Recording job interviews in Hong Kong: the PDPO, the PCPD's HR code and candidate access

Hong Kong has no law that we found making it an offence for a participant to record their own job interview; the interception statute regulates law enforcement agencies. What governs the recording is the Personal Data (Privacy) Ordinance (PDPO, Cap. 486): you must collect the candidate's data by lawful and fair means, tell them the purpose and who may receive it on or before collection, keep it no longer than necessary, and give them access on request. The Privacy Commissioner's (PCPD) Code of Practice on Human Resource Management adds a two-year limit for keeping rejected applicants' data. As of October 2026, tell candidates you are recording, say why, and delete on a set schedule.

This page adds Hong Kong to our country series alongside Singapore, Japan and India. It is for recruiters, agency consultants and hiring managers who interview candidates in Hong Kong by phone or video, including from the US.

Hong Kong's rules at a glance

Is it legal to record a job interview in Hong Kong?

Yes, if you handle the personal data in it as the PDPO requires. The Interception of Communications and Surveillance Ordinance, according to the Commissioner that oversees it, "provides a statutory regime for the authorisation and regulation of interception of communications and covert surveillance conducted by law enforcement agencies." We found no Hong Kong statute that requires every party's consent before a participant records a private call, unlike the all-party rules in several Australian states.

The PDPO fills the gap. The PCPD's summary of the Ordinance explains that personal data "means information which relates to a living individual and can be used to identify that individual," and a recorded interview or a transcript filed under a candidate's name plainly is. Data Protection Principle 1(2) requires that personal data be collected "by means which are (a) lawful; and (b) fair in the circumstances of the case." A recording made without the candidate's knowledge is hard to call fair, so the first step is to tell them.

What must you tell the candidate?

DPP1(3), as reproduced in the appendix to the PCPD's Code of Practice on Human Resource Management, requires all practicable steps to ensure the candidate is told:

• on or before collection, whether supplying the data is obligatory or voluntary, and the consequences of refusing if it is obligatory;
• on or before collection, "the purpose (in general or specific terms) for which the data is to be used" and "the classes of persons to whom the data may be transferred," such as a client or a transcription vendor;
• on or before first use, their rights to request access to and correction of the data, and "the name or job title, and address, of the individual who is to handle any such request."

The Code, issued under section 12 of the PDPO, applies the same rule to recruitment: data collected from applicants must be "adequate but not excessive in relation to the purpose of recruitment," and paragraph 2.7.1 lists the selection interview among techniques that collect additional personal data, which must still not be excessive. DPP3 then bars using the recording for a new purpose, such as a talent pool or training a model, without the candidate's "express and voluntary consent," as the PCPD puts it.

How long can you keep interview recordings?

DPP2, as the PCPD summarizes it, requires that personal data "is not kept longer than is necessary for the fulfillment of the purpose for which the data is used," and section 26 requires erasure once data is no longer required; the PCPD notes that breaching section 26 is an offence with a fine of up to HK$10,000. For applicants, the Code is specific. Paragraph 2.10.1 says an employer that keeps unsuccessful applicants' data for future recruitment "should not retain such data for a period longer than two years from the date of rejecting the applicant" unless there is a subsisting reason that obliges it to keep the data longer, or the applicant has given prescribed consent. The Code's notes point to the four anti-discrimination ordinances, which allow a claim to the District Court within two years of the act complained of.

Two years is a ceiling, not a target. A recording is more intrusive than a CV, and most hiring decisions do not need the audio once written notes and scores exist. As good practice, the Code suggests telling candidates how long you normally keep their data and offering them the chance to ask for its destruction. Our retention policy template gives the structure.

Can candidates ask for the recording or the interviewers' notes?

Yes. Paragraph 2.11.1 of the Code says personal data collected from applicants and "other data compiled about applicants in the course of a recruitment selection process" are subject to access and correction. Section 19 requires a data user to comply with a data access request "within 40 days after receiving the request." Section 55 exempts data that is the subject of a "relevant process" from access until the process is complete, but the PCPD explains that "a recruitment process falls outside the meaning of a 'relevant process'" if no appeal may be made against the decision, "as most recruitment processes probably are," and that once the decision is made the employer "should comply with the request." Before you send a copy, remove other individuals' personal data unless they consent. Our candidate data access requests guide has a workflow.

What about agencies, clients and vendors?

Under paragraph 2.4.1 of the Code, an employer that engages an employment agency to solicit applicants' data "thereby collects personal data of those applicants," so the employer's notice duties apply, and under paragraph 2.4.3 it must take all practicable steps to ensure its agent does not breach the Ordinance. Section 65 makes a principal liable for acts done by an agent with its authority. For processors such as a transcription service, DPP2(3) and DPP4(2) require the data user, where it engages a processor "whether within or outside Hong Kong," to adopt contractual or other means to prevent the data being kept longer than necessary and to prevent unauthorized or accidental access, loss or use. If you interview from the US, your own state's recording law also covers your side of the call; see two-party consent states.

What does the PCPD say about AI and monitoring?

Writing in September 2025, the Privacy Commissioner said that "while there is no overarching legislation on AI at present," data protection laws "still apply in the context of AI insofar as the collection, processing and use of personal data is concerned" (PCPD). The PCPD's AI privacy page lists its Artificial Intelligence: Model Personal Data Protection Framework (2024) and a Checklist on Guidelines for the Use of Generative AI by Employees (2025), and its guidance list includes Privacy Guidelines: Monitoring and Personal Data Privacy at Work (revised April 2016) for monitoring employees, such as interviewers whose calls a tool records.

For an AI note taker, ask where audio is processed, whether it is kept, and whether the vendor trains models on it, and put the vendor in your list of transferees. Interview Signal, for example, runs on the interviewer's own computer with no bot in the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the PDPO. See also is it legal to use AI note takers in interviews.

A consent line for interviews in Hong Kong

"Before we start: to record your answers accurately, I'd like to record
this interview [and transcribe it with software]. The recording is used
only for this recruitment, shared only with [client / transcription
provider], and deleted [period] after the decision. Is that all right?
You can say no or ask me to stop at any time; it won't affect your
application. To access or correct your data, contact [name or title,
address]."

在開始之前，想先徵求你的同意：為準確記錄你的回答，我們希望為這次面試
錄音［並以軟件轉錄為文字］。錄音只會用於這次招聘，只會提供予［客戶／
轉錄服務供應商］，並會在作出決定後［期限］內刪除。你是否同意？你可以
拒絕或隨時要求停止，這不會影響你的申請。如欲查閱或更正你的個人資料，
請聯絡［姓名或職位及地址］。

The last sentence covers the DPP1(3) access notice. Put the same points in your written Personal Information Collection Statement. More wording is in the interview recording consent script.

Checklist before you record interviews in Hong Kong

• Candidate told the purpose and the classes of recipients before recording starts.
• Access and correction contact given before first use.
• Questions and recording limited to what the hiring decision needs.
• No new use, such as a talent pool or model training, without express and voluntary consent.
• Rejected applicants' recordings deleted well within two years of rejection.
• Access requests answered within 40 days, with other people's data removed.
• Contracts with agencies and vendors covering retention and security.