Recording job interviews in Jordan: the Cybercrime Law, PDPL consent and transfers abroad

Recording a job interview with a candidate in Jordan requires the candidate's consent. Article 7 of the Cybercrime Law (Law No. 17 of 2023) punishes anyone who intentionally and "without right" intercepts or records the content of data sent over an information network, with at least six months in prison and a fine of JOD 1,500 to 6,000, and the Personal Data Protection Law No. 24 of 2023 (the PDPL) bars processing personal data without prior consent that is "explicit and authenticated, whether in writing or electronically," unless a listed exception applies. The PDPL also requires a notice before processing, limits transfers abroad and has candidate requests answered within 15 working days. This is the position as of November 2026.

This page adds Jordan to our country series alongside Saudi Arabia, the United Arab Emirates and Qatar. It is for recruiters, agency consultants and hiring managers who interview candidates located in Jordan by video or phone, including from the US. What sets Jordan apart is the form of consent: authenticated in writing or electronically, on a model the regulator publishes.

Jordan's rules at a glance

Is it legal to record a job interview in Jordan?

Yes, with consent, but three statutes sit behind that answer. Article 7(a) of the Cybercrime Law, published in Official Gazette No. 5874, punishes anyone who "intentionally and without right intercepts the flow of data or captures its content," or alters or deletes it, "or records that content," whether sent over the information network, information technology or an information system, with at least six months in prison and a fine of JOD 1,500 to 6,000. Article 7(b) raises this to at least one year and JOD 3,000 to 6,000 for anyone who "discloses, leaks or uses" what the interception produced (our translations). A video or internet-phone interview travels over that network.

Article 56 of the Telecommunications Law says "telephone calls and private communications are confidential matters whose sanctity may not be violated, on pain of legal liability." Article 71 punishes anyone who publishes or spreads the content of a communication or telephone message that they learned of through their job "or recorded without legal grounds," with one month to one year in prison, a fine of JOD 100 to 300, or both (our translations).

The Penal Code adds a third layer. Law No. 27 of 2017 (Official Gazette No. 5479) amended Article 348 bis so that its prison term is "not less than six months" and added a fine of 200 dinars (our translation). We could not open the article's current consolidated text on an official site, so we do not quote it; ask Jordanian counsel how it applies to recorded calls.

None of these texts says whether a participant may record their own call, and we found no official guidance on it. A hidden listener or bot is the clear risk, and the data protection law requires consent anyway.

What does the Personal Data Protection Law require?

The PDPL was published in Official Gazette No. 5881 on September 17, 2023 and, according to MoDEE's FAQs, took effect on March 17, 2024; the one-year grace period in Article 23 has ended. "Processing" includes "collecting, recording, copying, saving, storing," so recordings and transcripts are covered.

• Consent first (Article 4). Data "may not be processed unless the Prior Consent of the Data Subject is obtained, or otherwise in the situations permitted by the Law."
• Narrow exceptions (Article 6). Public bodies, medical care, vital interests, crime, processing required or authorized by legislation or a court, Central Bank entities, research, statistics and data the person made public. None fits private recruiting. Regulation No. 68 of 2025 adds processing "necessary to execute a contract in which the Data Subject is a party," but an interview comes before any contract.
• Notice before processing (Article 9). In writing or electronically: the data and "the date on which the processing will commence," the purpose, the processing period (which "may not be extended unless the Data Subject so consents"), the processor, the security controls and "Information on Profiling."

Is a spoken yes on the call enough?

Probably not on its own. Article 5(A) requires prior consent to be "explicit and authenticated, whether in writing or electronically," "specific as regards duration and purpose," and requested in "clear, simple, and not misleading language." Article 5 of Regulation No. 68 of 2025 requires consent "for each processing purpose, in accordance with the model approved by the Council," and MoDEE publishes a Prior Consent Form listing the purposes, data types, recipients, transfers abroad and retention period. Under Article 5(B), consent given on incorrect or misleading information, or not renewed when the purpose changes, does not count. We found no text saying whether a spoken yes captured on a recording is "authenticated." Send the form, or an electronic version with the same content, with the invitation, keep the signed or ticked copy, and confirm on the call. Recording for assessment, sharing with a client and keeping a profile for future roles are separate purposes.

What counts as sensitive data in an interview?

Article 2 defines sensitive personal data as data indicating "the origin or ethnicity, the political opinions or affiliations, or the religious beliefs," as well as data relating to "the financial position; health, physical, mental, or genetic status; biometrical Data, or the criminal record." Criminal record and financial position, which may reach questions about current pay or debts, are the ones that surface in interviews. Avoid these subjects unless a law requires the check, keep volunteered details out of notes and scorecards, and note that sensitive data triggers the officer and assessment duties below.

Do you need a data protection officer, registration or an impact assessment?

Possibly all three. Article 11 requires a data protection officer where the controller's "primary activity" is processing personal data, where it processes sensitive data or financial information, and where it is "transferring Data Bases outside the Kingdom." A recruitment agency, or any employer sending recordings to a tool hosted abroad, should assume it is covered. The Council's register instructions require controllers to record, within 30 days of the start of actual processing, the purposes, the legal basis, the retention period and location, transfers abroad, security measures, the privacy policy and the consent form used. Article 6 of the 2025 Security, Technical and Organizational Measures Instructions makes a data protection impact assessment mandatory when processing sensitive data "or transferring it outside the Kingdom," updated at least once a year.

What if you interview a candidate in Jordan from the US?

