12 most asked questions on the Indonesian employee monitoring laws

In Indonesia, there are presently no explicit laws regulating employee monitoring. Surveillance of any sort, however, must be justified by law and required to accomplish a valid goal. Before beginning any electronic monitoring process, the following relevant data collection standards must be followed: transparency, the legal basis for processing, data minimization, and retention.

1. Is employee monitoring legal in Indonesia?

Yes. Employee monitoring is lawful as long as businesses have genuine interests to safeguard. However, there are certain restrictions. Employees must provide written permission before being monitored under Indonesian legislation. Article 15 Paragraph 2 of Reg. 82 requires the electronic system provider to get written notice from the owner of the data (employee) before deployment, even if it is on a company-owned device.

2. Is it legal to monitor the company's computers?

Yes. Collective Labour Agreements (negotiations between regulated labor unions and employers), and Company Regulations (official agreement given by the ‘’MOMT’’) permit employers to monitor computers and other equipment provided to their employees if employees are made aware of and consent to being monitored, particularly if personal data is involved (The EIT law prohibits personal data breaches). It is illegal to monitor workers without their permission during working hours.

3. Is it legal to monitor employee internet and social media activities?

Yes. It is illegal in Indonesia for any worker to disclose any employer's information. Companies have the authority to restrict workers from accessing the Internet for any purpose other than work-related purposes, as long as it is governed by Collective Labour Agreements (CLA) or Company Regulations (CR). Employers must still consider their workers' personal life while monitoring their social media and internet use. Monitoring without permission is a breach of Legislation No. 11 OF 2008 on electronic information and transaction (EIT law), which requires explicit agreement from the individual whose personal information is being handled. It is also recommended that businesses establish rules regarding the usage of the Internet and social media.

4. Is it legal to monitor screen contents and keystrokes?

Yes. In Indonesia, employers have the right to monitor and analyze screen contents as well as keystrokes on company property. However, employees reserve the right to consent to such monitoring, as they have a right to personal privacy.

5. Is it legal to monitor email content?

Yes. The company owns company email systems. Employees should use caution while accessing personal emails from the workplace computer since they may be monitored. Private and personal information should not be accessed without permission, according to Indonesia's constitution. The company must explicitly notify its workers that their emails are being monitored. Clear policies regarding the usage of corporate emails for professional purposes should also be given.

6. Is it legal to monitor or record phone conversations?

Yes, Articles 41 and 42 of Law No. 36 of 1999, commonly referred to as the "Telecommunication Law," allow providers to record telecommunications use and data per applicable laws and regulations. However, for specific criminal acts, telecommunications providers must obtain a written request from the Attorney General and/or the Chief of the Indonesian Police (in cases of criminal activities). Written requests for information must also include what was recorded, the time period during which it was recorded, and the time frame for keeping the reports.

7. Is it legal to use video monitoring systems in the workplace?

Yes. The following precautions should be taken when installing a video monitoring system:

• Notifying employees that their work environment is being monitored through a video system.
• Explaining the purpose of the monitoring to the employees.
• Installing cameras exclusively in work areas, not in places where privacy may be invaded (e.g. restrooms, changing rooms, bathrooms).
• Avoiding the use of the video system for discriminatory purposes, i.e., to monitor only one sector of the company or a specific employee.
• Taking the necessary precautions to store monitored data.
• Ensuring who has access to the monitored data does not share information with third parties.

Aside from video surveillance systems, there are a variety of employee-friendly options to consider if the primary goal is to monitor overall productivity and ensure that company resources are properly utilized. Employee productivity monitoring software is a great way to balance the benefits of monitoring with the risks of invading employees' privacy.

8. Is it legal to monitor private messages and email content?

Yes. If employees access private messages and personal emails on a company-owned device, their employer may monitor the use, not the content, and only during working hours. It is also important for employers to implement clear policies for employees to be informed of this and obtain their consent. Also, employees should be informed that their email may be accessed while they are away.

9. Is it legal to monitor employees' personal devices?

Yes. It should be noted that if work activities are conducted on a personal device, the employee must account for the time spent on work activities during working hours. Employers have the right to monitor such devices during working hours only. While this is true, the Data Protection Regulation requires every electronic system operator (such as employers) to get written permission. According to the Data Protection Regulation, the data owner has the right to have their personal data erased at any time. However, the deletion request must be submitted per the applicable rules and regulations.

