Recording job interviews in Saudi Arabia: PDPL consent, its reach to recruiters abroad and transfer rules

Recording a job interview with a candidate in Saudi Arabia is governed mainly by the Personal Data Protection Law (PDPL), which applies to processing in the Kingdom and to processing of residents' data "from any party outside the Kingdom." Consent is the default; it can be spoken but must be documented and given separately for each purpose, and a private employer may instead rely on a legitimate interest only after a documented assessment and never for sensitive data. The Saudi Data & AI Authority (SDAIA) publishes the law's regulations, and fines reach five million riyals. As of November 2026, the practical rule is to tell the candidate, ask, record the yes, and keep the recording briefly.

This page adds Saudi Arabia to our country series alongside the United Arab Emirates, India and Singapore. It is for recruiters, agency consultants and hiring managers who interview candidates located in Saudi Arabia by video or phone, including from the US. Quotations are from the English versions of the law and regulations that SDAIA publishes.

Saudi Arabia's rules at a glance

Does the PDPL apply to a recruiter outside Saudi Arabia?

Yes, and this is the first difference from many countries in our series. Article 2 of the PDPL says the law "applies to any Processing of Personal Data related to individuals that takes place in the Kingdom by any means, including the Processing of Personal Data related to individuals residing in the Kingdom by any means from any party outside the Kingdom." The only exclusion is processing for "personal or family use." A recorded interview with a candidate in Jeddah, run from an office in Texas, is inside the law. "Processing" expressly includes "collecting, recording, saving," "storing" and "disclosing," and personal data includes "photos and videos of an individual."

Unlike the UAE, where free zones such as the DIFC have their own data protection laws (see recording job interviews in the UAE), Saudi Arabia has one national law. Your own state's recording law still governs your side of the call; see two-party consent states.

Can one participant record the interview?

Not quietly. The PDPL has no exception for a participant who records a call for work, and Article 11(2) requires that the "methods and means of Personal Data Collection" be "direct, clear and secure" and "not involve any deception, misleading or extortion." A recording the candidate does not know about fails that test. Article 5 adds that personal data may not be processed, and its purpose may not be changed, "without the consent of the Data Subject," except in the cases the law lists, and the candidate "may withdraw the consent ... at any time." This page covers data protection only; we have not summarized Saudi criminal law, so do not treat silence on it as permission.

How must consent be given and recorded?

Article 11 of the Implementing Regulation lets a controller obtain consent "in any appropriate form or means, including written or verbal consent or electronic means," on five conditions: it is "given freely and not obtained through misleading methods"; the purposes are "clear, specific" and explained before or when consent is requested; the person has full legal capacity; it is "documented through means allowing future verification, such as keeping registers recording Data Subjects' consent for Processing operations, specifying time and the mean of Consent"; and "a separate consent shall be obtained for each Processing purpose."

The last two matter for recruiters. A spoken yes captured at the start of the recording, with the date noted in your system, meets the documentation condition. Recording for assessment, sharing with a client and keeping a candidate in a talent pool are separate purposes, each needing its own yes. Consent must be "explicit" for sensitive data and "when decisions are made solely based on automated Processing." Article 7 of the law also says consent "may not form a condition of providing a service or a benefit" unless directly related, so let candidates decline without losing the interview.

Can an employer rely on legitimate interest instead?

A private employer can, but with paperwork. Article 6(4) of the PDPL allows processing without consent when "necessary for the purpose of legitimate interest of the Controller, without prejudice to the rights and interests of the Data Subject, and provided that no Sensitive Data is to be processed." Article 16 of the Implementing Regulation adds that the processing must be "within the reasonable expectations of the Data Subject," and that before relying on it the controller "shall conduct and document an assessment" covering the purpose, its legality, necessity, possible harm and the safeguards. For an interview, written notes are a natural fit; a full audio recording is harder to call necessary, and a candidate who was not told about it did not reasonably expect it. Asking is simpler.

What must the candidate be told?

Two things. Article 12 requires a privacy policy, available "prior to collecting" the data, stating the purpose, the data collected, the means of collection, processing, storage and destruction, and the person's rights. Article 13 then requires telling the person, at collection, "the legal basis," the purpose, which data is mandatory or optional, who is collecting it, "the entities to which the Personal Data will be disclosed" and "whether the Personal Data will be transferred, disclosed or processed outside the Kingdom," the consequences of not providing it, and their rights. Put the policy link in the invitation and the essentials in the opening line of the call.

Can candidates ask for the recording or the transcript?