Assume the PDPL applies. It defines a controller as "any natural or legal person, located inside or outside the Kingdom, who has the Data under their custody," and MoDEE's FAQs say the law "applies to the processing of personal data of citizens and residents within the territory of Jordan." The register instructions also provide for a controller that is not Jordanian. Your own state's law governs your side of the call; see two-party consent states.

The transfer rule is strict. Article 15(A) says data "shall not be transferred to a person outside the Kingdom ... if the level of protection such person offers to the Data is less than that provided in this Law," except in listed cases, among them the data subject's "Consent ... on transfer after being made aware that no sufficient level of protection exists." Article 15(B) requires the controller to verify the recipient's protection level before the transfer. Article 17(H) has the Council publish a list of countries and bodies with sufficient protection; MoDEE's FAQs say the Council "will issue" it, and we did not find one on MoDEE's law and instructions page as of November 2026. For a US-hosted tool, document your check of the vendor and name the country in the consent form.

Can you share the recording with a client?

Only with consent. Article 14 says data "shall not be transferred or exchanged between the Controller and any other person, including the Recipient, except with the Consent of the Data Subject," where the transfer serves legitimate interests and the person has "full sufficient knowledge of the Recipient and the purposes." The controller must keep records of each transfer and the consent, and the recipient takes on the controller's duties. Beyond the PDPL, Article 20(a) of the Cybercrime Law punishes, on complaint, anyone who uses a network or platform to publish a recording of "what a person is keen to protect and keep hidden from the public" in order to defame, harm or gain, "even if they obtained" it lawfully, with at least three months in prison and a fine of JOD 20,000 to 40,000 (our translation). Never post interview clips.

Can candidates get the recording, and how long can you keep it?

Article 4(B) gives the candidate the rights to "know, review, access, and get the Data," to withdraw consent, to correct it, restrict it, erase or conceal it, object to unnecessary or discriminatory processing and profiling, and to be told of breaches. Article 3 of Regulation No. 68 of 2025 requires a response "within 15 working days," with any justified extension explained to the person, and Article 8 requires complaints to get a reference number and an answer within 10 working days. Our candidate data access requests guide has a workflow.

On retention, Article 6(B) says processed data "shall not be retained after the fulfilment of the purpose ... unless legislations provide otherwise." Article 7 of the 2025 security instructions requires erasure at the end of the processing period, including backups and copies held by processors outside Jordan, documented in the processor contract. Put the period in the consent form and delete on schedule.

Who enforces the law, and what are the penalties?

The Personal Data Protection Council, chaired by the Minister of Digital Economy and Entrepreneurship, sets policy, issues licenses and decides complaints; MoDEE's Personal Data Protection Directorate receives complaints and monitors compliance under Bylaw No. 95 of 2025. A breach likely to cause severe harm must be notified to affected people within 24 hours and to the Directorate within 72 hours (Article 20). If a warning is ignored, the Council may suspend a license or impose a fine "not exceeding (500) Dinars for each day," capped at 3% of the previous year's revenues (Article 21); courts can add fines of JOD 1,000 to 10,000, doubled for a repeat (Article 22).

Can you use AI note takers or transcription?

Yes, with consent that names the tool, an Article 9 notice that identifies it as a processor and explains any profiling, a processor bound by Article 12 to erase data when the period ends, and a transfer check if it is hosted abroad. Candidates may object to profiling that is unnecessary or discriminatory. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and sends audio in short chunks to a speech-to-text provider that does not retain it; the transcript stays on the computer and is still personal data under the rules above.

A consent line for interviews with candidates in Jordan

قبل أن نبدأ: كما ورد في نموذج الموافقة الذي أرسلناه مع الدعوة، أودّ
أن أستأذنك في [تسجيل هذه المقابلة / استخدام برنامج يحوّل المحادثة إلى
نص مكتوب] لتوثيق إجاباتك بدقة. سنستخدم [التسجيل / النص] لتقييم طلبك
لهذه الوظيفة فقط، ولن يطّلع عليه إلا [مدير التوظيف / العميل]، ويعالجه
[مزوّد الخدمة] في [البلد]، وسنحذفه خلال [المدة] بعد اتخاذ القرار. هل
توافق على ذلك؟ يمكنك الرفض أو سحب موافقتك أو طلب إيقاف التسجيل في أي
وقت، ولن يؤثر ذلك على تقييم طلبك.

(Before we start: as set out in the consent form we sent with the
invitation, I'd like your permission to [record this interview / use
software that turns the conversation into text] to document your
answers accurately. We'll use the [recording / text] only to assess
your application for this role; only [the hiring manager / the client]
will see it; it is processed by [vendor] in [country], and we'll
delete it within [period] after the decision. Do you agree? You can
refuse, withdraw your consent or ask me to stop recording at any time,
and it won't affect how your application is assessed.)

The spoken line confirms the written consent Article 5 asks for; it does not replace it. More wording is in the interview recording consent script.

Checklist before you record interviews in Jordan

• Written or electronic consent, based on MoDEE's Prior Consent Form, collected before the call, one purpose per tick box.
• Article 9 notice: data, start date, purpose, period, processor, security controls, profiling.
• No bots or listeners the candidate does not know about; consent confirmed on the call before recording starts.
• No questions on religion, ethnicity, politics, health, criminal record or finances unless a law requires them.
• Data protection officer, register entry and impact assessment checked, especially for agencies and tools hosted abroad.
• Transfer abroad checked under Article 15 and named in the consent form.
• Requests answered within 15 working days; recordings and backups erased when the period ends.

Interviewing elsewhere in the region? Compare Saudi Arabia, the UAE and Qatar.