional Court has treated secret recordings mainly as a question of evidence: in judgment SU-371 of 2021 it reviewed when a recording made without the consent of the person recorded can be used in criminal and disciplinary cases. That is not permission to record interviews without asking, and the data protection rules below apply regardless.

Why Colombia needs the candidate's authorization

A recording or transcript of an interview is personal data under Law 1581 of 2012, and the law's principle of freedom (Article 4(c)) says processing "may only be carried out with the prior, express and informed consent of the data subject." Article 9 requires that authorization to be obtained "by any means that can be consulted later." Article 10 lists the only cases where it is not needed: requests by a public body or a court, public data, medical emergencies, historical, statistical or scientific purposes, and civil registry data. Hiring is not on the list. That is the key difference from Singapore, which allows collection without consent for an "evaluative purpose," and from the GDPR's legitimate-interest basis. Decree 1377 of 2013, which regulates the law, says how to ask:

• When: request authorization "no later than at the time of collection," and tell the person the data you will collect and "all the specific purposes" (Article 5).
• How: authorization is valid when expressed "(i) in writing, (ii) orally or (iii) through unequivocal conduct" from which it can reasonably be concluded that it was given; "in no case may silence be equated with unequivocal conduct" (Article 7).
• Proof: controllers "must keep proof of the authorization" (Article 8). A spoken yes captured at the start of the recording, plus a note in your system, does that.
• No tricks: "No deceptive or fraudulent means may be used to collect and process personal data" (Article 4). A hidden recording fails this test on its face.

What must you tell the candidate before you record?

Article 12 of Law 1581 requires the controller, when it asks for authorization, to inform the person "clearly and expressly" of: the processing their data will undergo and its purpose; that answering questions about sensitive data is optional; their rights as data subject; and the controller's identification, physical or electronic address and telephone number, and keep proof that you did. Decree 1377 adds the privacy notice (aviso de privacidad), a "verbal or written communication" pointing to your data processing policy (Articles 3, 14 and 15). A short spoken notice, with a link to the written policy in the invitation, covers both.

Sensitive data (Article 5 lists, among others, ethnic origin, political views, religious beliefs, union membership, health, sex life and biometric data) needs more: Article 6 of the decree says "no activity may be conditioned on the data subject providing sensitive personal data." Keep interviews away from these topics, and if a candidate raises a health matter, leave it out of your notes.

What does the SIC say about recording and AI?

The SIC has not, as far as we found, published guidance specifically on recorded job interviews. Its guide to personal data in video surveillance systems (2016), written for cameras in workplaces and other spaces, makes two points that carry over: "Where audio is also recorded, the data subjects must also be informed of that," and data collected "must be kept only for as long as necessary, according to the specific purpose set by the controller, after which it must be deleted."

On AI, External Circular 002 of August 21, 2024, "Guidelines on the processing of personal data in artificial intelligence systems," says Colombia's data protection laws are technology-neutral and apply to AI. It asks organizations to weigh suitability, necessity, reasonableness and strict proportionality, and to document a privacy impact assessment where an AI product is likely to carry a high risk to people. For a tool that only transcribes, that is a short exercise; for one that scores or ranks candidates, write it down.

Can candidates ask for the recording, and how fast must you answer?

Yes. Article 8 gives candidates the right to know, update and correct their data, to ask for proof of the authorization, to be told how their data has been used, and to "access free of charge" their processed data. Article 14 requires an answer to a request to consult within "ten (10) business days," with five more if you explain the delay. A complaint asking for correction or deletion (Article 15) must be decided within fifteen business days, extendable by eight, and a candidate can revoke the authorization the same way (Decree 1377, Article 9). Our candidate data access requests guide has a workflow.

How long can you keep interview recordings?

No fixed period applies to recruiting. Article 11 of Decree 1377 says data may be collected, stored and used "only during the time that is reasonable and necessary, according to the purposes that justified the processing," and once those purposes are met the data must be deleted, unless a legal or contractual obligation requires keeping it. Set a period tied to the hiring decision, write it in your policy and delete on schedule. Keeping recordings for a talent pool is a new purpose that needs its own authorization (Decree 1377, Article 5). Our retention policy template gives the structure.

What if the interviewer, the client or the tool is in the US?

Article 26 of Law 1581 prohibits transfers of personal data to countries that do not provide an adequate level of protection, as judged by the SIC's standards. The SIC's list, in numeral 3.2 of Title V of its Circular Única, includes the United States, Mexico, Peru, the UK, Japan and EU countries, among others. A draft resolution published on May 26, 2026 would add Brazil, Ecuador, Kenya, Panama and South Africa and keeps the United States; as of November 2026 it is a draft. Being on the list does not end your duties: the Circular Única says controllers must still be able to show they protect the data transferred.

The decree separates two kinds of sharing. A transmission goes to a processor (encargado) working for you, such as a transcription vendor; an international transmission needs neither notice nor consent when a contract sets the scope and the vendor's security and confidentiality duties (Decree 1377, Articles 24 and 25). A transfer goes to a recipient that is itself a controller, such as a client receiving a submittal. Name client sharing in your notice and ask; see can recruiters share interview recordings with clients. If you interview from the US, your own state's law governs your side of the call; see two-party consent states.

Can you use AI note takers for interviews in Colombia?

Yes, with authorization that names the tool's role, a processor contract, and the SIC's AI circular in mind. Ask the vendor whether it keeps audio, where it processes data, and whether it uses your interviews to train its models; that last use is a purpose the candidate must be told about. Interview Signal, for example, captures audio from the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and sends audio to a speech-to-text provider in short chunks that are not retained; the transcript stays on the interviewer's computer and is still personal data under Law 1581. For general vendor questions, see is it legal to use AI note takers in interviews.

A consent line for interviews in Colombia

"Antes de empezar: en [Empresa] quisiéramos grabar y transcribir esta
entrevista para tener un registro preciso de sus respuestas y evaluar
su candidatura para este cargo. Solo la usaremos para este proceso de
selección [y la compartiremos con (cliente)], y la eliminaremos [plazo]
después de la decisión. Usted puede conocer, actualizar, rectificar y
pedir la supresión de sus datos escribiendo a [correo] o llamando al
[teléfono]; nuestra política de tratamiento está en [enlace]. ¿Nos
autoriza a grabar? Puede decir que no o pedirme que pare en cualquier
momento; no afectará su candidatura."

("Before we start: at [Company] we would like to record and transcribe
this interview to keep an accurate record of your answers and assess
your application for this role. We'll use it only for this selection
process [and share it with (client)], and delete it [period] after the
decision. You can access, update, correct and ask us to delete your
data by writing to [email] or calling [phone]; our data processing
policy is at [link]. Do you authorize us to record? You can say no or
ask me to stop at any time; it won't affect your application.")

The line covers the purpose, rights and contact details that Article 12 of Law 1581 requires, and recording the answer gives you the proof Article 8 of Decree 1377 asks for. More wording is in the interview recording consent script.

Checklist before you record interviews in Colombia

• Written data processing policy published, with a privacy notice linked in the interview invitation.
• Authorization asked before recording starts, covering each purpose; proof kept; silence never treated as a yes.
• Separate authorization for client sharing, talent pools or vendor model training.
• Sensitive topics kept out of interviews and notes; no activity conditioned on sensitive data.
• Transmission contract with any transcription or AI vendor; check the SIC's adequate-country list for transfers.
• Privacy impact assessment documented for any tool that scores or ranks candidates.
• Process to answer consultations within 10 business days and complaints within 15; retention period set.

Also hiring in Latin America? See Chile, Argentina, Mexico and Brazil.