Kenya interview recording laws: the Data Protection Act, sensitive family details and US transfers

Kenya's Constitution protects the privacy of communications, and the Data Protection Act, 2019 governs what you do with an interview recording or transcript. Before you collect the data you must tell the candidate it is being collected, why, who receives it and what their rights are (section 29); you need a lawful basis such as consent (section 30); and the Act reaches recruiters outside Kenya who process data of people in Kenya (section 4). Family details and marital status are sensitive personal data, and candidates can demand a copy within seven days. This is the position as of November 2026.

This page adds Kenya to our country series alongside South Africa, the UK and Canada. It is for recruiters, agency consultants and hiring managers who interview candidates located in Kenya by video or phone, including from the US. Kenya's statute is modeled on the same ideas as the GDPR, but some of its rules are stricter or more specific, especially on sensitive data and timelines.

Kenya's rules at a glance

Is it legal to record a job interview in Kenya?

Yes, if you handle the recording as the Data Protection Act requires. Article 31 of the Constitution gives every person the right to privacy, which includes the right not to have "information relating to their family or private affairs unnecessarily required or revealed" or "the privacy of their communications infringed." Recording a call you are not part of, or recording without the candidate knowing, is exactly what that article is aimed at.

A recording or transcript of an interview is the candidate's personal data, so the Data Protection Act, 2019 (No. 24 of 2019, in force since November 25, 2019) applies. Its principles in section 25 require processing "in accordance with the right to privacy of the data subject," lawfully, fairly and transparently, for "explicit, specified and legitimate purposes," limited to what is necessary, and kept no longer than necessary.

Does the Act apply if you interview from the US?

Yes. Section 4 applies the Act to a data controller or processor "established or ordinarily resident in Kenya" and also to one "not established or ordinarily resident in Kenya, but processing personal data of data subjects located in Kenya." A US employer, agency or interviewer who records or transcribes a candidate sitting in Kenya is in scope. Your own state's law also governs your side of the call; see two-party consent states. If you are established in Kenya, check whether section 18 and the registration regulations require you to register with the Data Commissioner.

What must you tell the candidate before you record?

Section 29 requires a data controller, "before collecting personal data, in so far as practicable," to inform the person of their rights under section 26, "the fact that personal data is being collected," the purpose, the third parties the data will go to and the safeguards adopted, the controller's contacts, the security measures, whether providing the data is voluntary or mandatory, and the consequences of not providing it. For an interview, that means a short spoken notice at the start ("I'd like to record and transcribe this call to assess your application") backed by a written candidate privacy notice in the invitation that covers the rest. Regulation 4(2) of the General Regulations confirms that consent information may be given "through a written notice, oral statement, audio or video message."

Which lawful basis covers the recording?

Section 30(1) allows processing on the person's consent "for one or more specified purposes," or where it is necessary, among other grounds, "in order to take steps at the request of the data subject before entering into a contract," or for legitimate interests, "except if the processing is unwarranted" given the harm to the person. Regulation 5(2) of the Data Protection (General) Regulations, 2021 adds that processing on one of those non-consent grounds "shall only rely on one legal basis for processing at a time, which shall be established before the processing." Decide your basis before the call and write it down.

If you rely on consent, the Act puts the burden of proof on you (section 32(1)), the candidate can withdraw at any time (section 32(2)), and regulation 4(4) says consent is not freely given where, among other things, the person "is unable to refuse or withdraw their consent without detriment" or where several purposes are merged without specific consent for each. So ask separately for any extra use, such as sharing the recording with a client or keeping it for future roles, and have a way to continue the interview with handwritten notes.

Why do family details in an interview matter so much in Kenya?

Because the Act treats them as sensitive personal data. Section 2 defines sensitive personal data as data revealing a person's "race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of the person's children, parents, spouse or spouses, sex or the sexual orientation." Candidates often mention a spouse, children or health in passing, and a recording captures it. Section 45 limits the grounds for processing sensitive data, and section 49(1) says sensitive personal data may be processed outside Kenya "only ... upon obtaining consent of a data subject and on obtaining confirmation of appropriate safeguards."

