03 / Compliance Landscape
UU PDP is fully enforceable. Criminal penalties apply.
Law No. 27/2022 on Personal Data Protection is in force. Transition period ended October 2024. The dedicated PDP Agency is targeted for mid-2026 launch.
UU PDP 27/2022: the binding compliance framework
Criminal penalties up to 5 years imprisonment. Cross-border data transfers restricted.
What's happening
UU PDP No. 27/2022, effective 1 January 2024, establishes Indonesia's comprehensive personal data protection framework. Two-year transition period ended October 2024. Full enforcement now applies.
Why it matters
This is not a civil-only regime. Unlawful collection of personal data carries criminal penalties of up to 5 years imprisonment and IDR 5 billion in fines. BGV vendors operating in Indonesia must demonstrate documented compliance.
Where it breaks
Vendors processing Indonesian candidate data on foreign servers without documented assessment. Cross-border transfers under Articles 39-40 are restricted. KOMINFO notification may be required.
Reality insight
The dedicated PDP Agency (Lembaga PDP) is targeted for mid-2026 launch, replacing KOMINFO oversight. Enforcement will intensify. Vendors without documented UU PDP compliance are a liability.
5 yrs
Maximum prison term
For unlawful collection or processing of personal data
IDR 5B
Maximum fine
Approx. USD 310K at current rates
6 yrs
Creating false data
Prison term for fabricating personal data, plus IDR 6B fine
Mid-2026
PDP Agency launch
Dedicated supervisory body replacing KOMINFO oversight
SKCK criminal records: specific personal data classification
- Criminal records classified as "specific personal data" under UU PDP, requiring heightened handling obligations including explicit consent and purpose limitation.
- SKCK (Police Certificate of Good Conduct) is candidate-initiated. Employers cannot access criminal records directly. The individual must personally apply at their local police station.
- Discrimination risk: automatic disqualification based solely on criminal history may violate Indonesian labour law protections. Case-by-case assessment is required.
Cross-border data restriction
UU PDP Articles 39-40 restrict international data transfers. Employer BGV programmes must document data processing location. Processing or storing Indonesian candidate personal data on foreign servers requires documented assessment and may require KOMINFO notification. Vendors should clarify their data residency and cross-border transfer policy.
KOMINFO compliance requirements
- Explicit written consent required for screening before any check begins.
- Reasonable security measures must be implemented and documented.
- 72-hour breach notification: data subjects must be notified within 72 hours of discovery.
- Data retention schedule: recommended practice is to purge post-hire decision + 12 months.
Procurement implication
If your BGV vendor processes Indonesian candidate data outside Indonesia, your programme may be non-compliant with UU PDP cross-border transfer restrictions. Ask your vendor where data is processed and stored, and whether they have documented KOMINFO notification for cross-border transfers.
Decision trigger
Can your vendor produce a documented UU PDP compliance programme, including data residency documentation, cross-border transfer assessment, and 72-hour breach notification protocol?
04 / Operational Gaps
Every check type has its own dependency chain, and the archipelago multiplies every delay
Java vs. outer islands: two fundamentally different operating environments. Constraints are geographic and structural.
Verification process: where it stalls
1
Candidate consent
UU PDP compliant
2
Identity (KTP)
KTP + NPWP cross-ref
3
Employment
BPJS + HR confirm
Stall: informal sector gaps
4
Education
PDDikti + registrar
Stall: private institution gaps
5
Criminal
SKCK from Polri
Gap: candidate-initiated
6
Address
Field visit
Stall: inter-island travel
Identity: the dual-ID cross-reference discipline
- KTP (National ID): 16-digit unique identity number, biometric-linked. e-KTP (electronic version) increasingly standard. Issued by Dukcapil (Civil Registry).
- NPWP (Tax ID): 16-digit tax identifier issued by Directorate General of Taxes. Cross-reference with KTP is critical: discrepancies indicate potential fraud or identity issues.
- Passport: acceptable for identity but not primary for domestic employment screening.
Employment: BPJS is the centralised trace
- BPJS Ketenagakerjaan (employment social insurance) maintains comprehensive contribution records. Most formal employers are registered. Provides a reliable, centralised employment trace.
- Direct HR contact: employment letter, contract, or HR portal verification. Most BPO and IT companies support direct verification.
- Gaps: informal-sector and contractual workers may lack BPJS records. HR confirmation alone may be the only source.
Education: PDDikti as first-pass, not definitive source
- PDDikti database: Ministry-operated national database of higher education institutions, programmes, and graduate records. Free public access for verification.
