Recording job interviews in Cyprus: Law 92(I)/1996, every participant's express consent and the GDPR

Recording a job interview with a candidate in Cyprus requires the prior express consent of everyone on the call. Section 3 of Law 92(I)/1996 on the secrecy of private communications punishes recording a private communication, which expressly includes internet calls and teleconferences, with up to ten years in prison, a fine of up to €100,000, or both, unless the person who made the communication and the person who received it gave prior express approval, and where several people take part, all of them. The GDPR and Cyprus's Law 125(I)/2018 then govern the recording and transcript, and Law 125(I)/2018 turns some GDPR breaches into criminal offenses. This is the position as of November 2026.

This page adds Cyprus to our country series alongside Greece and Germany. It is for recruiters, agency consultants and hiring managers who interview candidates located in Cyprus by video or phone, including from the US, and for agencies that run interviews for employers in Nicosia or Limassol. Greece reaches the same answer through its Penal Code; Cyprus has a dedicated interception statute, and that is where this page starts.

Cyprus's rules at a glance

Is it legal to record a job interview in Cyprus?

Yes, with everyone's prior express consent. Article 17 of the Constitution gives everyone "the right to respect for and protection of the secrecy of their correspondence and of every other communication," and Article 15 protects private and family life. Law 92(I)/1996 gives the Article 17 right teeth. Section 3(1) makes it an offense for any person who intentionally intercepts or monitors the content of any private communication, uses a device to do so, or discloses or uses the content knowing how it was obtained. The penalty, as amended in 2020, is imprisonment of up to ten years, a fine of up to €100,000, or both.

Three definitions in section 2 bring an interview inside that offense (our translations):

• "Monitoring" means "the aural or other acquisition of the content of any private communication" by any device, and "includes listening, tape-recording or any other form of recording."
• "Private communication" means any oral, written or electronic communication made "in circumstances in which it is reasonable for that person to expect that it will not be intercepted or monitored by any other person, except the one intended to receive it."
• "Electronic communication" covers information exchanged by any electronic means, including "communication via the internet" and "teleconferencing."

The exception that matters is section 3(2)(a): the offense does not apply to a person who has "the prior express approval" of "the person who makes or has made that communication and the person who received or is intended to receive it." Section 3(3) adds that where more than one person makes or receives the communication, that approval "must be obtained from all the persons" taking part. The Law does not say in terms whether an interviewer who records their own call is "monitoring," and we found no official guidance on the point; but the only consent route it offers is everyone's prior express approval. Treat Cyprus as an all-party, express-consent country. A colleague, client or note-taking bot on the call is a participant too.

Section 16(1) adds a practical cost: content obtained by monitoring in breach of the Law "cannot be admitted as evidence" in any criminal or civil proceedings. Section 16(2), on evidence, admits recordings made with the prior express approval of the sender or the recipient, but the offense in section 3 is the stricter text, and it is the one to follow.

What does the Commissioner expect at the recruitment stage?

The GDPR applies in full to the audio and the transcript. Cyprus's implementing law, Law 125(I)/2018, has no employment chapter of its own, so the Commissioner's guidance fills the gap. In a presentation on employers' duties under the GDPR and the AI Act (May 28, 2025), the Commissioner set out these points (our translations):

• Agencies are processors. Candidates may be assessed by the employer or by an employment agency to which the employer entrusts the assessment; entrusting the collection of CVs, the assessment and the interviews "requires the signing of a Processing Agreement (Article 28)," and controller and processor "are liable jointly and severally."
• Questions must be job-related. Information asked must be "relevant and proportionate to the duties of the post"; in Cyprus no law lists permitted interview questions, the GDPR applies, and questions unrelated to the duties or that create discrimination "breach the GDPR." Family status and a photograph are not justified in most cases.
• Special categories stay out. No questions on racial or ethnic origin, political opinions, religion, union membership, health or sex life, unless labor law or a binding collective agreement provides for it; health data may be asked only to assess fitness for work.
• No solely automated decisions, under GDPR Article 22. Psychometric tools that assess skills are allowed; lie-detection tools "are not permitted in Cyprus" for lack of a legal basis.
• Call recording at work is allowed only where a law provides for it, for example to prove banking or investment orders, or where the employer can show an overriding legitimate interest.

For a recorded interview that means two layers that fit together: the candidate's express consent to the recording, which Law 92(I)/1996 requires, and a documented GDPR Article 6 basis for the processing, usually steps before a contract or legitimate interests, with a necessity check on whether you need audio at all. If a vendor offers voice-stress or "deception" scoring, the Commissioner's view on lie detection is the answer.

Can a data protection breach be a crime in Cyprus?

Yes, which is unusual in the EU. Besides the GDPR's administrative fines, section 33 of Law 125(I)/2018 lists criminal offenses. In the Commissioner's unofficial English translation, they include a controller or processor "who transfers personal data to a third country or an international organisation, in breach of Chapter V of the Regulation," punishable by up to three years in prison or a fine of up to €30,000, and a controller or processor "who does not comply with the provisions of the Regulation and of this law when carrying out a processing activity," punishable by up to one year or €10,000. Where the controller is a company, "the legal responsibility lays with the person designated as the supreme executive instrument or body." Sending interview recordings to a vendor outside the EEA without a valid transfer basis is therefore more than a paper risk.

What should you tell the candidate, and why does the stated purpose matter?

Give the GDPR Article 13 information when you invite the candidate: who you are, the purpose, the lawful basis, who receives the recording (the client, the transcription vendor), any transfer outside the EEA, the retention period and the candidate's rights. Our candidate privacy notice template has the structure.