Yes. Article 4 gives the rights to be informed of the legal basis and purpose, to access the data, to obtain it "in a readable and clear format," to request correction and to request destruction when it is no longer needed. Under Article 3 of the Implementing Regulation the controller must act on a request "within a period not exceeding (30) days," extendable by up to thirty more days where the request needs disproportionate effort or there are multiple requests, with advance notice and reasons. Requests can be oral, and the controller must keep a record of all requests received. The National Data Governance Platform takes complaints. Our candidate data access requests guide has a workflow.

How long can you keep interview recordings?

Article 18 requires the controller to "Destroy the Personal Data when no longer necessary for the purpose for which they were collected," without undue delay, unless a legal basis requires a set retention period or the data is needed for a case before a court. Article 11(4) says the same at the collection stage. Set a short, documented period after the hiring decision; our retention policy template gives the structure.

What about AI note takers and US-hosted tools?

Three sets of rules apply. First, the vendor. Article 17 of the Implementing Regulation requires the controller to choose a processor that "provides sufficient guarantees" and to have an agreement covering the purpose, the categories of data, the duration, breach notification, subcontractors and "whether the Processor is subject to Regulations in other countries." A processor that departs from your instructions "shall be considered as a Controller." Second, the assessment. Article 25 requires a written impact assessment for, among other things, processing "based on newly adopted technologies, or making decisions based on automated Personal Data Processing," which can describe an AI tool that scores candidates. SDAIA's AI Ethics Principles 2025 add that systems posing "high risks" to basic rights must undergo pre- and post-conformity assessments.

Third, the transfer. Article 29 of the PDPL allows transfers outside the Kingdom for listed purposes, and the Regulation on Personal Data Transfer Outside the Kingdom (version 2.0, August 2024) adds "central processing" for the controller's activities and providing "a service or benefit" to the person. The transfer must not harm national security, must go to a place with protection "at least equivalent" to the law as assessed by the competent authority, and must be limited to the minimum data. Where those conditions are not met, the regulation lists safeguards: SDAIA's standard contractual clauses, binding common rules or an accreditation certificate, with a documented risk assessment (Articles 4 and 7). Name the tool's country in your notice.

Interview Signal, for example, captures audio from the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and sends audio to a speech-to-text provider in short chunks that are not retained; the transcript stays on the interviewer's computer and is still personal data under the PDPL. For general vendor questions, see is it legal to use AI note takers in interviews.

Do agencies need to register or appoint an officer?

Possibly. SDAIA's rules for the National Register of Controllers require registration where, among other cases, "the Controller's main activity is based on personal data processing" or it "processes sensitive data." Its rules for appointing a data protection officer require one where core activities involve "regular and systematic monitoring" of people or processing of sensitive data. A recruitment agency should check both.

A consent line for interviews in Saudi Arabia

"قبل أن نبدأ: نودّ في [الشركة] تسجيل هذه المقابلة وتحويلها إلى نص
مكتوب لتوثيق إجاباتك بدقة وتقييم طلبك لهذه الوظيفة. سنستخدم التسجيل
لهذا الغرض فقط [وسنشاركه مع (العميل) بموافقة منفصلة]، وتتم معالجته
في [البلد]، وسنحذفه بعد [المدة] من اتخاذ القرار. سياسة الخصوصية لدينا
متاحة على [الرابط]. هل توافق على التسجيل؟ يمكنك الرفض أو طلب إيقاف
التسجيل في أي وقت، ولن يؤثر ذلك على طلبك."

("Before we start: at [Company] we'd like to record and transcribe
this interview to document your answers accurately and assess your
application for this role. We'll use the recording for this purpose
only [and share it with (client) with your separate agreement]; it is
processed in [country], and we'll delete it [period] after the
decision. Our privacy policy is at [link]. Do you agree to the
recording? You can refuse or ask me to stop at any time; it won't
affect your application.")

The line states the purpose, the place of processing and the right to refuse that Article 13 expects, and the recorded answer gives you the documented consent Article 11 of the Implementing Regulation asks for. More wording is in the interview recording consent script.

Checklist before you record interviews in Saudi Arabia

• Privacy policy published and linked in the invitation; Article 13 points covered at the start of the call.
• Consent obtained before recording, documented with time and means, separately for each purpose.
• If relying on legitimate interest, a documented assessment and no sensitive data.
• Processor agreement with the Article 17 terms; impact assessment for any scoring or automated decisions.
• Transfer basis for any tool outside the Kingdom: adequacy or SDAIA's standard contractual clauses, with a risk assessment.
• Requests answered within 30 days; recordings destroyed once no longer needed.
• National Register and data protection officer rules checked for your organization.

Also interviewing elsewhere? See the UAE, Malaysia, India and Israel.