Bulgaria interview recording laws: Article 32 of the Constitution, the six-month candidate limit and the CPDP

Recording a job interview with a candidate in Bulgaria is lawful only if the candidate knows about it. Article 32 of the Constitution says no one may be "recorded" without their knowledge or despite their express disagreement, except where the law provides. The GDPR governs the recording and the transcript, and Bulgaria's Personal Data Protection Act adds a fixed limit: an employer may keep the data of people in a recruitment procedure for no more than six months unless the candidate agrees to longer. The Commission for Personal Data Protection (CPDP) treats voice data as personal data and says indiscriminate recording of all calls is not allowed. This is the position as of November 2026.

This page adds Bulgaria to our country series alongside Romania, Poland and Germany. It is for recruiters, agency consultants and hiring managers who interview candidates located in Bulgaria by video or phone, including from the US. Quotations from Bulgarian sources are our translations.

Bulgaria's rules at a glance

Is it legal to record a job interview in Bulgaria?

Yes, if the candidate knows and does not object. Article 32 of the Constitution first declares that "the private life of citizens is inviolable," then adds, in paragraph 2: "No one may be followed, photographed, filmed, recorded or subjected to other similar actions without their knowledge or despite their express disagreement, except in the cases provided for by law." Two things follow for interviewers: a hidden recording fails the first test, and a recording the candidate has refused fails the second. Article 34 separately makes "the freedom and secrecy of correspondence and other communications" inviolable, with exceptions only by permission of the judiciary to uncover or prevent serious crimes.

Bulgaria's Criminal Code also protects the secrecy of correspondence and communications. We could not load an official consolidated text of it when writing this page, so we do not summarize those offenses or say whether they reach a participant's own recording. The constitutional rule already gives the practical answer: tell the candidate before the recording starts, and stop if they say no.

What does the GDPR cover, and what does Bulgarian law add?

A recording or transcript of an interview is personal data, so the GDPR applies in full: a lawful basis under Article 6 (usually steps taken at the candidate's request before a contract, or legitimate interests; see legitimate interest in recruitment), the Article 13 information when the recording starts, data minimization, the candidate's rights, limits on decisions based solely on automated processing (Article 22), and an impact assessment where the processing is high risk (Article 35). The Personal Data Protection Act says it regulates data protection "insofar as" the GDPR does not, and its 2019 amendments added several rules that touch recruiting:

• Six months for candidates (Article 25k). An employer or appointing authority "sets a retention period for the personal data of participants in recruitment and selection procedures, which may not be longer than 6 months, unless the candidate has given consent to retention for a longer period." When the period ends, it "erases or destroys the stored documents containing personal data, unless a special law provides otherwise." If it asked for originals or notarized copies of documents on fitness, qualifications or experience, it must return them to an unsuccessful candidate within six months of the final completion of the procedure.
• Data you had no basis to receive (Article 25a). Where a person provides data without a legal basis under Article 6(1) GDPR or contrary to the Article 5 principles, the controller must return them within one month of learning of it, or, where that is impossible or disproportionate, erase or destroy them. If a candidate volunteers health details you have no reason to hold, keep them out of your notes.
• No copies of ID unless a law requires it (Article 25g). A controller "may copy an identity document, driving license or residence document only if this is provided for by law." Do not screenshot a document a candidate holds up to the camera.
• Written workplace rules (Article 25i). An employer must adopt rules and procedures, and notify its staff of them, when it uses a whistleblowing system, restricts the use of internal company resources, or introduces systems to control access, working time and labor discipline.

What has the CPDP said about recording conversations?

We found no CPDP guidance specifically on recorded job interviews, but two recent positions on recording people at work point the same way:

• Audio needs stronger justification than video (2023). Asked by a fuel retailer whether it could use camera footage, and possibly audio recordings, to assess staff performance for bonuses, the CPDP said in an opinion of November 15, 2023 that video monitoring should be used only if its aim cannot be sufficiently achieved by less intrusive means, and that "this applies with even greater force to the recording of sound (conversations), since it is an additional category of personal data." It concluded that using the recordings, including sound, to assess performance did not meet Article 6(4) GDPR and was "therefore inadmissible."
• No blanket call recording (2025). In its annual report for 2025, the CPDP summarized an opinion on recording work calls at critical energy infrastructure: "voice data constitute personal data and in certain cases may fall within the special categories," the consent of participants is as a rule not an appropriate legal basis in that context, and "preventive, general and indiscriminate recording of all telephone conversations is inadmissible." Recording should be limited to predefined lines and situations where necessity and proportionality are shown, with clear retention periods, access controls, transparency and an impact assessment for systematic recording.