- Coverage is improving but not universal: smaller private universities and polytechnics may have incomplete or delayed data uploads. A degree not appearing in PDDikti does not automatically indicate fraud.
- Direct registrar confirmation remains the gold standard: PDDikti should be treated as a first-pass screening tool. Direct registrar contact is still required for definitive verification.
PDDikti verification workflow
Best practice: search PDDikti first. If the institution and programme appear with matching graduate records, this constitutes strong initial verification. If the institution appears but graduate records are missing, or if the institution does not appear at all, escalate to direct registrar contact. Never treat a PDDikti miss as automatic grounds for adverse action.
Criminal: candidate-initiated, geographically decentralised
- SKCK (Surat Keterangan Catatan Kepolisian): Police Certificate of Good Conduct issued by Polri. Candidate must personally apply at their local police station.
- Valid for 6 months only: for programmes with extended onboarding timelines, SKCK may need to be re-obtained.
- Bilingual format: issued in Bahasa Indonesia and English, directly usable for international reporting.
- Geographic limitation: issued by the police station at the candidate's registered address. Candidates who have lived in multiple jurisdictions may need multiple SKCKs.
Address: the archipelago factor
- Physical field-visit exercise: Jakarta, Surabaya, and major cities have robust field networks.
- Outer-island verification: requires inter-island travel by ferry or small aircraft. A single field visit that takes 2 hours in Jakarta may take 2 days in Maluku or Papua.
- Distributed subcontractor networks: no single vendor maintains in-house staff across all 34 provinces. Local knowledge and language capabilities are essential.
turnaround time by check
Realistic TAT range per check type (days)
Observed ranges across Indonesia IT-BPO programmes, 2024-2025. Gold marker = typical median.
IdentityKTP + e-KTP verification
0-1 days
EmploymentBPJS + HR confirm
2-4 days
EducationPDDikti + registrar
2-8 days
CriminalSKCK from Polri
2-5 days
Address, urbanfield-visit, Jakarta/Surabaya
2-4 days
Address, outer islandsfield-visit, inter-island
5-10 days
Source: OutsourceVerify Indonesia operating data, IT-BPO programmes, 2024-2025.
What companies assume
Uniform TAT across all of Indonesia
PDDikti confirms all education credentials
SKCK is employer-accessible
KTP alone is sufficient for identity verification
Field visits are straightforward nationwide
5-7 day SLA covers all candidates
What actually happens
Java: 5-7 days. Outer islands: 8-21 days. Geography drives TAT, not process.
PDDikti has coverage gaps. Private institutions and recent graduates may not appear. Registrar contact still required.
Candidate-initiated only. Employer cannot query criminal records directly. SKCK valid for 6 months.
KTP + NPWP cross-reference is critical. Discrepancies are a primary fraud signal at 2.3% detection rate.
Outer-island field visits may require inter-island travel by ferry or small aircraft. 2 hours in Jakarta, 2 days in Maluku.
A vendor quoting uniform national TAT is either excluding outer-island candidates or underrepresenting complexity.
Decision trigger
When your vendor reports "completed" on an education check, does that mean PDDikti lookup alone or registrar confirmation? Do you know the difference?
05 / Decision Impact
Three scenarios. Three different risk exposures.
Your operating context determines your verification risk. Each scenario below maps to a distinct failure mode in the Indonesian market.
Multi-Island Operations
Hiring across Java and outer islands simultaneously. TAT variability compounds with geographic spread. Outer-island candidates create SLA outliers that break reporting averages.
Risk: National TAT averages mask geographic-specific delays and verification depth gaps.
High exposure
Market Entry into Indonesia
First BPO or IT services engagement. No baseline for what "good" looks like. Vendor selection based on price and SLA alone without understanding archipelago complexity.
Risk: Verification programme designed for Java only, leaving outer-island hiring uncovered.
High exposure
UU PDP Compliance Audit
Client or regulatory audit requires evidence of UU PDP compliance. Data residency, cross-border transfer documentation, and consent capture under scrutiny.
Risk: Vendor cannot produce data processing location evidence, cross-border transfer assessments, or 72-hour breach notification protocols.
Medium-high exposure
Decision trigger
The right question is not "which vendor is cheapest." It is: does the vendor have field infrastructure across the archipelago, and can it prove UU PDP compliance under audit?
