Estonia interview recording laws: the Penal Code, Employment Contracts Act § 11 and AKI guidance

Estonian criminal law does not, on its wording, forbid a participant from recording their own interview: the Penal Code's offenses target unauthorized surveillance and breaches of the confidentiality of messages. The rules that matter are the GDPR, Estonia's Personal Data Protection Act and § 11 of the Employment Contracts Act, which bars questions the employer has no legitimate interest in and, since July 13, 2026, questions about pay history. The Data Protection Inspectorate (AKI) says the basis for candidates' data is legitimate interest backed by a written assessment made beforehand, and suggests keeping rejected candidates' data for up to a year. Tell the candidate before you record. This is the position as of November 2026.

This page adds Estonia to our country series alongside Finland, Poland and Germany. It is for recruiters, agency consultants and hiring managers who interview candidates located in Estonia by video or phone, including from the US. Statutes are quoted from the English translations published in Riigi Teataja; quotations from the AKI are our translations from Estonian.

Estonia's rules at a glance

Is it legal to record a job interview in Estonia?

Generally yes, if the candidate is told. Two Penal Code offenses deal with listening in and watching. Section 137, "unauthorised surveillance," punishes the "observation of another person in order to collect information relating to such person by a person without the lawful right to engage in surveillance" with a pecuniary punishment or up to three years' imprisonment. Section 156, "violation of confidentiality of messages," punishes the "violation of the confidentiality of a message communicated by a letter or other means of communication" with a pecuniary punishment. Neither, on its wording, addresses a participant who records a conversation they are part of, and we found no official text applying them to one.

That does not make a silent recording safe. The GDPR requires a lawful basis and notice before the recording starts, and a recording made without the candidate's knowledge would fail the Article 13 information duty immediately. Tell the candidate, give them a real chance to object, and offer handwritten notes as the alternative.

What does the GDPR cover, and what does Estonian law add?

A recording or transcript of an interview is personal data, so the GDPR applies in full: a lawful basis under Article 6, the Article 13 information, data minimization, a retention limit, the candidate's rights of access and erasure, and Article 22 on decisions based solely on automated processing. Estonia's Personal Data Protection Act says it "elaborates and supplements" the GDPR. Its special rules cover journalism, research, archiving, children's consent online, deceased persons, credit data and recordings in public places, not recruitment.

The employment rule that shapes an interview is § 11 of the Employment Contracts Act:

• Legitimate interest only (§ 11(1) and (2)). "In precontractual negotiations or upon preparation of an employment contract in another manner, including in a job advertisement or job interview, an employer may not ask the person applying for employment for any data with regard to which the employer does not have any legitimate interest." The absence of legitimate interest is presumed for questions that "disproportionately concern the private life" of the applicant or are "not related to their suitability for the job offered."
• No pay history (§ 11(2¹)). Since July 13, 2026, "the employer may not ask the applicant about their pay history during their previous or current employment relationships."
• Pay range first (§ 11(2²)). The employer must give the applicant information about the pay or its range for the position, in a form that can be reproduced in writing, "prior to the job interview," and must also mention additional pay terms that come from a collective agreement.

A recording captures everything said, so build the question guide around these limits. If a candidate volunteers their current salary, do not use it, and keep it out of the notes you pass on.

What does the AKI say about candidates' data?

The AKI's guidance on processing personal data in employment relationships starts with job applicants and makes three points:

• The basis is legitimate interest. "When someone applies for a job, the employer's legal basis for processing the applicant's personal data is legitimate interest (Article 6(1)(f) GDPR)," and processing on that basis "is lawful only if a legitimate interest analysis has been properly carried out and documented in writing before the processing." Write one for interview recording before you start.
• Avoid consent. Because employer and employee are in different positions of power, consent is suitable only where refusing or withdrawing it truly has no negative consequences, which the AKI says is rare in practice, "which is why we recommend avoiding consent as a legal basis in employment relationships."
• Candidates can ask. "When applying for a job, everyone has the right to ask what has been collected about them, including any background checks made."

That is why the notice line below tells the candidate about the recording and invites an objection, rather than resting everything on a yes.

