The French Labour Code focuses on the method used. Article L1221-8 requires that the candidate be "expressly informed, before they are implemented, of the recruitment assistance methods and techniques used in their regard", that the results remain confidential and that the methods be relevant to the purpose pursued. Article L1221-9 adds that no information concerning the candidate personally may be collected through a method that has not been disclosed to them beforehand. A recording, an automatic transcript or an AI analysis logically fall within this scope, which is why they should be presented before the interview.
The GDPR, for its part, deals with the data. Its Article 13 lists the information to be provided "at the time when personal data are obtained", and Article 12 requires that it be presented in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
The CSE (comité social et économique, the French works council) is also involved. Under Article L2312-38 of the French Labour Code, it is informed, before they are used, of the methods or techniques used to assist in recruiting candidates and of any change to them. Adding an interview recording or analysis tool to an existing process falls under this duty to inform.
For an interview, the Article 13 list translates as follows.
- Who processes the data. The hiring company (or the agency, depending on the arrangement), with its contact details and those of the DPO if there is one.
- Why. To keep an accurate record of the conversation, write the interview report and, where applicable, produce an AI-assisted summary. Each separate purpose must be listed, in particular keeping the data in a talent pool for other roles.
- On what basis. The legal basis chosen and, if it is legitimate interest, the interest pursued.
- Who receives it. The recruiters and managers involved, the end client for an agency, and the technical providers (transcription tool, applicant tracking software).
- Where. If data is transferred outside the European Union, the transfer and its safeguards must be mentioned.
- For how long. A period or, failing that, the criteria used to determine it. The CNIL states that when an application is unsuccessful, adding it to a talent pool is possible if retention does not, as a rule, exceed two years from the last contact and if the candidate has been informed.
- Which rights. Access, rectification, erasure and restriction, plus objection and portability depending on the legal basis, and the option to lodge a complaint with the CNIL (the French data protection authority).
- Automated decision-making. Where it exists, meaningful information about the logic involved, as well as the significance and the envisaged consequences for the candidate (Article 13(2)(f)).
Both texts place the information before the collection. Announcing the recording once it has already started comes too late under the Labour Code. The CNIL also describes filming or recording a job interview without informing the candidate beforehand as unfair collection.
In practice, the most robust approach works in two steps. A written notice comes with the interview invitation (email or calendar invite) and links to the full privacy policy. An oral reminder then opens the interview, before the recording starts, and gives the candidate time to ask a question or refuse. The written notice also serves as evidence, since the controller must be able to demonstrate compliance with the GDPR (Article 5(2)).
For a phone interview, the announcement is made at the start of the call, before recording begins, with a link or an address where the full notice can be read.
These texts are starting points, to be adapted to your actual processing (purposes, legal basis, recipients, retention periods).
In the written invitation
To give you our full attention, we record the interview and have it transcribed. The transcript is used to write the interview report, which is shared with [the hiring manager / our client]. A summary is prepared with the help of an artificial intelligence tool, and the decision is still made by a person. If your application is not successful, we keep this information for no more than two years after our last exchange so we can offer you other roles, unless you object. Details of your rights and our contact information are available here: [link]. You can tell us at any time that you would prefer an interview without recording.
Orally, before starting the recording
As mentioned in the invitation, I am going to record our conversation to write up the interview report. The recording is used only for your application and our talent pool, and you can ask to access it or have it deleted. Is that all right with you?
On the phone
This call will be recorded and transcribed for recruitment purposes. You can find our contact details and your rights at [address]. If you do not want to be recorded, please say so now.
A transcript followed by an AI-assisted summary must be presented as such. Calling it a "note-taking tool" when the software also produces an assessment of the candidate meets neither the Labour Code's requirement for express information nor the GDPR's transparency obligation.
If the tool alone makes a decision that produces legal effects or significantly affects the candidate (an automatic rejection, for example), Article 13(2)(f) requires meaningful information about the logic involved and its consequences. If a recruiter makes the decision, saying so clearly reflects how the processing actually works and reassures the candidate.
Regulation (EU) 2024/1689 on artificial intelligence classifies systems intended for the recruitment and selection of people as high-risk (Annex III, point 4, and recital 57). Its Article 26(11) requires deployers of these systems that make decisions about people, or help make them, to inform those people that they are subject to them. Regulation (EU) 2026/1744 of 8 July 2026, known as the AI omnibus, set 2 December 2027 as the application date of these obligations for Annex III systems, including those in the field of employment. Adding the AI mention to the invitation now avoids having to rework every template later.
- Relying on the tool to give notice. An automatic message in the video call or an assistant's thumbnail does not replace the information owed by the hiring organisation.
- Pointing to a general privacy policy that says nothing about recording or analysis. The candidate must be able to understand what is done with this particular interview.
- Writing "for as long as necessary" instead of a period. Article 13 asks for a period or, where that is not possible, the criteria used to determine it.
- Leaving out recipients, in particular an agency's end client or the applicant tracking software where the interview report will be stored.
- Keeping quiet about reuse in the talent pool. Keeping the interview for other roles is a purpose in its own right, to be announced from the start.
- Not planning for refusal. A recruiter who cannot run the interview without recording leaves the candidate with a choice that is no real choice.
This page provides a general framework. For a specific case, have your notices reviewed by your DPO or a lawyer.
The controller. The CNIL recruitment guide classifies as a processor an agency that, under a recruitment process outsourcing (RPO) arrangement, only applies the instructions of the client company, which remains the controller. An agency that feeds its own talent pool or CV database determines its own purposes and, as a rule, acts as controller for that processing. In every case, the candidate must know that their interview report will be passed on to the client.
Article 12 of the GDPR provides that information is given in writing or by other means, including electronically where appropriate. An oral announcement on its own is hard to prove and does not let the candidate reread their rights. The safest approach combines a written notice sent with the interview invitation and an oral reminder.
Yes, when the company has a CSE (works council) with this remit. Article L2312-38 of the French Labour Code provides that it is informed, before they are used, of the recruitment assistance methods or techniques and of any change to them. The CNIL also points this out in its recommendations to recruiters.
Yes, under the right of access. The CNIL points out that a candidate can obtain a copy of the personal information about them used in the recruitment process, simply by asking and without having to give a reason. Article 12 of the GDPR sets a response time of one month from receipt of the request, which can be extended by two months given the complexity and number of requests, provided the person is told within the first month.
If reuse for other roles was announced at the first interview, it is one of the purposes the candidate already knows about. If not, Article 13(3) of the GDPR requires that they be informed of this new purpose before their data is processed for it. The two-year period the CNIL recommends for a talent pool runs from the last contact.