Recording job interviews in Bangladesh: the Personal Data Protection Act, 2026, consent and the telecom eavesdropping offense

Recording a job interview with a candidate in Bangladesh needs the candidate's consent or another lawful basis under the Personal Data Protection Act, 2026 (Act No. 63 of 2026), which is deemed to have taken effect on November 6, 2025. Section 5 requires consent that is "voluntary, specific, clear and revocable," given after the candidate is told the purpose, the retention period, any transfer and how to withdraw. The complaint and fine provisions (sections 31 to 35) start later, on a date the government sets by gazette. Separately, section 71 of the Bangladesh Telecommunication Act, 2001 punishes eavesdropping on other people's conversations with up to two years in prison or a fine of up to 1.5 crore taka. This is the position as of November 2026.

This page adds Bangladesh to our country series alongside India and Pakistan. It is for recruiters, agency consultants and hiring managers who interview candidates located in Bangladesh by video or phone, including from the US, Europe and the Gulf, and for agencies that recruit Bangladeshi candidates for jobs abroad. The law changed fast: three ordinances made in 2025 were replaced by Acts of Parliament in April 2026, so summaries that describe the ordinances are out of date.

Bangladesh's rules at a glance

Is it legal to record a job interview in Bangladesh?

Yes, with the candidate's agreement. Article 43 of the Constitution gives every citizen the right, subject to reasonable restrictions imposed by law, "to the privacy of his correspondence and other means of communication." The criminal rule is section 71 of the Bangladesh Telecommunication Act, 2001, which the Bangladesh Telecommunication (Amendment) Act, 2026 (Act No. 51 of 2026) replaced with effect from February 5, 2026. It makes it an offense for a person who, in breach of the Act, "intentionally eavesdrops, using telecommunication equipment, on a conversation of two or more other persons," punishable with up to two years in prison, a fine of up to 1.5 crore taka, or both (our translation). A new subsection (2) makes surveillance or harassment of citizens through SIM and device registration data an offense with the same penalty.

The words "two or more other persons" aim at third parties listening in, so the offense does not on its face cover an interviewer recording a call they take part in. A colleague, client or bot listening without the candidate's knowledge is the risk. The data protection Act then settles the practical answer: a recording is processing of personal data, and it needs consent or one of the listed bases.

Which data protection law applies in November 2026?

Bangladesh made a Personal Data Protection Ordinance, a National Data Management Ordinance and a Cyber Security Ordinance in 2025. Laws of Bangladesh now marks all three as repealed, and lists their successors among the Acts of 2026: the Personal Data Protection Act, 2026 (Act No. 63) and the National Data Management Act, 2026 (Act No. 80), both dated April 10, 2026, and the Cyber Security Act, 2026.

Section 1(3) of the Personal Data Protection Act, 2026 says that, "except section 23 and sections 31 to 35, this Act shall be deemed to have taken effect on November 6, 2025," and that those sections take effect on the date the government sets by gazette notification once eighteen months have passed after the law was made (our translation). Section 23 is the chief data officer; sections 31 to 35 are complaints, administrative fines, remedies for security failures, the factors for setting fines and compensation. So the duties apply now, but the complaint and fine machinery does not yet.

The regulator, called "the Authority" in the Act, is the National Data Management Authority established under section 8 of the National Data Management Act, 2026, a statutory body "attached to the Prime Minister's Office." Many details, including request deadlines, notice forms, breach timelines and retention periods, are left to regulations, which we did not find published.

What does the Act require before you record?

The Act calls the organization that decides on the processing a "data fiduciary" (উপাত্ত-জিম্মাদার) and the candidate a "data subject." For a recorded interview (our translations):

• Consent, properly informed (section 5(1) and (2)). A data fiduciary may process personal data "by obtaining the consent of the data subject." Every consent "shall be voluntary, specific, clear and revocable," and must be obtained "after informing the data subject of the purpose of processing, the retention period, transfer and the procedure for withdrawal." Section 2 defines consent as a "clear affirmative indication," so a banner the candidate never answers is weak.
• Bases without consent (section 5(3)). Processing without consent is allowed, "keeping intact the conditions of benefit, necessity, proportionality and purpose limitation" set by regulations, for listed grounds including a contract the data subject is party to, "taking necessary steps at the request of the data subject for entering into a contract," legal claims, vital interests, and "implementing legal rights relating to employment, labor rights or social protection."
• Proof (section 5(4)). "The burden of proving" that consent was properly given "shall rest on the data fiduciary." Keep the candidate's answer.
• Transparency (section 15). Make available the categories of data collected and how, the purposes, the ways to exercise rights and complain to the Authority, any transfer of data to another place, and your identity and contact details.
• Withdrawal (section 13). The candidate may withdraw consent "at any time, wholly or partly," to storage, processing or automated decisions, and may ask for erasure once the purpose is gone or consent is withdrawn, subject to listed exceptions.

Given the power imbalance in hiring, ask for consent to the recording itself, offer written notes as the alternative, and keep "steps toward a contract" in reserve for the notes and scorecard.

What counts as sensitive data in an interview?

