Recording job interviews in Indonesia: the PDP Law's consent rules, 72-hour access and Article 258 of the new Criminal Code

Recording a job interview with a candidate in Indonesia is governed by the Personal Data Protection Law (Law No. 27 of 2022, the PDP Law) and, since January 2, 2026, by Article 258 of the new Criminal Code, which punishes unlawfully listening to or recording non-public electronic communications. If you rely on consent, tell the candidate the purpose, data, retention period and their rights first (Article 21), and get a yes in writing or on the recording (Article 22). Candidates can demand access within 3 x 24 hours (Article 32), and the law reaches recruiters abroad whose acts affect Indonesian citizens (Article 2). This is the position as of November 2026.

This page adds Indonesia to our country series alongside Singapore, Malaysia and Thailand. It is for recruiters, agency consultants and hiring managers who interview candidates located in Indonesia by video or phone, including from the US. The PDP Law's two-year adjustment period (Article 74) ended in October 2024, so its obligations apply in full.

Indonesia's rules at a glance

Is it legal to record a job interview in Indonesia?

Yes, openly and on a lawful basis. Article 258(1) of the Criminal Code, in force since January 2, 2026, punishes anyone who "unlawfully listens to, records, diverts, alters, obstructs and/or notes the transmission of non-public electronic information and/or electronic documents," by cable or wireless network, with up to ten years in prison or a fine; Article 258(2) punishes broadcasting or spreading the results the same way. Article 622 of the Code revoked the old interception offense in Articles 31 and 47 of the Electronic Information and Transactions Law and redirected references to it to Article 258.

The official explanation of Article 258 says it protects "the interests of the speaker against a person who unlawfully listens to or records the conversation," and that the word "unlawfully" is there to avoid catching conduct that "properly should not be punished." It does not say outright that a participant may record, so the safe course is the obvious one: record only interviews you take part in, say so, and get the candidate's agreement.

Which legal basis should you use?

Article 20 of the PDP Law requires a basis for every processing, including "explicit valid consent" for stated purposes, fulfilling a contract or "a request of the data subject when about to enter into an agreement," a legal obligation, and "other legitimate interests" weighed against the person's rights. An employer can argue that a recording made to assess an applicant fits the pre-contract or legitimate-interest basis. Consent is easier to prove and fits the specific-data risk below.

If you rely on consent, Article 21 requires you first to tell the candidate the legality and purpose of the processing, the type and relevance of the data, how long documents containing it are kept, the processing period and their rights, and to notify them before any of that changes. Article 22 makes consent "written or recorded," given "electronically or non-electronically," with equal legal force. Where the request covers other purposes too, it must be clearly distinguishable, understandable and in plain language, and a request that breaks these rules is "null and void." Article 24 requires you to show proof of consent. A practical route: send the notice with the invitation, then ask on the call and keep the first seconds of the recording, which is itself recorded consent.

What about health, criminal records and other specific data?

Article 4 separates general data (such as full name, sex, religion and marital status) from "specific" data: health information, biometric and genetic data, criminal records, children's data and personal financial data. Interviews capture health and family details by accident, so do not ask, and keep anything volunteered out of notes and scorecards. Article 34 requires a data protection impact assessment for high-risk processing, which it defines to include processing specific data, "automated decision-making that has legal consequences or significant impact," "evaluation, scoring or systematic monitoring," and "the use of new technology." A tool that scores candidates is likely to need one.

Does the PDP Law reach a recruiter in the US?

It can. Article 2 applies the law to any person, public body or international organization in Indonesia, and to those outside Indonesia whose acts have "legal consequences" in Indonesia or for "Indonesian citizen data subjects" abroad. Your own state's law also governs your side of the call; see two-party consent states.

Transfers abroad follow a three-step order in Article 56: the recipient's country must have protection "equal to or higher than" the PDP Law; if not, you must ensure "adequate and binding" protection; if neither, you must obtain the person's consent. Article 56(5) leaves the details to a government regulation. For a US-hosted recording or transcription tool, put the vendor's contract terms in place and name the country in the notice.

Can candidates get the recording, and how long can you keep it?

Article 32 requires you to give the person access to their data "together with the record of its processing," no later than 3 x 24 hours after receiving the request, a far shorter deadline than the GDPR's month. Article 40 requires you to stop processing within the same 3 x 24 hours after consent is withdrawn. Our candidate data access requests guide has a workflow.

Article 43 requires deletion when the data is no longer needed for the purpose, consent is withdrawn, the person asks, or the data was processed unlawfully, and Article 44 requires destruction when the retention period ends or the person asks. State a period in the notice, tie it to the hiring decision, and delete audio first.

Who enforces the PDP Law, and what are the penalties?

Article 58 assigns enforcement to an agency established by, and answerable to, the President. On July 22, 2026, Komdigi said in Press Release No. 131/HM-KKD/7/2026 that the government was "finalizing the formation" of an independent personal data protection authority, through a presidential regulation targeted for about two months later. Check whether the authority now exists before you rely on its guidance.

Article 57 provides written warnings, suspension of processing, deletion and administrative fines of up to 2 percent of annual revenue or receipts, imposed by that agency, for breaches that include processing without a basis (Article 20), missing consent information (Article 21), no proof of consent (Article 24) and failing to give access (Article 32). Article 67 adds up to five years in prison or a fine of up to IDR 5 billion for unlawfully obtaining or collecting someone else's personal data for gain, causing them loss.

Can you use AI note takers or transcription?

Yes, with notice under Article 21, a basis under Article 20, a transfer route under Article 56 for any vendor abroad, the impact assessment Article 34 requires for scoring or new technology, and deletion on schedule. Ask the vendor where it stores audio and transcripts, how long it keeps them, and whether it trains models on them. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews with candidates in Indonesia

Sebelum kita mulai, saya ingin meminta persetujuan Anda untuk
[merekam percakapan ini / menggunakan perangkat lunak yang mengubah
percakapan ini menjadi teks] agar jawaban Anda tercatat dengan akurat.
[Rekaman / Transkrip] hanya digunakan untuk proses rekrutmen ini,
hanya dibagikan kepada [klien / manajer yang merekrut], disimpan oleh
[penyedia, negara], dan dihapus paling lambat [jangka waktu] setelah
keputusan diambil. Apakah Anda setuju? Anda boleh menolak atau meminta
saya berhenti merekam kapan saja, dan hal itu tidak akan memengaruhi
penilaian lamaran Anda.

(Before we start, I'd like to ask for your consent to [record this
conversation / use software that turns this conversation into text]
so your answers are captured accurately. The [recording / transcript]
is used only for this recruitment, shared only with [the client / the
hiring manager], stored by [vendor, country] and deleted no later than
[period] after the decision. Do you agree? You can refuse or ask me to
stop recording at any time, and it will not affect how your
application is assessed.)

Send the Article 21 information with the invitation. More wording is in the interview recording consent script.

Checklist before you record interviews in Indonesia

• Only calls you take part in are recorded, openly.
• Article 21 information sent before the call: purpose, data, retention period, rights, any client who receives it.
• Consent captured in writing or on the recording, and kept as proof.
• No questions about health, criminal records or finances unless the job and the law require them.
• Impact assessment done before using scoring or other new technology.
• Access requests answered, and withdrawals honored, within 3 x 24 hours.
• US vendors covered by an Article 56 route; recordings deleted when the purpose ends.