Recording job interviews in Iceland: the call-recording notice rule, Act No. 90/2018 and Persónuvernd's guidance on AI note takers

Recording a job interview with a candidate in Iceland requires telling the candidate at the start of the call: Persónuvernd, the data protection authority, says the other party must be notified of a recorded call at its beginning unless they are without doubt already aware, and that saying a call "may be recorded" might not be fair or transparent enough. The GDPR applies through the EEA Agreement and Act No. 90/2018, and Persónuvernd has published guidance on recruitment and on AI note takers that sets out what to settle before you press record. This is the position as of November 2026.

This page adds Iceland to our country series alongside Norway, Denmark and Finland. It is for recruiters, agency consultants and hiring managers who interview candidates located in Iceland by video or phone, including from the US. Quotations from Persónuvernd's Icelandic pages are our translations; the Act and the Constitution are quoted from the government's English translations.

Iceland's rules at a glance

Is it legal to record a job interview in Iceland?

Yes, if you tell the candidate at the start. Persónuvernd's page on audio recordings states the rule for telephone calls in three lines: "The other party must be notified of the recording of a telephone call at its beginning. There is no need to give notice of recording when the other party is without doubt aware of the recording. Public authorities do not need to give notice when recording is a normal part of their activities and necessary for national and public security." It then adds a point that matters for scripts: when the other party is told, the person recording "must consider the duty to inform under data protection law. Wording such as that a call may be recorded might therefore not be compatible with data protection law on fairness and transparency."

For a recruiter, that means a definite statement ("I am recording this call") at the beginning, not a vague warning, followed by the information the GDPR requires. The same page says that, as a general rule, "individuals may not record the conversations of other individuals," that "those who can be heard on the recording must give their consent," and that there must be "a specific, objective need" for monitoring. Behind these rules, Article 71 of the Constitution provides that "everyone shall enjoy freedom from interference with privacy, home, and family life," and that examining "communications by telephone and other means" requires a judicial decision or a statutory provision.

Which data protection law applies, given Iceland is not in the EU?

The GDPR, through the EEA. Act No. 90/2018 on Data Protection and the Processing of Personal Data, in force since July 15, 2018, implements the regulation, and Article 1 makes Persónuvernd the authority that monitors it. Article 7 sets the geographical scope: the Act and the GDPR apply to controllers or processors established in Iceland, wherever the processing happens, and to the processing of "personal data of data subjects in Iceland" by controllers not established in the EEA when it relates to offering goods or services to them or monitoring their behavior. The usual GDPR duties follow: a lawful basis under Article 6, the Article 13 information when the recording starts, data minimization, a retention limit and the candidate's rights. For the basis, see legitimate interest in recruitment.

Two provisions of the Act are worth knowing. Article 12 says private bodies "are not authorised to process data on criminal offences unless the data subject has given his or her explicit consent or the processing is necessary for legitimate interests that evidently override the fundamental rights and freedoms of the data subject." Article 14 sets conditions for "electronic surveillance," which Article 3 defines as surveillance that is "continuous or repeated on a regular basis." A single interview recording is unlikely to fit that definition, but systematically recording your own recruiters' calls may, and then the Article 14 conditions and Persónuvernd's rules on monitoring apply.

What does Persónuvernd say about recruitment?

Persónuvernd's page on recruitment and employment contracts says the purpose of collecting information "must be clear and follow the basic principles of data protection law," and that the information requested should be relevant and "not more than necessary." It then gives specific rules a recruiter can apply on the call:

• References. It is normal for a prospective employer to seek information from a former or current employer, "but the person must agree to it," and has the right to know whether neutral facts (dates, tasks) or subjective views (social skills, workplace communication) are being sought.
• Criminal records. A criminal record certificate "may be justified" for work with children or at a financial undertaking; necessity must be assessed case by case, and explicit consent is needed.
• Online and social media information. A prospective employer may collect public information about a candidate, but the processing must serve a specific purpose, the information must be verified, and the candidate must be told.
• Sensitive information. Candidates "should not have to provide" sensitive personal data, and the employer is usually not permitted to process it without a special exemption.

On a recorded call, those rules translate into a short script: say the call is being recorded, say whether you will contact referees, and steer away from health, religion, union membership and similar topics. If a candidate volunteers such details, keep them out of the notes and the scorecard.

How long can you keep recordings and transcripts?

