Recording job interviews in Malta: the communications consent rule, the Data Protection Act and IDPC guidance on candidates

Recording a job interview with a candidate in Malta is lawful with the candidate's agreement and a GDPR notice given before you start. Regulation 4 of the Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01) says that no person other than the user shall "listen, tap, store or undertake any other form of interception or surveillance of communications" without the consent of the user concerned, and breaches carry administrative fines of up to 23,293.73 euros per violation. The recording and the transcript are personal data under the GDPR and the Data Protection Act (Cap. 586), supervised by the Information and Data Protection Commissioner (IDPC). We found no Criminal Code offense aimed at a participant recording a conversation. This is the position as of November 2026.

This page adds Malta to our country series alongside Cyprus and Italy. It is for recruiters, agency consultants and hiring managers who interview candidates located in Malta by video or phone, including from the US. It also covers three points from the IDPC's own employment guidance that tend to surface on a recorded call: health questions, police conduct certificates and identity documents.

Malta's rules at a glance

Is it legal to record a job interview in Malta?

Yes, with the candidate's agreement. Regulation 4(1) of S.L. 586.01, which transposes the EU ePrivacy Directive, reads: "no person other than the user, shall listen, tap, store or undertake any other form of interception or surveillance of communications and of any related traffic data, without the consent of the user concerned." Regulation 13 lets the Commissioner impose an administrative fine of up to 23,293.73 euros for each violation and 2,329.37 euros for each day it persists, and regulation 11 lets anyone who suffers loss or damage from a breach sue for compensation.

Two questions are open. The regulations define a "communication" as information exchanged "between a finite number of parties by means of a publicly available electronic communications service," and the IDPC's legislation page describes S.L. 586.01 as "establishing specific rules applicable to providers operating in this field." Whether an employer recording a Teams or Zoom interview is caught, and whether a participant keeping a copy counts as storing someone else's communication, is not settled in any official guidance we found. Consent from the candidate removes both questions, so ask at the start, note the answer, and stop if the candidate says no.

Regulation 4(2) preserves "legally authorised recording of communications and the related traffic data in the course of lawful business practice for the purpose of providing evidence of a commercial transaction or of any other business communication." That exception was written for trading desks and call centers. A job interview is not obviously a business communication of that kind, so do not rely on it in place of the candidate's agreement.

Does Maltese criminal law cover recording a conversation?

Not as such. We searched the consolidated Criminal Code and found no offense of recording a private conversation that you take part in. The nearest provision is Article 337C(1)(k), which makes it an offense for a person "without authorisation" to intercept "by technical means, non-public transmissions of data, to, from or within an information system or a computer system." It targets interception by someone who is not entitled to the data. It does not make your own interview recording lawful by default: the ePrivacy consent rule above and the GDPR below still apply. Never record a call you are not part of, and never leave a recorder running in a meeting after you leave.

Which GDPR rules apply to the recording and transcript?

The Data Protection Act says in Article 2 that it "implements and further specifies" the GDPR. Article 4(2) applies it to processing "in the context of the activities of an establishment of a controller or a processor in Malta," and to processing of data subjects "who are in Malta" by a controller not established in the EU where the processing relates to offering them goods or services or monitoring their behavior in Malta, mirroring Article 3 of the GDPR.

You need an Article 6 basis for keeping the recording and transcript, usually steps taken at the candidate's request before a contract or legitimate interests (see legitimate interest in recruitment). The IDPC is skeptical of consent from candidates: in its Employment Sector FAQs it says that explicit consent "is not considered to constitute a valid legal basis in the field of employment, due to the inherent power imbalance." So ask for the candidate's agreement to the recording itself, as S.L. 586.01 requires, and document a separate GDPR basis for what you keep. Give the Article 13 information before the recording starts, keep only what the hiring decision needs, set a retention limit under Article 5(1)(e), and keep a person in the decision, because Article 22 restricts decisions based solely on automated processing.

What does the IDPC say about candidates?

