Recording job interviews in Egypt: Penal Code Article 309 bis, Law No. 151 of 2020 and PDPC licenses

Recording a job interview with a candidate in Egypt requires the candidate's consent. Article 57 of the Constitution makes telephone calls and electronic correspondence inviolable, and Article 309 bis of the Penal Code punishes anyone who, without the person's consent, records or transmits conversations held in a private place or by telephone, with up to one year in prison. The Personal Data Protection Law (Law No. 151 of 2020, the PDPL) and its Executive Regulations (Decision No. 816 of 2025) then require a lawful basis, explicit rather than presumed consent where you rely on consent, a license or permit from the Personal Data Protection Center (PDPC), and a separate permit to send data abroad. This is the position as of November 2026.

This page adds Egypt to our country series alongside Saudi Arabia, the United Arab Emirates and Qatar. It is for recruiters, agency consultants and hiring managers who interview candidates located in Egypt by video or phone, including from the US and Europe, and for agencies that recruit Egyptian candidates for employers abroad. Egypt's distinctive points are a Penal Code that presumes consent in some meetings, which the data protection law does not, and a licensing system that most other countries in this series do not have.

Egypt's rules at a glance

Is it legal to record a job interview in Egypt?

Yes, with consent. Article 57 of the Constitution, in the State Information Service's translation, says that "postal, telegraphic and electronic correspondences, telephone calls, and other means of communication are inviolable, and their confidentiality is guaranteed," and may be monitored only "by virtue of a reasoned judicial order." The criminal rule is Article 309 bis of the Penal Code, which punishes with imprisonment of up to one year anyone who infringes the inviolability of a citizen's private life, "other than in the cases permitted by law or without the consent of the victim," by "eavesdropping on, recording or transmitting, by any device of whatever kind, conversations held in a private place or by telephone," or by capturing or transmitting a person's image in a private place (our translation). The court orders the devices confiscated and the recordings erased.

Article 309 bis (a) then punishes anyone who "broadcasts, facilitates the broadcasting of, or uses, even if not publicly," a recording obtained in one of those ways or without the consent of the person concerned, and sets up to five years for threatening to disclose such material to force someone to act or refrain from acting (our translation). Sharing a covert interview recording with a client is the risk here.

Does the Penal Code's presumed consent cover an open recording?

Not for data protection purposes. Article 309 bis adds that where the acts take place "during a meeting, within the hearing or sight of those present at that meeting, the consent of those present shall be presumed" (our translation). A recorder in plain view at a meeting may therefore fall outside the criminal offense, and we found no official text applying that sentence to a video interview with a visible recording indicator.

The PDPL does not accept that shortcut. The PDPC's Data Subject Consent Guidelines say consent must be "personal, explicit, informed, specific, and freely given," that consent requests "cannot rely on implicit or presumed consent" or default mechanisms such as pre-checked boxes, and, in an example about an opt-out slip, that "data users cannot rely on presumed consent to process data subjects' personal data." An automatic "this meeting is being recorded" banner is presumed consent by another name. Ask the candidate a direct question before recording, wait for a clear yes, and keep the answer.

What does the data protection law require before you record?

A recording or transcript of an interview is personal data, and every processing activity needs one of the six lawful bases in Article 6 of the PDPL, which the PDPC's Lawful Bases Guidelines list as consent, a contractual obligation, a legal obligation, legitimate interest, the claim or defense of a legal right, and the execution of court judgments or orders. Two points from the guidelines matter for interviews:

• Consent and the power imbalance. The Consent Guidelines warn that consent "may not be the most appropriate" where there is "a clear power imbalance between the data user and the data subject (e.g., employment relationship)." A candidate is not yet an employee, but the same pressure applies, so make declining a real option: offer to continue with written notes.
• Legitimate interest needs a written test. Relying on legitimate interest requires a legitimate interest assessment showing the interest is legitimate, the processing "strictly necessary," and the processing proportionate. Given Article 309 bis, explicit consent to the recording is the simpler route; legitimate interest may still suit the notes and scorecard.

Tell the candidate, before recording, who you are, the purpose, who will receive the recording (the client, the transcription vendor), where it is stored and for how long, and their rights. The PDPC's Data Protection Principles Guidelines give an example that fits: a company that "permanently stores customer service call recordings to evaluate employee performance" breaks the storage limitation principle, because "retaining the recordings for a short, defined period would have been sufficient." Set a short period for audio.

Do you need a license from the Personal Data Protection Center?

Probably, and this is where Egypt differs from most countries. The PDPC's Licenses and Permits Guidelines say that, under Article 19 of the PDPL, "data users may only process personal data provided that they first obtain a license or permit from the PDPC." In summary, as of November 2026:

• Who gets what. Legal entities (companies, agencies, non-profits, government bodies) can hold a license, valid for three years. Permits cover temporary processing, last three, six, nine or twelve months, and are the only option for individuals. The license type follows your role: controller, processor, or both.
• Supplementary licenses. Transferring personal data outside Egypt needs a separate cross-border license or permit, which the PDPC says "includes engaging with cloud service providers where personal data is processed or stored on servers located outside Egypt."
• Process. You answer a questionnaire on the PDPC's electronic portal, apply with supporting documents, and the PDPC decides within 90 days, failing which the application "shall be deemed rejected." Fees are set in the Executive Regulations' financial tables by the size or number of records.
• Grace period. All data users "must apply for the necessary licenses or permits within the one-year grace period, as stipulated by the PDPL"; processing without one after that is a violation. Sanctions include warnings, suspension or revocation of a license, publication of violations and technical supervision, "without prejudice to civil or criminal liability."