Section 25(e) also says personal data should be "collected only where a valid explanation is provided whenever information relating to family or private affairs is required." Keep interviews on job-related ground, do not ask about family or marital status, and leave anything sensitive a candidate volunteers out of your notes and scorecard.

Can candidates get the recording or the transcript?

Yes. Section 26(b) gives a data subject the right to access their personal data held by a controller or processor. Regulation 9 sets the mechanics: the candidate is entitled to the purposes of processing, the categories of data, the recipients "including recipients in other countries," and the storage period; the controller may "provide the data subject with a copy of their personal data"; and regulation 9(4) requires compliance "within seven days of the request." That is far shorter than the GDPR's one month, so build a fast route to find a candidate's recording, transcript and notes. Section 40 adds rights to have inaccurate or unlawfully held data rectified or erased. Our candidate data access requests guide has a workflow.

How long can you keep interview recordings?

Section 39(1) allows retention "only as long as may be reasonably necessary to satisfy the purpose," unless retention is required or authorized by law, reasonably necessary for a lawful purpose, or consented to by the person. Regulation 19 requires a retention schedule that states the purpose, the retention period, a periodic audit and what happens after it, and requires you to "erase, delete anonymise or pseudonymise personal data upon the lapse of the purpose." Set a period tied to the hiring decision, write it into the schedule, and delete audio first. Our retention policy template gives the structure.

Can you send recordings to a US vendor or system?

Only on the conditions in Part VI. Section 48 allows a transfer to another country only where the controller "has given proof to the Data Commissioner on the appropriate safeguards," or where the transfer is necessary, for example for "pre-contractual measures taken at the data subject's request" or for compelling legitimate interests not overridden by the person's rights. Section 25(h) states the same idea as a principle: data should not be transferred outside Kenya "unless there is proof of adequate data protection safeguards or consent from the data subject." For a US-hosted recording, note-taking or applicant tracking tool, document the safeguards in your vendor contract, and get the candidate's consent where the recording holds sensitive data (section 49).

Can you use AI note takers or transcription?

Yes, with the same notice, basis, transfer and retention steps. Section 35(1) gives a person the right "not to be subject to a decision based solely on automated processing, including profiling," that significantly affects them, so keep a human decision on every candidate and do not let a tool's score reject anyone on its own. Regulation 49 of the General Regulations lists "automated decision making with legal or similar significant effect" and "innovative use or application of new technological or organizational solutions" among the high-risk operations that need a data protection impact assessment before processing starts, which an AI interview tool may trigger. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above. For questions to ask any vendor, see is it legal to use AI note takers in interviews.

A consent line for interviews with candidates in Kenya

"Before we start: I'd like to record and transcribe this call so I can
focus on you and keep an accurate record for assessing your
application. The recording is used only for this hiring process,
shared only with [the hiring manager / our client], stored with
[vendor] in [country], and deleted [period] after a decision. Please
don't share details about your family or health; they aren't needed.
Are you okay with this? You can say no or ask me to stop at any time,
and it won't affect your application."

English is an official language of Kenya alongside Kiswahili; offer the notice in Kiswahili if the candidate prefers. More wording is in the interview recording consent script.

Checklist before you record interviews in Kenya

• Section 29 notice given before recording: purpose, recipients, rights, security, and what happens if the candidate declines.
• One lawful basis chosen and documented before the call; consent asked separately for any extra use.
• No questions about marital status, family or health; sensitive details kept out of notes.
• Safeguards documented for any vendor outside Kenya; consent where sensitive data travels.
• Access requests answered within seven days with a copy of the recording or transcript.
• Retention schedule written; audio deleted early; transcripts deleted when the purpose lapses.
• A human makes every hiring decision; impact assessment done for new AI tools.