Recording job interviews in Mexico: Article 16, the Penal Code and the 2025 data protection law

In Mexico, a participant's own record of a conversation is treated differently from interception: Article 16 of the Constitution makes private communications inviolable but excludes communications "voluntarily provided by one of the individuals who take part in them," while the Federal Penal Code punishes intercepting private communications without a court order with six to twelve years in prison. The bigger change for recruiters is the new Federal Law on the Protection of Personal Data Held by Private Parties, in force since March 2025, which keeps the privacy-notice and consent model and moves enforcement from the former INAI to the Secretaría Anticorrupción y Buen Gobierno. As of October 2026, give candidates a spoken privacy notice and ask before you record.

This page adds Mexico to our country series alongside Canada, Australia, Germany and the UK. It is for US and Mexican recruiters, nearshore staffing teams and hiring managers interviewing candidates located in Mexico. Quotations from Spanish sources are our translations.

Mexico's rules at a glance

Is it legal to record a job interview in Mexico?

Article 16 of the Political Constitution of the United Mexican States provides: "Private communications are inviolable. The law shall criminally punish any act that violates their freedom and privacy, except when they are voluntarily provided by one of the individuals who take part in them." The same paragraph lets a judge weigh such communications where they relate to a crime, and bars any communication that violates a legal duty of confidentiality. Only the federal judiciary can authorize interception by the authorities.

Article 177 of the Federal Penal Code punishes "whoever intercepts private communications without an order from a competent judicial authority" with six to twelve years in prison and 300 to 600 days' fine. Read with Article 16, the offence is aimed at outsiders tapping a conversation, not a participant keeping their own record. Two practical cautions follow. A note-taking bot from a third party that joins without everyone knowing is closer to the target. And state penal codes can define their own offences, so check the candidate's state if you plan anything unusual.

What does the 2025 data protection law require?

Mexico replaced its 2010 private-sector privacy law with a new Ley Federal de Protección de Datos Personales en Posesión de los Particulares, published in the Official Gazette on March 20, 2025 and in force the next day, with its latest reform published on November 14, 2025. The parts that matter for a recorded interview:

• Lawful, fair collection (Article 6). Data must not be obtained "through deceptive or fraudulent means," and the organisation must respect "the reasonable expectation of privacy." A hidden recording sits badly with both.
• Consent (Article 7). Processing needs the person's consent unless an exception applies. Consent is express when given "verbally, in writing, by electronic or optical means" or other technology, and tacit when the privacy notice was made available and the person did not object. Tacit consent is valid as a general rule, and consent can be revoked at any time.
• Sensitive data (Articles 2(VI) and 8). Data that could reveal racial or ethnic origin, present or future health, genetic information, religious, philosophical and moral beliefs, political opinions or sexual preference needs "express and written" consent by signature, electronic signature or another authentication mechanism. Keep interviews away from these topics; if a candidate raises a health matter, do not record it in your notes.
• Purpose and proportionality (Articles 11 and 12). Use is limited to the purposes in the privacy notice; a new purpose needs new consent.
• Deletion (Article 10). Data no longer needed for the purposes in the notice must be deleted, after a blocking period where applicable.

What should the privacy notice say, and how do you give it on a call?

Article 15 lists the minimum content of the aviso de privacidad: the identity and address of the organisation; the personal data processed, identifying any sensitive data; the purposes, distinguishing those that need consent; the options to limit use or disclosure; how to exercise ARCO rights (access, rectification, cancellation and objection); and how changes to the notice will be communicated.

Article 16 deals with the call itself. When personal data is obtained "by any electronic, optical, sound, visual" or other technological means, the organisation must provide the notice "in its simplified form," containing at least items I to IV of Article 15 (identity and address, data, purposes, and options to limit use), and indicate where the full notice can be consulted. A short spoken notice at the start of the interview, with a link to the full notice in the invitation, is the natural way to meet this.

Can candidates ask for the recording?

Yes. ARCO rights cover access, rectification, cancellation and objection. Article 22 gives the person the right to access their personal data held by the organisation and to know how it is processed through the privacy notice. Article 31 gives the organisation a maximum of twenty days (business days, under Article 2(VIII)) to tell the person its decision and fifteen more to carry it out, and each period can be extended once. Plan for requests for recordings, transcripts and notes; our candidate data access requests guide covers the workflow, and the retention policy template helps you decide what you will still hold.

What if the interviewer or the tool is outside Mexico?

The law separates two kinds of sharing. A persona encargada (processor) handles data on the organisation's behalf (Article 2(XII)), and a communication to it is not a "transfer," which the law defines as a communication to someone other than the person, the organisation or the processor (Article 2(XX)). A transcription or AI note-taking vendor working only for you is a processor; choose one with a contract that limits its use of the data.

A transfer to a separate third party, in Mexico or abroad, such as a client employer that receives a submittal, is governed by Articles 35 and 36. The recipient must receive the privacy notice and takes on the same obligations, and the notice must include a clause stating whether the person accepts the transfer. Article 36 lists transfers that do not need consent, including to companies in the same group and where "necessary by virtue of a contract concluded or to be concluded in the interest of the" person. For agencies, the simplest path is to name client sharing in the notice and ask. If you interview from the US, your own state's recording law also applies; see two-party consent states.

Using AI note takers for interviews in Mexico

The new law has no AI-specific article, so the general rules apply: say in the notice that software transcribes and drafts notes, keep the purpose to evaluating the candidate, and do not let the vendor use recordings for its own purposes unless the candidate agreed. Interview Signal, for example, shows a read-aloud consent line with a one-click pause and puts no bot into the call; audio goes to a speech-to-text provider in short chunks and is not retained, while the transcript stays on the interviewer's computer and remains personal data. See is it legal to use AI note takers in interviews for vendor questions.

A consent line for interviews in Mexico

"Antes de empezar: [Empresa], con domicilio en [domicilio], quisiera
grabar y transcribir esta llamada para tener un registro preciso de sus
respuestas y evaluar su candidatura para este puesto. Solo la usaremos
para este proceso de selección y la eliminaremos [plazo] después de la
decisión. Puede consultar nuestro aviso de privacidad completo en
[enlace]. ¿Está de acuerdo? Puede decir que no o pedirme que la detenga
en cualquier momento; no afectará su candidatura."

("Before we start: [Company], of [address], would like to record and
transcribe this call to keep an accurate record of your answers and
assess your application for this role. We'll use it only for this
selection process and delete it [period] after the decision. You can
read our full privacy notice at [link]. Do you agree? You can say no or
ask me to stop at any time; it won't affect your application.")

The line covers the identity and address, purpose and link to the full notice that Article 16 expects; the written notice covers the rest. More wording is in the interview recording consent script.

Checklist before you record interviews in Mexico

• Full privacy notice published, with the Article 15 items and a clause on transfers to clients.
• Simplified notice spoken at the start of the call, with a link to the full notice.
• A clear yes before recording; recording stopped if consent is revoked.
• No unannounced bots or third parties on the call.
• Sensitive topics kept out of interviews and notes.
• Processor contract with any transcription or AI vendor.
• ARCO request process able to answer within twenty business days; retention period set.

Also hiring in Latin America? See recording job interviews in Brazil.