Nigeria interview recording laws: the NCC interception rules, the NDPA 2023 and the NDPC directive

Nigeria's Constitution protects the privacy of telephone conversations, and the Nigerian Communications Commission's Lawful Interception of Communications Regulations, 2019 make interception an offense except where the regulations allow it, including where "one of the parties to the communication has consented," with "incontrovertible proof." The Nigeria Data Protection Act, 2023 (NDPA) then governs the recording and transcript, including for recruiters outside Nigeria, and the Nigeria Data Protection Commission's 2025 directive asks employers to put consent first. Tell the candidate, ask, and keep proof of the yes. This is the position as of November 2026.

This page adds Nigeria to our country series alongside Kenya, South Africa and the UK. It is for recruiters, agency consultants and hiring managers who interview candidates located in Nigeria by video or phone, including from the US, and for agencies that place Nigerian candidates with overseas clients.

Nigeria's rules at a glance

Can you record a call you are part of in Nigeria?

Yes, on the right footing. Section 37 of the 1999 Constitution says: "The privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected." The NCC's Lawful Interception of Communications Regulations, 2019 (S.I. No. 14 of 2019, made under the Nigerian Communications Act, 2003) then provide in regulation 5 that, except as the regulations or other legislation provide, "it shall be an offence to intercept any Communication in Nigeria." Regulation 16 sets a fine of five million naira for failing to comply.

Regulation 8 lists when interception without a warrant is lawful. The first case is where "one of the parties to the communication has consented to the interception, provided that an incontrovertible proof of such consent is available." The regulations' definition of interception is aimed at making the contents of a communication available, while it is being transmitted, "to a person other than the sender or intended recipient." A recruiter recording their own interview is an intended recipient; a colleague or a service listening in is not. Because the regulation asks for "incontrovertible proof" of consent, the practical rule is simple: ask the candidate on the recording or in writing, and keep that proof with the file.

Does the Nigeria Data Protection Act apply if you interview from the US?

Yes. Section 2(2) of the Nigeria Data Protection Act, 2023 applies it where the controller or processor is "domiciled in, resident in, or operating in Nigeria," where processing "occurs within Nigeria," or where the controller or processor "is not domiciled in, resident in, or operating in Nigeria, but is processing personal data of a data subject in Nigeria." A recording or transcript of a candidate in Nigeria is their personal data, so a US employer or agency is in scope. Your own state's law also governs your side of the call; see two-party consent states.

Which lawful basis should you use?

Section 25(1) lists the lawful bases: consent "for the specific purpose or purposes," or necessity, including "to take steps at the request of the data subject prior to entering into a contract" and legitimate interests. Section 25(2) says interests are not legitimate where they override the person's rights, or where "the data subject would not have a reasonable expectation that the personal data would be processed in the manner envisaged."

The NDPC's General Application and Implementation Directive (GAID) 2025, issued on March 20, 2025, leans toward consent. Article 17(1) calls it "prudent for a data controller to prioritise the interest of the data subject which may be effectively addressed through his or her informed consent," and Article 17(5) says reliance on a basis other than consent, without the justifications the directive lists, "shall be strictly scrutinised" in compliance audits. Article 26 asks controllers to "cautiously consider" legitimate interest and to complete a legitimate interest assessment first. For interview recordings, consent is the natural choice.

If you rely on consent, section 26 of the Act puts the burden of proof on you, says "silence or inactivity of the data subject shall not constitute consent," requires you to tell the candidate about the right to withdraw before they agree, and allows consent "in writing, orally, or through electronic means." Article 17(7) of the GAID adds that withdrawing must be as easy as giving consent and that "refusal of consent is not detrimental to the rights and interests of the data subject." Offer to continue with handwritten notes.

What must you tell the candidate before the interview?

