INDONESIA Law and Practice Contributed by: Lia Alizia, Jonathan Andreas Sitorus and El Yefta Akwila, Alizia & Partners Law Office
7. Data Protection 7.1 Collecting Personal Data
7.3 Access Basically, the relevant employees can access their personal data in HR internal investigations, but employers may limit access to protect the investiga - tion, others’ rights or legal compliance. The parties may only access their personal data collected dur - ing the investigation and the minutes of their own investigation proceedings. Access does not extend to other employees’ data or confidential information, and employers may restrict disclosure to protect the integrity of the investigation and the rights of others, or to ensure compliance with legal obligations. The investigation team may access data and documents relevant to the HR internal investigation, provided that the parties involved are informed and have given their express consent. 7.4 AI AI is not yet widely used in HR internal investigations in Indonesia. In practice, however, it can support the process by providing risk matrix overviews and ana - lytical insights that guide investigators. It may also aid the organisation and simplification of evidence, making it easier for the team to assess facts and sub - stantiate alleged violations. Indonesia’s Law No 13 of 2006 on the Protection of Witnesses and Victims provides safeguards for whis - tle-blowers, but only in the context of criminal acts. It does not extend to whistle-blowing in employment matters. For workplace-specific cases, protection is addressed under Minister of Manpower Decree No 88 of 2023 on Guidelines for Preventing and Handling Sexual Har - assment in The Workplace (“Guidelines 88/2023”), which sets out guidelines for preventing and handling sexual violence in the workplace. This Decree includes provisions to protect whistle-blowers who report such allegations. 8. Special Cases 8.1 Whistle-Blowing
When collecting personal data during an HR internal investigation, employers must comply with the Per - sonal Data Protection Law. Data may only be col - lected with the employee’s clear and explicit consent, and such collection is considered part of “processing” under the law, which requires a valid legal basis. Arti - cle 16 (2) of the Personal Data Protection Law further requires that data collection be limited to what is nec - essary. In short, employers may collect personal data for investigation purposes only if they have obtained valid consent from the employee and ensure the pro - cess is proportionate and compliant with the law. 7.2 Specific Rules In Indonesia, there is no regulation that specifically governs personal data collection for HR internal inves - tigations. However, any collection or processing of employee data must comply with the Personal Data Protection Law. There are three essential principles of personal data protection under this law, namely: • lawful and limited purpose, which means that the collection of personal data must be limited and specific, legally lawful and transparent; • need-to-know basis, which means that the pro - cessing of personal data is carried out in accord - ance with its purpose; and • confidentiality and security, which means that the processing of personal data is carried out by protecting it from unauthorised access, unauthor - ised disclosure, unauthorised alteration, misuse, destruction and/or loss. These essential principles are further regulated in the obligations of controllers and/or processors of per - sonal data in the Data Protection Law. Violations of these obligations may result in legal implications in the form of administrative sanctions, criminal sanctions and even potential civil lawsuits from the data subject. In short, employers may collect personal data for HR internal investigations only with explicit consent, for a clearly defined purpose and on a limited basis in line with the law.
232 CHAMBERS.COM
Powered by FlippingBook