How long can you keep recordings and transcripts?

The AKI's guidance answers this directly. Under § 25 of the Equal Treatment Act, a claim for compensation for discrimination has a limitation period of "one year from the date when the injured party becomes aware or should become aware of the damage caused." The AKI therefore says employers "should keep data and documents related to applicants for up to a year, until the end of the period for contesting the recruitment decision," and that keeping them longer for future competitions requires the applicant's written consent. A recording is more intrusive than a CV, so a shorter period for audio, with written notes kept for the year, is easier to defend. Our retention policy template gives the structure.

Can candidates get a copy of the recording?

Yes. Under Article 15 GDPR the candidate can ask for a copy of their personal data, including a recording or transcript, and Article 12(3) requires an answer within one month, extendable only in the cases the GDPR allows. The AKI's line quoted above confirms that this applies to applicants. Our candidate data access requests guide has a workflow.

What if you interview a candidate in Estonia from the US?

An employer or agency established in the EU is covered by the GDPR under Article 3(1); a US company with no EU establishment is covered only where Article 3(2) applies. Your own state's law governs your side of the call; see two-party consent states. A recording or transcript sent to a US vendor needs a transfer basis under Chapter V of the GDPR, such as the Commission's adequacy decision for the EU-US Data Privacy Framework (certified recipients only) or standard contractual clauses. The AKI has stressed that clauses are not a formality: where they are used, "it is not enough that they merely exist in a formal sense," and the circumstances of the transfer and the need for supplementary measures must be assessed.

Can you use AI note takers or transcription?

Yes, with notice, a documented basis and short retention. The AKI's closest guidance is an answer of April 16, 2026 about AI documentation software in healthcare, and three of its points carry over to interviews. Recording the whole conversation "inherently involves processing personal data, including special categories of personal data, on a much larger scale" than writing down only what is needed, because "the entire conversation is stored in a durable and replayable form, and the same scope carries over into the transcript and any AI processing." If the vendor wants to use the sensitive data it receives "for its own purposes, for example to improve its model or for product development, that is a new purpose that requires an additional legal basis." And an impact assessment is needed where processing is likely to be high risk. A tool that scores or ranks candidates is also likely to be high-risk under the EU AI Act; see also do AI note takers train on interview recordings. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A notice line for interviews in Estonia

Enne kui alustame: soovime selle vestluse [salvestada / lasta
programmil see tekstiks kirjutada], et teie vastused oleksid täpselt
kirjas. Teeme seda oma õigustatud huvi alusel, kasutame [salvestist /
teksti] ainult selles värbamisprotsessis, jagame seda ainult
[kliendiga / värbava juhiga] ja kustutame selle [tähtaeg] pärast
protsessi lõppu. Kui te ei soovi, et vestlust salvestataks, öelge
seda – teen siis märkmeid käsitsi ja see ei mõjuta teie
kandideerimist. Kas võime alustada?

(Before we start: we'd like to [record this conversation / have
software transcribe it] so your answers are captured accurately. We
do this on the basis of our legitimate interest, use the [recording /
text] only in this recruitment process, share it only with [the
client / the hiring manager] and delete it [period] after the process
ends. If you'd rather not be recorded, say so; I'll take notes by hand
instead and it won't affect your application. Shall we start?)

Put the same information, with the Article 13 details and your legitimate interest assessment's conclusion, in the invitation and candidate privacy notice. More wording is in the interview recording consent script.

Checklist before you record interviews in Estonia

• Legitimate interest assessment for interview recording written before you start.
• Candidate told before recording or live transcription starts, with a real option to object and notes by hand instead.
• Question guide checked against § 11: no questions without legitimate interest, no pay-history questions.
• Pay or pay range given to the candidate in writing before the interview.
• Data kept up to a year at most, audio for less; written consent for talent pools.
• Vendor contract barring training on your interviews; impact assessment for scoring features.
• US vendors certified under the Data Privacy Framework or covered by assessed standard contractual clauses.

Interviewing elsewhere around the Baltic Sea? Compare Lithuania, Finland and Sweden.