Companies hiring in Indonesia can use AI screening under the PDP Law, provided they have a valid legal basis for processing, tell applicants how their data is used, and offer a human review to applicants who object to an automated decision. Law No. 27 of 2022 on Personal Data Protection (the PDP Law, or UU PDP) has been fully in force since October 2024, and its implementing rule, Government Regulation (GR, or PP) 33 of 2026, takes effect on 16 January 2027. This guide is for HR teams that use AI screening for roles in Indonesia, or are choosing a tool now.
This is not legal advice. Use it as a checklist, then confirm the details with your legal team or counsel in Indonesia.
What does the PDP Law say about applicant data?
Applicant data is personal data. Names, phone numbers, education, work history, interview recordings, and test results all count. The company that decides the purpose of recruitment and how the data is processed is the controller. A software vendor that processes data on the company's instructions is a processor.
The PDP Law took effect when it was enacted on 17 October 2022, with a transition period of up to two years (Article 74). Its obligations have applied in full since October 2024. The full Indonesian text is on JDIH BPK.
General and specific data in recruitment
Article 4 splits personal data into general data and specific data. Specific data carries more risk and is one of the triggers for an impact assessment.
| Type of data | Recruitment examples |
|---|---|
| General data | Full name, gender, nationality, religion, marital status, and any combination of data that identifies a person |
| Specific: criminal records | SKCK (police clearance certificate) |
| Specific: health | Medical check-up results, health certificates, drug tests |
| Specific: personal finance | Payslips from a previous employer, bank account numbers |
| Specific: biometric | Fingerprints or face recognition data, when used for identification |
| Specific: children's data | Internship applicants who are minors |
The simplest way to lower risk is to not ask for specific data at the first stage. You only need the SKCK and medical results once a candidate has been selected, long after the first few hundred applications come in.
What legal basis covers applicant data?
Article 20 requires every controller to have a legal basis. The options include explicit consent from the data subject, performing a contract or acting on the data subject's request before a contract, legal obligations, and other legitimate interests.
In recruitment, the basis that is easiest to prove is explicit consent given when the applicant submits the application, with a specific stated purpose. If you want to keep applicant data for future openings (a talent pool), state that purpose separately. Consent to apply for one role may not cover keeping the data for other roles.
Automated decisions and the right to object
Article 10 gives data subjects the right to object to a decision based only on automated processing, including profiling, that has legal effects or a significant impact on them. Article 10(2) leaves the objection procedure to a government regulation. GR 33 of 2026 is the implementing regulation for the PDP Law, so check the article covering objections with your legal team.
A rejected job application can count as a significant impact. Check whether any applications are rejected without a person ever looking at them. If you use a score threshold that rejects applicants automatically, put three things in place:
- A notice telling applicants that first-stage screening is assisted by AI, and which criteria it uses.
- A way for applicants to ask a recruiter to review the decision.
- A written reason for every score, so the recruiter can review it on clear grounds.
When do you need an impact assessment (DPIA) and a data protection officer?
Article 34 requires a data protection impact assessment for high-risk processing. The list includes automated decision-making with legal effects or a significant impact, processing of specific data, large-scale processing, and systematic evaluation, scoring, or monitoring of data subjects. AI screening for high-volume hiring can meet several of these at once. GR 33/2026 sets out the impact assessment in Articles 120 to 122 (Veritask summary, in Indonesian, September 2026).
Article 53 requires a data protection officer in certain cases, for example when the controller's core activities need regular and systematic monitoring of data at scale, or large-scale processing of specific data. An outsourcing or staffing company that processes thousands of applicants a month should ask its lawyers whether this applies.