Executive Intelligence Summary
Indonesia: 7 conclusions for decision-makers
The archipelago is the defining constraint. 17,000+ islands, 34 provinces. Java and outer islands are fundamentally different operating environments. Any vendor quoting uniform national TAT is misrepresenting complexity.
KTP/NPWP cross-reference is the primary fraud detection lever. Indonesia's dual-ID landscape creates a verification discipline most markets lack. Vendors verifying KTP alone miss the 2.3% identity discrepancy signal.
Distance education fraud is the highest-frequency red flag at 2.8%. Programme-level accreditation must be verified separately from institution accreditation. PDDikti alone does not catch this.
UU PDP carries criminal penalties, not just civil fines. Up to 5 years imprisonment for unlawful data processing. Cross-border data transfer restrictions apply. The PDP Agency launches mid-2026.
BPJS Ketenagakerjaan is the centralised employment trace. Most formal employers are registered. Contribution gaps at 2.1% detection rate reveal unreported employment breaks or informal-sector periods.
SKCK is candidate-initiated, not employer-accessible. Criminal record screening requires the candidate to voluntarily obtain the certificate. Valid for 6 months only. Geographic limitation applies.
Vendor evaluation must test for archipelago infrastructure. Ask for TAT breakdowns by geography, field-visit infrastructure outside Java, subcontractor network coverage, and UU PDP data residency documentation.
Country benchmark
Indonesia Verification Benchmark Pack
Market-specific constraints, institutional access data, typical timelines, and source verification pathways. PDF format, designed for internal circulation.
Request benchmark
Delivery in this market
Verification in this jurisdiction is executed by a regional cell with direct institutional access, operating under our central programme office. Cases run in parallel with other active markets. Evidence standards, quality gates, and escalation protocols are identical regardless of geography. Surge capacity is pre-built, not assembled on demand.
About this brief. Reflects the regulatory and operational landscape as of May 2026. Workforce data sourced to Indonesian BPO Association (KASINDO). TAT ranges and red flag detection rates are first-party operating data from OutsourceVerify programmes, presented as observed ranges. Archipelago geography and inter-island logistics vary by route and candidate location.
References
- Indonesian BPO Association (KASINDO): IT-BPO sector statistics and workforce estimates. https://www.kasindo.or.id
- Law No. 27 of 2022 on Personal Data Protection (UU PDP): official text (Indonesian). kominfo.go.id
- Ministry of Communication and Information Technology (KOMINFO): UU PDP regulator and guidance authority. https://kominfo.go.id
- BPJS Ketenagakerjaan (Employment Social Insurance): contribution records and member portal. https://www.bpjsketenagakerjaan.go.id
- DIKTI (Directorate General of Higher Education): education accreditation authority. dikti.kemdikbud.go.id
- PDDikti (Higher Education Database): comprehensive institution and programme database. pddikti.kemdikbud.go.id
- Polri (Indonesian National Police): SKCK issuance and criminal records. https://www.polri.go.id
- OJK (Financial Services Authority): SLIK credit information system regulator. https://www.ojk.go.id
- Dukcapil (Directorate General of Civil Registration): KTP and e-KTP issuance; civil registry. dukcapil.kemendagri.go.id
- Directorate General of Taxes: NPWP tax ID issuance and records. pajak.go.id
- Ministry of Foreign Affairs (KEMLU): Passport issuance. kemlu.go.id
- Ministry of Home Affairs (KEMENDAGRI): Civil registry and Dukcapil administration. kemendagri.go.id
- Ministry of Education and Culture: higher education oversight and DIKTI administration. kemdikbud.go.id
- BPJS Kesehatan (Health Social Insurance): health insurance records (supplementary for employment verification). https://www.bpjs-kesehatan.go.id
- Ministry of Justice and Human Rights: SKCK coordination and oversight. kemenkumham.go.id
- SLIK OJK (Credit Information System): credit bureau regulated by OJK. ojk.go.id/slik
- UU PDP Transition Period: Government Regulation on UU PDP implementation timeline; transition period ended October 2024. kominfo.go.id
- PDP Agency (Lembaga PDP): planned supervisory authority for personal data protection, targeted launch mid-2026. kominfo.go.id
- PDDikti Coverage and Data Completeness: Ministry of Education guidance on PDDikti database participation requirements for higher education institutions. pddikti.kemdikbud.go.id
- SKCK Application Process: Polri guidance on police certificate application, validity, and issuance procedures. polri.go.id
- Law No. 13 of 2003 on Manpower (UU Ketenagakerjaan): Indonesian labour law governing employment discrimination protections and hiring practices. kemnaker.go.id