10. Is it legal to monitor employees' personal computers?

Yes, the answer is the same as the one above. Employers can monitor the work activities of staff who work on a personal computer to protect business information. However, the monitoring should not interfere with or collect any personal information about the employee. Separating personal and professional information is an effective precaution to take. Employers should not only develop work/monitoring policies , but they should also properly explain these policies to their employees.

11. Is it required to inform employees of the monitoring?

Yes. As stated in most of this article, The Indonesian constitution requires employees to be properly informed and consent in writing before being monitored. Employers are not allowed to monitor their devices without employees' consent, even if they are company-owned. It is also crucial that employees understand how and why these monitoring devices are being used. If employees do not give their consent, they should not be monitored.

12. Employee monitoring policy - mandatory or not?

Yes. Employee monitoring policies, should adhere to international human rights laws and standards, including the principles of transparency, legality, proportionality, and necessity. This can be achieved by creating and distributing comprehensive company policies, handbooks, and consent forms to ensure that employees know the rules and guidelines regarding monitoring and surveillance. Policies should be easy to access and understand.

Our monitoring experts have developed ready-to-use policies, announcement samples, and employee monitoring handbooks for direct use or a sample to create future employee monitoring policies. Request a copy now. It's free!

Are there Indonesian laws that protect employee workplace privacy?

There are no constitutional laws that explicitly mention workplace privacy. That said, there are so many laws relating to data privacy in Indonesia.

• The Data Protection Regulation provides more detailed specifications on the use of personal data in electronic systems in every surveillance process, i.e., acquiring, collecting, processing, analyzing, storing, displaying, announcing, transmitting, disseminating, and/or providing access to, and/or deleting personal data.
• Law No. 11 of 2008 regarding Electronic Information and Transactions, as amended by Law No. 19 of 2016 ("Electronic Information Law").
• Regulation No. 71 of 2019 regarding the Implementation of Electronic Systems and Transactions ("GR 71").
• Minister of Communication and Informatics Regulation No. 20 of 2016 regarding the Protection of Personal Data ("MOCI Reg. 20").

The last two are collectively called the PDP regulations According to the EIT Law and Government Regulations, employees are protected by law when they are not informed about the monitoring in the workspace, did not give their consent, and/or the use of such data is not indicated in employment contracts, workplace policies, or handbooks. In Indonesia, the sanctions for data privacy breaches are found under the relevant legislation and are essentially fines. Imprisonment may be imposed in severe instances, such as in the event of intentional infringement. The EIT Law provides criminal penalties ranging from; Rp. 600,000,000 fine to Rp. 800,000,000 and/or 6 to 8 years imprisonment for unlawful access; Rp. 800,000,000 fine and/ or 10 years imprisonment for interception/wiretapping of transmission; Rp. 2,000,000,000 to Rp. 5,000,000,000 and/or 8 to 10 years imprisonment for alteration, addition, reduction, transmission, tampering, deletion, moving, hiding Electronic Information and/or Electronic Records. The bottom line, monitoring should be implemented to maintain the trust and security of the workforce.

Is there professional lawyers’ advice on monitoring?

Lawyers agree while there is no specific legal restriction on employee monitoring, the employer should express the right to do so in the company regulation. They also recommend that clear and detailed monitoring policies be put in place. Employees should be explicitly notified and give written consent before monitoring solutions are implemented. Separate data privacy policies may also be put in place. The policies should include the following:

• The definition of private or personal data (typically, various types of information relating to the employee and the employee’s dependents).
• Ensuring the appropriate, lawful use and disclosure of personal data.
• Provisions of data and disaster recovery centers.
• The employee’s consent to the employer accessing, collecting, using, transferring, or otherwise processing the employee’s personal data.
• The employee’s right to access their own personal data (but not others).
• The employee’s obligation to notify the employer of any changes or updates to their personal data.

What is the bottom line?

Employers need to balance the need to safeguard business interests and their employees' privacy expectations when implementing employee monitoring software. To perform the monitoring process on legitimate grounds, transparency and prior notification should be considered. Disclaimer The information provided in this article is for general understanding only and not to be used as legal advice. To receive professional legal advice, please consult your lawyer.