The same report says that in employment, legitimate interest is "the most appropriate legal basis" for monitoring staff's digital activity, after a thorough balancing test, and that employees' consent is as a rule not appropriate "because of the dependent nature of employment relations." A candidate is in a similar position of dependence, so do not make consent your only safeguard. These positions also bite on recruiting teams: a phone system or interview tool that records or analyzes every recruiter call is monitoring the recruiters.

How long can you keep interview recordings?

Six months is the outer limit for an employer, under Article 25k, unless the candidate agrees to longer. The limit covers the whole candidate file, so audio, which is the most intrusive part, should usually go sooner, with written notes kept for the rest of the period if you need a record. Ask separately, and keep the answer, before holding a candidate's data for future vacancies. The rule is addressed to employers; an agency recruiting for a client should agree a period with the client that stays within it. Our retention policy template gives the structure.

Can candidates get a copy of the recording?

Yes. Under Article 15 GDPR the candidate can ask for a copy of their personal data, including a recording or transcript, and Article 12(3) requires an answer within one month, extendable only in the cases the GDPR allows. Where the request is made electronically, provide the copy in a commonly used electronic form. Our candidate data access requests guide has a workflow.

What if you interview a candidate in Bulgaria from the US?

An employer or agency established in the EU is covered by the GDPR under Article 3(1); a US company with no EU establishment is covered only where Article 3(2) applies. The Constitution protects the candidate wherever the recording is made, and your own state's law governs your side of the call; see two-party consent states. A recording or transcript sent to a US vendor needs a transfer basis under Chapter V of the GDPR, such as the Commission's adequacy decision for the EU-US Data Privacy Framework (certified recipients only) or standard contractual clauses.

Can you use AI note takers or transcription?

Yes, with notice before you start, the candidate's agreement, a documented legal basis, a processor contract under Article 28 GDPR, a transfer basis for any vendor outside the EU, and retention inside the six-month limit. Ask the vendor whether it keeps audio and whether it trains models on your interviews, which would be a new purpose. A tool that scores or ranks candidates is likely to be a high-risk system under the EU AI Act. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews in Bulgaria

Преди да започнем: бих искал(а) да [запиша разговора ни / използвам
програма, която превръща разговора в текст], за да отбележа точно
отговорите Ви. Ще използваме [записа / текста] само за тази процедура
по подбор, ще го предоставим само на [клиента / мениджъра, който
назначава] и ще го изтрием не по-късно от [срок до 6 месеца], освен
ако не се съгласите на по-дълъг срок. Съгласни ли сте? Можете да
откажете или да ме помолите да спра по всяко време, без това да се
отрази на кандидатурата Ви.

(Before we start: I'd like to [record our conversation / use software
that turns the conversation into text] so I note your answers
accurately. We'll use the [recording / text] only for this selection
procedure, make it available only to [the client / the hiring manager]
and delete it no later than [period of up to 6 months], unless you
agree to a longer period. Do you agree? You can say no or ask me to
stop at any time; it won't affect your application.)

Put the same information, with the Article 13 details, in the invitation and your candidate privacy notice. More wording is in the interview recording consent script.

Checklist before you record interviews in Bulgaria

• Candidate told before recording or live transcription starts; no recording if they object.
• Article 6 basis documented; Article 13 notice in the invitation, naming any client who receives the recording.
• Retention period of no more than six months set, unless the candidate consents to longer; originals returned on time.
• No copies of identity documents unless a law requires them; unrequested sensitive details kept out of notes.
• If recruiter calls are recorded or analyzed: limited to defined situations, written rules, impact assessment.
• US vendors certified under the Data Privacy Framework or covered by standard contractual clauses.
• Criminal Code position confirmed with a Bulgarian lawyer.

Interviewing elsewhere in the region? Compare Croatia, Romania and Greece.