The PDPC's Data Users Guidelines add that legal entities "must appoint a DPO irrespective of the scale of their processing activities," and its framework presentation says the DPO must be registered with the PDPC. An agency that records interviews in Egypt should check its license, its cross-border permit and its DPO before the next campaign.

What counts as sensitive data in an interview?

The PDPC's Consent Guidelines list the categories that Article 1 of the PDPL treats as sensitive: "genetic data; biometric data; health data; financial data; religious beliefs; political opinions; security data; and children's data." Consent for any of them "must be in writing, whether in paper form or through electronic means." A candidate who mentions a health condition or their religion on a recorded call has given you sensitive data. Do not ask about these subjects unless a legal requirement for the role makes it necessary, keep volunteered details out of notes and scorecards, and delete audio that captured them early.

What if you interview a candidate in Egypt from the US?

The PDPL can reach you. The PDPC's framework presentation says the law "regulates the collection, processing, storage, and transfer of personal data of Egyptian citizens, non-Egyptian residents, and Egyptians abroad," and its Data Users Guidelines say data users "located outside the Arab Republic of Egypt, without having a branch or representative office within the Egyptian borders, must appoint a representative within Egypt," registered with the PDPC. A recording made in the US of a candidate in Cairo is also a cross-border transfer in practice, so the cross-border license, a transfer impact assessment and contract terms all come into play; the PDPC says it will keep a whitelist of countries with adequate protection. Your own state's law governs your side of the call; see two-party consent states.

Can candidates get the recording, and what about breaches?

The PDPL gives data subjects nine rights, which the PDPC lists as the rights to be informed, of access, to withdraw consent, to rectification, to erasure, to restriction, to object, to portability and to be notified of a data breach. The right of access covers "a copy of such data," which includes a candidate's own recorded answers. The PDPC's compliance checklist asks whether "acknowledgement of data subject requests is issued within six working days, as legally required." Our candidate data access requests guide has a workflow, and our retention policy template helps you set periods tied to the hiring decision.

If recordings leak, the Data Users Guidelines require notifying the PDPC "within seventy-two (72) hours of becoming aware of the breach," or immediately where national security is concerned, and the affected candidates within three working days after notifying the PDPC.

Can you use AI note takers or transcription?

Yes, with explicit consent that names the tool, a vendor contract that makes it your processor, and a cross-border license or permit if the vendor stores audio or transcripts outside Egypt. Keep a human decision on every candidate: the PDPC's Data Protection Principles Guidelines cite "an HR system automatically rejecting candidates based on ethnicity" as an example of unfair automated decision-making. Ask the vendor where it stores data and whether it trains models on your interviews. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews with candidates in Egypt

قبل أن نبدأ: أودّ أن أطلب موافقتك الصريحة على [تسجيل هذه المقابلة /
استخدام برنامج يحوّل المحادثة إلى نص مكتوب] لتوثيق إجاباتك بدقة.
سنستخدم [التسجيل / النص] لهذا التوظيف فقط، ولن يطّلع عليه إلا
[العميل / مدير التوظيف]، ويُحفظ لدى [مزوّد الخدمة، البلد]، وسنحذفه
خلال [المدة] بعد اتخاذ القرار. هل توافق؟ من حقك الرفض، أو سحب
موافقتك وطلب إيقاف التسجيل في أي وقت، ونكمل بملاحظات مكتوبة، ولن
يؤثر ذلك على تقييم طلبك.

(Before we start: I'd like to ask for your explicit consent to
[record this interview / use software that turns the conversation
into text] to document your answers accurately. We'll use the
[recording / text] for this recruitment only; only [the client /
the hiring manager] will see it; it is stored by [vendor, country]
and we'll delete it within [period] after the decision. Do you
agree? You can refuse, or withdraw your consent and ask me to stop
recording at any time, and we'll continue with written notes; it
won't affect how your application is assessed.)

The line asks for explicit consent rather than relying on the Penal Code's presumption, names the recipients and the storage location the PDPL notice needs, and offers a real alternative. Put the same details in the invitation. More wording is in the interview recording consent script.

Checklist before you record interviews in Egypt

• Explicit consent asked for and noted before any recording or live transcription; no reliance on a banner or presumed consent.
• Notice in the invitation: who you are, purpose, recipients, storage location, retention, rights.
• PDPC license or permit in place, and a cross-border license or permit if any vendor stores data outside Egypt.
• DPO appointed and registered; a representative in Egypt if you have no presence there.
• No questions on health, religion, politics or security matters; volunteered details kept out of notes.
• Recordings never shared beyond the announced recipients, never posted.
• Requests acknowledged within six working days; breaches reported to the PDPC within 72 hours.

Interviewing elsewhere in the region? Compare Saudi Arabia, the United Arab Emirates and Qatar.