The Commissioner's employment FAQs are written for employers and say several things that change how you run a recorded interview:

• Health. "Requiring prospective job candidates to undergo medical examinations / testing during the recruitment process is inherently intrusive, and does not satisfy any of the legal bases for the processing of personal data under the Regulation." Medical checks may be justified only for a chosen candidate, after the employment contract is signed, where the role requires it. Do not ask health questions on a recorded call.
• Police conduct certificates. "As a general rule, employers cannot retain police conduct certificates of employees, including prospective employees." The employer may document the confirmation of the individual's clean conduct; a paper certificate should be returned and an emailed one securely deleted. A video recording of the certificate is a copy, so do not make one.
• Retention. The IDPC sets no fixed period and says it is the controller's responsibility to ensure its retention periods "are justified and reasonable, and are not longer than what is strictly necessary."
• Voice. The FAQs note that the European Data Protection Board treats an individual's voice as biometric data, which becomes a special category under Article 9(1) GDPR when processed to identify a person uniquely. A tool that builds voiceprints to recognize speakers needs a separate look.

Can you check a candidate's ID card on a recorded call?

Be careful. Article 8 of the Data Protection Act says "an identity document shall only be processed when such processing is clearly justified having regard to the purpose of the processing" and either "the importance of a secure identification" or "any other valid reason as may be provided by law," and that the national identity number "shall be used only under appropriate safeguards." Holding an ID card up to a camera while the call is recorded puts a full image of the document into your recording and transcript store. Pause the recording, check the document, and write down only that it was checked and by whom. Right-to-work checks belong in a separate, controlled step.

What about recording your own recruiters?

Your interviewers are employees, and a recording or call analytics tool captures them too. The IDPC's monitoring FAQs say employees must be given Article 13 information that lets them "understand the purposes and extent of any monitoring," that "employees should not be informed after the monitoring has already started," and that, other than in exceptional situations, employers must rely on a legal basis other than consent. They also say any monitoring measure must be "strictly necessary and proportionate" to its purpose. Tell recruiters in writing what is recorded, why, who can play it back and when it is deleted, before you switch the tool on.

What if you interview a candidate in Malta from the US?

An employer or agency established in the EU is covered by the GDPR under Article 3(1). A US company with no EU establishment is covered only where Article 3(2), and Article 4(2)(b) of the Maltese Act, applies; take advice rather than assume either way. The S.L. 586.01 consent rule protects the candidate's side of the call, and your own state's law governs your side; see two-party consent states. A recording or transcript sent to a US vendor needs a transfer basis under Chapter V of the GDPR, such as the Commission's adequacy decision for the EU-US Data Privacy Framework (certified recipients only) or standard contractual clauses.

Can candidates get the recording, and who enforces the rules?

Candidates may ask for a copy of their data under Article 15 GDPR. Article 12(3) requires an answer "without undue delay and in any event within one month of receipt," extendable by two further months where necessary. Article 15(4) says the right to a copy "shall not adversely affect the rights and freedoms of others," so check what other interviewers said before you send one.

The IDPC handles complaints through its complaint page and imposes GDPR fines on private employers under Article 83. The Maltese Act adds lower caps for public authorities (25,000 or 50,000 euros per violation, Article 21) and makes it a criminal offense to give the Commissioner false information or ignore a lawful request in an investigation, with a fine of 1,250 to 50,000 euros, six months in prison, or both (Article 22).

Can you use AI note takers or transcription?

Yes, with the candidate's agreement, an Article 13 notice that names the tool, a processor contract under Article 28, a transfer basis for any vendor outside the EU, and short retention. Ask the vendor where it stores audio and transcripts, how long it keeps them, and whether it trains models on your interviews, which would be a new purpose. A tool that scores or ranks candidates is likely a high-risk system under the EU AI Act. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews with candidates in Malta

Before we start: I'd like to [record this interview / use software
that transcribes our conversation] so I capture your answers
accurately. The [recording / transcript] will be used only for this
recruitment, shared only with [the client / the hiring manager],
stored by [vendor, country] and deleted [period] after the decision.
Please don't show any ID documents or certificates while we're
recording; we'll check those separately. Do you agree? You can say no
or ask me to stop at any time, and it won't affect your application.

Maltese and English are both official languages under Article 5 of the Constitution, so offer the line in Maltese if the candidate prefers. Put the same details in the invitation and your candidate privacy notice so the Article 13 information comes before the call. More wording is in the interview recording consent script.

Checklist before you record interviews in Malta

• Candidate told before recording or live transcription starts, asked, and the answer noted.
• GDPR basis other than consent documented for what you keep; Article 13 notice in the invitation.
• No health questions; no recorded ID cards or police conduct certificates; checks noted, not copied.
• Only calls you take part in are recorded; nothing covert, nothing left running after you leave.
• Recruiters told in writing before their calls are recorded or analyzed.
• Processor contracts and a transfer basis for every vendor; voiceprint features reviewed.
• Access requests answered within one month; retention period set, justified and followed.