Section 2(21) lists genetic and biometric data; data about small ethnic groups, tribes and communities; political or philosophical views and religious beliefs; trade union membership; health; sexual orientation; data on offenses, criminal proceedings and convictions; data on offenses the person is alleged to have committed; real-time location; and anything regulations add. Section 7 allows processing it only on conditions such as "the specific consent of the data subject," a contract, or rights and duties under employment and social protection law. Do not ask about these subjects unless a law requires it for the role, and keep anything volunteered out of notes and scorecards.

What if you interview a candidate in Bangladesh from the US?

The Act is written to reach you. Section 1(2) applies it to persons, data fiduciaries and processors who are citizens or residents of Bangladesh or working there, who process personal data inside Bangladesh, or who process personal data outside Bangladesh in connection with providing goods or services to, or "monitoring or profiling," data subjects located in Bangladesh. Section 4(2) adds that if a person breaches the Act "from outside Bangladesh into Bangladesh," the Act applies as if the whole breach took place in Bangladesh. Your own state's law governs your side of the call; see two-party consent states.

For transfers, section 29(3) allows personal data to go abroad, subject to the section's conditions, with "the consent of the data subject," under a contract to which the data subject is party, or, with consent, for matters in their interest such as "business, education, emigration, migration." Section 29(4) allows transfers only to places or countries with the storage technology and equipment that regulations will prescribe, and section 29(6) requires notifying the Authority of cross-border transfers of large volumes of sensitive identifiers: national ID, passport and tax numbers, biometrics, genetic data and criminal records. An agency recruiting for jobs abroad should name the destination and the employer in its consent wording.

Can candidates get the recording, and how long can you keep it?

Yes. Section 11 gives the data subject access to data the fiduciary processes, and on request a copy "in a concise and intelligible format," with a summary of the data, the purposes, the recipients and retention, and a statement of every person, fiduciary or processor it was shared with. Frequency limits and response deadlines are left to regulations. Our candidate data access requests guide has a workflow that will fit once deadlines are set.

Section 18(1) bars keeping personal data beyond the retention period that regulations prescribe for the purpose, and section 40 lets data processed before the Act took effect continue to be used for its original purpose, with fresh consent if the purpose changes. Until periods are prescribed, set a short one for audio, tie notes and scorecards to the hiring decision, and tell candidates both. Our retention policy template gives the structure. If recordings leak and significant harm to candidates is likely, section 20 requires notifying the Authority in the form and time regulations set.

Can you use AI note takers or transcription?

Yes, with consent that names the tool, where it stores data and any transfer abroad, and a contract that makes the vendor your processor. The Act's definition of "profiling" includes automated processing to evaluate a person's "performance at work," section 13(1) lets the candidate withdraw consent to automated decisions, and section 13(6) bars a data fiduciary from carrying out automated processing or transfers without informing the data subject. Keep a human decision on every candidate, and ask the vendor whether it trains models on your interviews. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews with candidates in Bangladesh

শুরু করার আগে: আপনার উত্তরগুলো সঠিকভাবে লিখে রাখার জন্য আমি
[এই সাক্ষাৎকারটি রেকর্ড করতে / কথোপকথনকে লেখায় রূপান্তরকারী একটি
সফটওয়্যার ব্যবহার করতে] চাই। এটি শুধু এই নিয়োগ প্রক্রিয়ার জন্য
ব্যবহার করা হবে, শুধু [ক্লায়েন্ট / নিয়োগকারী ব্যবস্থাপক] দেখবেন,
[দেশ]-এ [সেবাদাতা] এটি সংরক্ষণ করবে, এবং সিদ্ধান্তের [সময়কাল] পরে
মুছে ফেলা হবে। আপনি কি সম্মত? রাজি না হলে আমরা লিখিত নোট নিয়ে
চালিয়ে যাব। যেকোনো সময় আপনি সম্মতি প্রত্যাহার করতে বা রেকর্ডিং বন্ধ
করতে বলতে পারেন; এতে আপনার আবেদনের মূল্যায়নে কোনো প্রভাব পড়বে না।

(Before we start: I'd like to [record this interview / use software
that turns our conversation into text] so I can note your answers
accurately. It will be used only for this recruitment, seen only by
[the client / the hiring manager], stored by [vendor] in [country],
and deleted [period] after the decision. Do you agree? If you'd
rather not, we'll continue with written notes. You can withdraw your
consent or ask me to stop recording at any time; it won't affect how
your application is assessed.)

The line covers what section 5(2) asks you to say before consent: the purpose, the retention period, the transfer and the right to withdraw. Put the same details in the invitation. More wording is in the interview recording consent script.

Checklist before you record interviews in Bangladesh

• Only calls you take part in are recorded; no listeners or bots the candidate does not know about.
• Consent asked for after telling the candidate the purpose, retention, transfer and withdrawal; the answer kept as proof.
• Section 15 information in the invitation, including how to complain to the Authority.
• No questions on religion, ethnicity, politics, union membership, health, sexual orientation or alleged offenses.
• Transfers abroad covered by consent or a contract with the candidate; large transfers of ID numbers or criminal records notified.
• Vendor contracts in place; a short audio retention period stated and kept.
• Laws of Bangladesh checked for regulations and for the gazette date of sections 31 to 35.

Interviewing elsewhere in South Asia? Compare India, Pakistan and Sri Lanka.