We found no Icelandic rule that fixes a period for candidate recordings, so the GDPR's storage-limitation principle governs. Persónuvernd's note-taker guidance gives the practical test: if the purpose is only to produce notes, consider whether there is any reason to keep the audio once the notes have been reviewed, because personal data "should generally not be kept longer than necessary" for the purpose of collection. Set a period tied to the hiring decision and any dispute window, keep written notes longer than audio if you need a record, and delete on schedule. Our retention policy template gives the structure.

Can candidates get the recording?

Yes. Under Article 15 GDPR the candidate can ask for a copy of their personal data, including a recording or transcript, and Article 12(3) requires an answer within one month, extendable only where the GDPR allows. Where the recording includes other people, such as a second interviewer, consider whether their parts need to be removed first. Our candidate data access requests guide has a workflow.

What if you interview a candidate in Iceland from the US?

A company established in Iceland or elsewhere in the EEA is covered whatever the processing location; a US company with no EEA establishment is covered only in the cases Article 7 of the Act and Article 3(2) GDPR describe. Give the start-of-call notice either way, and remember that your own state's law governs your side of the call; see two-party consent states. For vendors, Persónuvernd's page on transfers explains that the EU's adequacy decision based on the EU-US Data Privacy Framework covers transfers from the EEA to US companies that have formally signed up and appear on the Commerce Department's list, that you must check whether the recipient is an active participant and whether its certification covers the data, and that otherwise another transfer basis, such as standard contractual clauses, is needed.

Can you use AI note takers or transcription?

Yes, after the checks in Persónuvernd's guidance on AI note takers. It describes the tools as a separate meeting guest that joins a remote meeting in Teams, Zoom or another system, "a small recording device lying on the table," or an app on a phone or computer, and treats all three alike. Its main points:

• Text is still personal data. "It does not change the nature of the processing even if the recording is soon converted to text or an automatic summary is created. The personal data remains, in a new form."
• A name in the participant list is not notice. "The mere fact that an unfamiliar name or icon appears in the participant list does not necessarily tell meeting guests what is being done with their information."
• Settle it before you start. Before recording or transcription begins, the purpose and legal basis must be clear, and participants must be told who is responsible, what happens to the data, how long it is kept and whether it is shared with others or outside the EEA. Consent is possible but not the only basis; if used, it must be freely given, informed and unambiguous.
• Check training use. Do not assume a vendor trains on meeting data, "but do not assume it is ruled out either"; check terms, settings and contracts.
• Review the output. An AI summary "should not be equated with minutes that have been approved by the participants," so review it before it is saved in a case or personnel file or used as the basis for decisions.

Its closing checklist asks, among other things, whether a less intrusive method would do, whether audio is needed at all, and "has it been decided how to respond if a participant does not want to be recorded?" For candidates, the answer should be a note-taking fallback that costs them nothing. See also whether AI note takers train on interview recordings. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews in Iceland

Áður en við byrjum: mig langar að [taka samtalið upp / nota forrit
sem breytir samtalinu í texta] svo ég nái svörum þínum nákvæmlega.
Við notum [upptökuna / textann] aðeins í þessu ráðningarferli,
deilum [henni / honum] aðeins með [viðskiptavini okkar /
ráðningarstjóranum] og eyðum [henni / honum] [tímabil] eftir að
ferlinu lýkur. Er það í lagi? Þú mátt neita eða biðja mig um að
stöðva upptökuna hvenær sem er, og það hefur engin áhrif á umsókn
þína.

(Before we start: I'd like to [record the conversation / use software
that turns the conversation into text] so I capture your answers
accurately. We'll use the [recording / text] only in this hiring
process, share it only with [our client / the hiring manager] and
delete it [period] after the process ends. Is that all right? You can
say no or ask me to stop the recording at any time, and it won't
affect your application.)

The line says "I'd like to record," not "this call may be recorded," which is the wording Persónuvernd warns about. Put the same information, with the Article 13 details, in the invitation and your candidate privacy notice. More wording is in the interview recording consent script.

Checklist before you record interviews in Iceland

• Recording announced plainly at the beginning of the call, and the candidate's answer noted.
• Article 6 basis documented; Article 13 notice in the invitation, naming any client who receives the recording.
• Candidate told before referees are contacted; criminal record checks only where justified, with explicit consent.
• No questions on health, religion, union membership or other sensitive topics; volunteered details left out of notes.
• Audio deleted once notes are reviewed; transcript retention set and followed.
• Note-taker vendor checked for storage location, training use and EEA transfers; AI summaries reviewed before use.
• US vendors active on the Data Privacy Framework list for the data concerned, or covered by standard clauses.

Interviewing elsewhere in the Nordics? Compare Norway, Denmark and Sweden.