Section 27(1) requires a controller, before collecting personal data directly from the person, to give its identity and contact details, "the specific lawful basis of processing" and the purposes, the recipients, the person's rights, "the retention period for the personal data," the right to complain to the NDPC, and the existence of automated decision-making with its significance and consequences. Article 27(2) of the GAID mentions interviews directly: where a privacy policy cannot be provided at "interviews or interactions," or the person could not understand it without an interpreter, the controller "shall provide the information in the form that the data subject can understand." Article 27(4) adds that giving information "does not constitute a request for consent," so the notice and the question are two steps. In practice: a written candidate privacy notice in the invitation, then a spoken summary and a clear question at the start of the call.

What counts as sensitive data in an interview?

The Act defines sensitive personal data as data relating to genetic and biometric data used to identify a person, race or ethnic origin, religious or similar beliefs, health status, sex life, political opinions or affiliations, trade union membership, and other information the Commission prescribes. Section 30 limits the grounds for processing it, and Article 18(1)(b) of the GAID says consent is required "for the processing of sensitive personal data." Do not ask about these subjects, and leave anything a candidate volunteers, such as a health condition or their religion, out of the notes and the scorecard.

Can candidates get the recording or transcript?

Yes. Section 34(1) gives a data subject the right to obtain from a controller, "without constraint or unreasonable delay," confirmation that their data is being processed, the purposes, the recipients "particularly recipients in third countries," the storage period, and "a copy of data subject's personal data in a commonly used electronic format." Section 34 also covers correction and erasure. Keep recordings, transcripts and interviewer notes where you can find them by candidate; our candidate data access requests guide has a workflow.

How long can you keep interview recordings?

Section 24(1)(d) requires personal data to be "retained for not longer than is necessary to achieve the lawful bases for which the personal data was collected." Because section 27(1)(e) requires you to tell the candidate the retention period up front, decide it before the first interview: for example, audio deleted soon after the decision and the transcript a set period later. Our retention policy template gives the structure.

Can you send recordings to a US vendor or system?

Only on the Act's transfer conditions. Section 41(1) bars transferring personal data from Nigeria unless the recipient "is subject to a law, binding corporate rules, contractual clauses, code of conduct, or certification mechanism that affords an adequate level of protection," or a section 43 condition applies, such as consent "after having been informed of the possible risks" or necessity "to take steps at the request of a data subject, prior to entering into a contract." Section 41(2) requires you to record the basis for each transfer. Article 18(1)(e) of the GAID goes further: consent is required "before personal data may be transferred to a country in respect of which the Commission has not made an adequacy decision." For a US-hosted recording, transcription or applicant tracking tool, get the candidate's informed consent to the transfer and keep the vendor's contract terms on file.

Can you use AI note takers or transcription?

Yes, with the same notice, consent and transfer steps. Section 37 of the Act gives a person the right not to be subject to a decision "based solely on automated processing of personal data, including profiling," with legal or similar effects, and Article 18(1)(f) of the GAID requires consent before such a decision. Article 43 asks anyone deploying artificial intelligence to process personal data to carry out a data privacy impact assessment and to file its parameters with the Commission as part of its compliance audit return. Keep a human decision on every candidate. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above. If you interview on WhatsApp, see how to record a WhatsApp interview.

A consent line for interviews with candidates in Nigeria

"Before we start: I'd like to record and transcribe this call so I can
focus on you and keep an accurate record for assessing your
application. The recording is used only for this hiring process,
shared only with [the hiring manager / our client], stored with
[vendor] in [country], and deleted [period] after a decision. Because
it is stored outside Nigeria, I need your agreement for that too. You
can say no or ask me to stop at any time, and it won't affect your
application. Do you agree?"

Keep the candidate's answer on the recording or in your system as proof of consent. More wording is in the interview recording consent script.

Checklist before you record interviews in Nigeria

• Only interviews you take part in are recorded; consent asked and proof kept.
• Section 27 notice in the invitation: identity, lawful basis, purposes, recipients, rights, retention period, complaint right.
• A spoken summary at the start, in a form the candidate understands, and a separate question.
• Informed consent to any transfer to a US vendor, and the basis for each transfer recorded.
• No questions on health, religion, ethnicity, politics or union membership.
• Copies supplied promptly in a common electronic format on request.
• An impact assessment for AI tools, and a human decision on every candidate.