Recording job interviews in Malaysia: PDPA consent, the bilingual notice rule and the 2024 amendments

In Malaysia, the rules that govern recording a job interview are mainly in the Personal Data Protection Act 2010 (PDPA), which makes the candidate's consent the general rule for processing personal data and lists "recording" as processing. The Act requires a written notice in both Malay and English, and a breach of its principles can bring a fine of up to RM1 million, up to three years in prison, or both. The Communications and Multimedia Act 1998 separately forbids intercepting communications without lawful authority. As of November 2026, the workable practice is to send a bilingual notice, ask before you record, and keep the recording only as long as the hiring decision needs it.

This page adds Malaysia to our country series alongside Singapore, the Philippines and India. It is for recruiters, employment agencies and hiring managers who interview candidates located in Malaysia by video or phone, including from the US.

Malaysia's rules at a glance

Is it legal to record a job interview in Malaysia?

Yes, if you handle the recording the way the PDPA requires. The Act applies to anyone who processes personal data, or controls or authorizes its processing, "in respect of commercial transactions," a term it defines as "any transaction of a commercial nature, whether contractual or not." "Processing" means "collecting, recording, holding or storing" personal data or doing anything else with it, and personal data includes "expression of opinion about the data subject," so the recording, the transcript and the interviewer's ratings are all covered. The Act does not say in terms whether hiring is a commercial transaction, and we found no department guidance on that point; an employment agency, whose business is placing candidates, is the clearest case, and most employers treat candidate data as covered.

The criminal rule sits in the Communications and Multimedia Act 1998. Section 234 makes it an offense for a person who, "without lawful authority under this Act or any other written law," intercepts any communications, or discloses or uses contents knowing they were obtained by unlawful interception. The Act defines "intercept" broadly, as "the aural or other acquisition of the contents of any communications through the use of any electronic, mechanical, or other equipment, device or apparatus," and its text contains no express carve-out for a participant. We found no Malaysian statute that expressly permits a participant to record a call without the other party's agreement, which is one more reason to ask. The Act was amended in 2025 (Act A1743); check the current text before relying on its penalties.

Do you need consent, or does an exception apply?

Section 6 of the PDPA says a data controller shall not process personal data "unless the data subject has given his consent," then lets it process without consent where processing is necessary for a contract, "for the taking of steps at the request of the data subject with a view to entering into a contract," for a legal obligation, vital interests, the administration of justice or a function conferred by law. Section 6(3) adds that the data must be processed for a lawful purpose "directly related to an activity of the data controller" and be "adequate but not excessive."

This looks like Singapore's evaluative-purpose exception, but it is narrower: it turns on necessity. Notes of an interview a candidate applied for are easy to justify; a full audio recording and an AI transcript are harder to call necessary when written notes would do. Asking is simpler, and a candidate can withdraw consent "by notice in writing," after which you must stop processing (section 38). Sensitive personal data, which includes health, political opinions, religious beliefs, alleged offenses and "biometric data," needs "explicit consent" unless a listed exception applies (section 40). Keep interviews away from those topics, and treat any voiceprint or speaker identification feature as a possible source of biometric data.

What must the written notice say, and in which languages?

Section 7 requires a data controller to inform the candidate "by written notice" that their data is being processed, with a description of it; the purposes; the source of the data; their right to request access and correction and how to contact you; "the class of third parties" to whom you may disclose it; the choices offered to limit processing; whether supplying the data is obligatory or voluntary; and the consequences of not supplying it where it is obligatory. The notice is due "as soon as practicable," when you first ask for or collect the data, and before using it for a new purpose or disclosing it to a third party.

Section 7(3) is the Malaysia-specific point: the notice "shall be in the national and English languages," and the person must be given a clear means to exercise their choice in both. A recruiter who sends a candidate privacy notice in English only does not meet it. Send the bilingual notice with the interview invitation, and use the spoken line below to confirm. Disclosure to anyone outside the classes named in the notice, such as a client who was not listed, needs consent (section 8).

Can candidates ask for the recording or the transcript?

Yes. Under section 30 a person may, "upon payment of a prescribed fee," make a written data access request for their personal data and a copy "in an intelligible form." Section 31 requires compliance "not later than twenty-one days" from receipt; if you cannot, you must say so in writing before the deadline, give your reasons, provide what you can, and comply in full within fourteen more days. Section 32 lists the grounds to refuse, including where complying would disclose personal data of another identifiable person who has not consented, unless disclosure is reasonable. Unlike Singapore, it has no general exception for evaluative opinions, so plan on the interviewer's ratings being within reach of a request. The 2024 amendments also added a right to data portability (section 43A). Our candidate data access requests guide has a workflow.

How long can you keep interview recordings?