State the real purpose. In a 2011 complaint about an insurer's recorded calls, decided under the previous data protection law, the Commissioner found that using a customer's recorded call to test her account of an accident served the company's interests rather than the "better service" the announcement promised, and had the message changed to say the calls were recorded "for purposes of better serving you and safeguarding the company's interests" (our translation). For interviews: say the recording is used to assess the candidate and to document the hiring decision, not just "for quality."

Can candidates get a copy of the recording?

Yes. A recording of the candidate's voice is their personal data, and GDPR Article 15 gives them a right of access, normally answered within one month. The Commissioner has dealt with exactly this request: in a 2011 decision on a caller who asked a telecom operator for its recording of his call, the Commissioner rejected the argument that the secrecy of communications barred disclosure, since the call had been recorded with the caller's express consent, and recommended giving him a copy "in audio form of the entire conversation," from which other people's personal data could be removed (our translation). If a second interviewer or a client is on the recording, plan for that redaction. Our candidate data access requests guide has a workflow.

How long can you keep interview recordings?

No Cypriot statute fixes a period for interview recordings, so GDPR storage limitation applies. The Commissioner's recommendations on recording council meetings give a useful pattern: inform the people recorded, secure the files, list the processing in the record of processing activities, and destroy the recordings once the minutes are confirmed or no longer serve their purpose. The interview equivalent: keep the notes and scorecard that support the decision for a stated period, delete the audio once they are checked, and say both periods up front. Our retention policy template gives the structure.

What if you interview a candidate in Cyprus from the US?

Law 92(I)/1996 protects the candidate's side of the call wherever you sit, so get everyone's express consent, and follow your own state's law for your side; see two-party consent states. The GDPR covers an employer or agency established in the EU under Article 3(1); a US company with no EU establishment is covered only where Article 3(2) applies.

• US vendors. The Commissioner's home page notes the European Commission's July 10, 2023 decision on the EU-US Data Privacy Framework, under which data can go to certified US companies without another transfer tool. For uncertified vendors, use standard contractual clauses or another Article 46 tool, as the Commissioner's transfers page explains.
• Special categories. If recordings may hold health or other special category data and go abroad under Article 46 safeguards or binding corporate rules, section 17(1) of Law 125(I)/2018 requires you to "inform the Commissioner for the intended transfer before the said data are transferred."
• Northern Cyprus. As the European Commission explains, EU legislation is suspended "in the northern part of the island, where the Government of the Republic of Cyprus does not exercise effective control," under Protocol 10 to the 2003 Act of Accession. This page does not cover the rules applied there; take local advice for candidates located in the north.
• British Sovereign Base Areas. Section 3(2) of Law 125(I)/2018 applies listed parts of the Law to processing in the Bases at Akrotiri and Dhekelia, except processing solely for military purposes or the administration of the Bases.

Can you use AI note takers or transcription?

Yes, with the same consent and notice. A bot that joins the call records it, so name it when you ask, and remember that Law 92(I)/1996 needs the express approval of every participant. Sign an Article 28 contract with the vendor, check where it stores audio and transcripts and whether it reuses them, and keep a human decision on every candidate. A tool that scores or ranks candidates is likely to be a high-risk system under the EU AI Act; the Commissioner's 2025 presentation says the government has designated the Commissioner as a market surveillance authority under the Act for matters within her competence. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews with candidates in Cyprus

Πριν ξεκινήσουμε: θα ήθελα να [ηχογραφήσω αυτή τη συνέντευξη /
χρησιμοποιήσω λογισμικό που μετατρέπει τη συνομιλία σε κείμενο],
ώστε να καταγράψω με ακρίβεια τις απαντήσεις σας και να τεκμηριώσω
την αξιολόγηση. Θα χρησιμοποιηθεί μόνο για αυτή τη διαδικασία
πρόσληψης, θα τη δει μόνο [ο πελάτης / ο υπεύθυνος πρόσληψης], θα
φυλάσσεται από [πάροχο, χώρα] και θα διαγραφεί [διάστημα] μετά την
απόφαση. Χρειάζομαι τη ρητή συγκατάθεσή σας, και όλων όσων
συμμετέχουν, πριν ξεκινήσω. Συμφωνείτε; Μπορείτε να αρνηθείτε ή να
μου ζητήσετε να σταματήσω οποιαδήποτε στιγμή, χωρίς καμία συνέπεια
για την αίτησή σας.

(Before we start: I'd like to [record this interview / use software
that turns the conversation into text] so I capture your answers
accurately and document the assessment. It will be used only for
this recruitment, seen only by [the client / the hiring manager],
stored by [vendor, country] and deleted [period] after the decision.
I need your express consent, and that of everyone on the call,
before I start. Do you agree? You can say no or ask me to stop at
any time, with no consequence for your application.)

The "express consent ... everyone on the call" line reflects sections 3(2)(a) and 3(3) of Law 92(I)/1996; the purpose line reflects the Commissioner's 2011 finding on stated purposes. Offer the line in Greek or English, whichever the candidate prefers, and note the answer. More wording is in the interview recording consent script.

Checklist before you record interviews in Cyprus

• Prior express consent from every participant, including colleagues, clients and any bot, before recording or live transcription starts; no reliance on a banner.
• Article 13 notice in the invitation, with the real purpose of the recording.
• Article 6 basis documented; questions limited to the duties of the post; no special category questions.
• Article 28 processing agreement between the employer and the agency, and with every vendor.
• Transfer basis for any vendor outside the EEA; Commissioner informed first if special category data goes abroad under section 17.
• Access requests answered within a month, with full audio and third parties redacted.
• Retention periods set for audio and notes, and followed.

Interviewing elsewhere in the eastern Mediterranean? Compare Greece, which also requires the other person's express consent, and Israel.