Background Checks Under Indonesia's PDP Law: What Employers Need to Do
Indonesia’s Personal Data Protection Law (UU No. 27 of 2022, the “PDP Law”) has applied in full since its two-year transition ended on 17 October 2024. In July 2026 the government issued the long-awaited implementing regulation, PP No. 33 of 2026, which takes effect on 16 January 2027.
For employers who screen candidates, this is the moment to check that background checks are run on a clear legal basis, collect only what the role needs, and treat sensitive records with extra care. This guide sets out what the law says and what a compliant screening process looks like in practice.
What the PDP Law covers
The PDP Law applies to any organisation that processes personal data of people in Indonesia, including employers and the screening providers they use. A background check collects, verifies and stores personal data, so every step falls within the law.
The law sets six lawful bases for processing: explicit consent, performing a contract, a legal obligation, vital interests, a public-interest task, and legitimate interests. For pre-employment screening, most employers rely on the candidate’s explicit written consent, because it is clear, documented and easy to explain.
Sensitive records need extra care
The law defines a category of “specific personal data” that carries higher risk. It includes:
- health data
- biometric and genetic data
- criminal records
- children’s data
- personal financial data
Several of these come up in screening, especially criminal record checks and credit or financial checks for finance roles. Collect them only where the role justifies it, explain why to the candidate, and restrict who can see the results. In January 2026 a civil case in Indonesia involved employees objecting to credit-history checks made without their consent, a reminder that these checks attract scrutiny.
What candidates can ask for
Candidates have rights under the PDP Law, including the right to be informed, to access and correct their data, to withdraw consent, and to have data erased. In practice this means your screening process should:
- tell candidates what will be checked, why, and who will do it
- let them correct errors before a decision is made
- stop processing if consent is withdrawn
- delete screening data once it is no longer needed
Breach notification, DPOs and PP 33/2026
The PDP Law itself already sets these obligations; PP 33/2026 adds detail on how they work. Two points matter most for HR teams:
- Breach notification. Under the PDP Law, a data breach must be notified in writing within 3 x 24 hours to affected individuals and the authority. PP 33/2026 clarifies that the clock starts once the breach has been confirmed.
- Data protection officers. The PDP Law requires a DPO if any one trigger applies, such as large-scale processing of specific data or criminal-related data. Large employers and screening providers should check whether they meet a trigger.
Fines can reach up to 2% of annual revenue, and the law also carries criminal penalties for unlawful collection, disclosure or use of personal data. The dedicated PDP supervisory agency had not started operating as of September 2026, but enforcement through the courts has already begun.
A compliant screening process in five steps
- Scope by role. Decide which checks each role genuinely needs. A junior role rarely needs a credit check; a finance director may.
- Written consent. Get the candidate’s signed consent before any check starts, naming each type of check.
- Verify at the source. Confirm degrees, employment and licences directly with the issuing institution rather than relying on copies.
- Secure handling. Share results only with the people who make the decision, through a secure channel rather than email attachments.
- Retention and deletion. Set a retention period and delete screening data when it ends.
How VERIS runs background checks in Indonesia
VERIS has screened candidates in Indonesia since 2010, today through PT Veris in Jakarta. Every check starts with written consent, is limited to what the role needs, and is verified directly with universities, employers and registries in Bahasa Indonesia. Results are delivered through the VERISChecks platform rather than email.
This article is general information, not legal advice. For decisions about your own obligations, speak to a qualified Indonesian lawyer.
Frequently asked questions
Is a background check legal in Indonesia?
Yes. Background checks are lawful when they have a legal basis under the PDP Law, most commonly the candidate’s explicit consent, and are limited to what the role requires.
Do I need the candidate's consent for a background check?
Consent is the most common and safest basis for pre-employment screening in Indonesia. Get it in writing before the check starts, and list the checks you will run.
Are criminal records sensitive data under the PDP Law?
Yes. Criminal records are “specific personal data” under the law, along with health, biometric, genetic, financial and children’s data. They need a clear justification and restricted access.
When does PP 33/2026 take effect?
The implementing regulation was promulgated on 16 July 2026 and takes effect on 16 January 2027.