Section 10 says personal data "shall not be kept longer than is necessary for the fulfilment of that purpose," and the data controller must take "all reasonable steps" to destroy or permanently delete it once it is no longer required. Set a short period tied to the hiring decision, document it, and delete on schedule. Our retention policy template gives the structure.

What do the 2024 amendments change for recruiters?

The Personal Data Protection (Amendment) Act 2024 (Act A1727) came into operation in stages on January 1, April 1 and June 1, 2025, according to the reprint. For a recruiting team, the parts that matter are:

• Processors now carry duties. A data processor, such as a transcription or AI note-taking vendor, must comply with the Security Principle and give "sufficient guarantees" about its technical and organizational measures (sections 5(1a) and 9(2)).
• Data protection officers. Data controllers and processors must appoint one or more DPOs and notify the Commissioner (section 12A).
• Breach notification. Notify the Commissioner "as soon as practicable" after a breach, and the person "without unnecessary delay" where it is likely to cause significant harm (section 12B).
• Penalties. Up to RM1,000,000, three years in prison, or both, for breaching the principles (section 5(2)).

Agencies have one more step. The department's registration page says classes listed in the Personal Data Protection (Class of Data Users) Order 2013 must register, and the Order includes companies and partnerships carrying on "the business of a private employment agency under the Private Employment Agencies Act 1981." The department states that failing to register can mean a fine of up to RM500,000, up to three years in prison, or both.

What if the interviewer or the tool is outside Malaysia?

Section 2(2) applies the Act to a person established in Malaysia, whether or not the data is processed in that context, and to a person not established in Malaysia who "uses equipment in Malaysia for processing" other than for transit; such a person must nominate a representative in Malaysia. A Malaysian employer, agency or subsidiary is covered wherever its tools run. For a US company with no Malaysian presence, coverage is less certain, but the candidate's expectations and your own state's law still apply; see two-party consent states.

The 2024 amendments deleted the Minister's whitelist of countries. Under section 129 as amended, a data controller may transfer personal data abroad if the destination has a law "substantially similar" to the Act or ensures protection "at least equivalent" to it, or if an exception applies, including the person's consent, a contract with the person or one entered into at their request, and the controller having "taken all reasonable precautions and exercised all due diligence." In a FAQ answer about a cloud service, the department said "consent for the transfer of personal data abroad must also be obtained by the data controller." Naming the tool's location in your notice and asking covers both routes.

Can you use AI note takers for interviews in Malaysia?

Yes, with a bilingual notice that names the tool's role, consent, and a vendor that can give the security guarantees section 9 now requires. The department ran a consultation from October 5 to 23, 2026 on a proposed AI and Personal Data Protection Framework that would clarify the obligations of controllers and processors using AI systems, including off-the-shelf and SaaS tools; as of November 2026 it is a proposal. Interview Signal, for example, captures audio from the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and sends audio to a speech-to-text provider in short chunks that are not retained; the transcript stays on the interviewer's computer and is still personal data. See is it legal to use AI note takers in interviews.

A consent line for interviews in Malaysia

"Sebelum kita mula: [Syarikat] ingin merakam dan membuat transkrip
temu duga ini supaya jawapan anda direkodkan dengan tepat untuk
menilai permohonan anda. Rakaman ini hanya digunakan untuk proses
pemilihan ini [dan akan dikongsi dengan (pelanggan)], dan akan
dipadam [tempoh] selepas keputusan dibuat. Notis privasi kami dalam
Bahasa Melayu dan Bahasa Inggeris ada di [pautan]. Adakah anda
bersetuju? Anda boleh menolak atau meminta saya berhenti pada
bila-bila masa; ini tidak akan menjejaskan permohonan anda."

("Before we start: [Company] would like to record and transcribe this
interview so your answers are captured accurately to assess your
application. The recording is used only for this selection process
[and will be shared with (client)], and deleted [period] after the
decision. Our privacy notice in Malay and English is at [link]. Do
you agree? You can say no or ask me to stop at any time; it won't
affect your application.")

The spoken line confirms consent; the written bilingual notice is what section 7 requires. More wording is in the interview recording consent script.

Checklist before you record interviews in Malaysia

• Written privacy notice in Malay and English, with the section 7 items, sent before the interview.
• Consent asked and noted before recording starts; withdrawal honored.
• Client sharing named as a class of third parties in the notice.
• Sensitive topics kept out of interviews; no voiceprint features without explicit consent.
• Registration checked if you are a private employment agency; DPO appointed and notified.
• Vendor security guarantees and a transfer basis under section 129 for any overseas tool.
• Access requests answered within 21 days; retention period set and deletion scheduled.

Also interviewing in the region? See Singapore, the Philippines, India and Saudi Arabia.