PDP Law checklist for HR teams using AI screening
These obligations have applied since October 2024. Finish this list before GR 33 of 2026 takes effect on 16 January 2027.
| Obligation | What it means in recruitment | Evidence to keep |
|---|---|---|
| Legal basis (Art. 20) | Applicants agree to processing for a clear purpose | Consent text and the time of consent for each applicant |
| Relevant data only | First-stage forms do not ask for SKCK, medical results, or other specific data | A list of the data requested at each hiring stage |
| Right to object to automated decisions (Art. 10) | A human review route for applicants who object | Written procedure and a log of review requests |
| Impact assessment (Art. 34) | A risk assessment before AI screening is used at volume | The DPIA document, reviewed when the process changes |
| Data subject rights | Applicants can ask to access, correct, or delete their data | A contact for requests and a log of how each was handled |
| Deletion (Art. 43) | Data is deleted when no longer needed or when the applicant asks | Written retention policy and deletion records |
| Cross-border transfer (Art. 56) | You know whether the vendor processes data outside Indonesia | The vendor's written answer on processing location and subprocessors |
| Breach notification (Art. 46) | Written notice within 3 x 24 hours to data subjects and the agency | Incident procedure, including the vendor's duty to tell you |
How long can applicant data be kept?
The PDP Law gives no number for applicant data. Article 43 requires the controller to delete data when it is no longer needed for its purpose, when consent is withdrawn, when the data subject asks, or when the data was obtained unlawfully.
So the company sets its own retention period and must be able to explain it. For example, data from unsuccessful applicants is kept until the role closes, plus a set period to handle questions or objections. Talent pool data is kept longer only if the applicant agrees. Write the policy down, include it in the privacy notice for applicants, and make sure your software can actually carry it out.
Questions to ask an AI screening vendor
Before you choose a vendor, ask for written answers to these questions. A clear answer is worth more than a general claim such as "secure" or "compliant".
- In which country is applicant data stored, and where is it processed by AI models?
- Which subprocessors are used (hosting, file storage, email, voice services, AI models), and how will you be told if the list changes?
- Is your company's data separated from other customers' data?
- How is data encrypted at rest and in transit?
- Can you set the retention period, and what happens when data is deleted: is it erased or only hidden?
- Can the AI reject applicants automatically, and can that be switched off or put behind a human review?
- Does every score come with a written reason you can show an applicant who objects?
- How does the vendor handle access, correction, and deletion requests from applicants?
- How quickly will the vendor tell you about a data breach?
- Does the vendor offer a data processing agreement (DPA)?
Some systems use soft delete, which hides data from view but keeps it stored. Ask which one applies.
How Inhire supports this process
Inhire (inhireai.app) is an AI screening and AI interview platform for high-volume hiring. These parts of Inhire relate to the checklist above:
- When an applicant applies through a careers page, Inhire stores a consent flag and the time of consent for each candidate.
- Each company's data is isolated from other companies at the database level.
- According to Inhire's privacy policy, data is encrypted at rest and in transit (TLS).
- Recruiters set the scoring rubric, the pass threshold, and the dealbreakers for each job. The AI gives scores, reasons, and a shortlist. Recruiters can see the reasons and move any candidate.
- Recruiters can export candidate data.
- Candidates have the right to access, correct, delete, or export their data. Requests go to hi@ideact.id, as stated in the privacy policy.
- Inhire uses third-party providers for hosting, file storage, voice interviews, email, and AI scoring, as described in the privacy policy.
Companies can also turn on automatic score thresholds. If you use them, make sure the human review procedure for applicants who object is ready. For questions such as where data is processed and how long it is kept, ask the Inhire team for written answers, as you would with any other vendor.
The full screening workflow is on the AI candidate screening page, and the split of work between AI and recruiters is covered in automated candidate screening. If you are comparing vendors, see also how to choose AI interview software.
Where the regulation stands in October 2026
GR 33 of 2026 was enacted on 16 July 2026 and takes effect six months later, on 16 January 2027 (Katadata, in Indonesian, 3 September 2026). The personal data protection supervisory agency had not been formed as of September 2026, and an analyst quoted by Bisnis.com said the rules cannot work well without it (Bisnis.com, in Indonesian, 8 September 2026). The PDP Law's obligations still apply, and administrative fines can reach 2% of annual revenue or income, assessed against the variables of the violation (Article 57(3)).
We will update this article when the supervisory agency is formed or new implementing rules come out.
