A global HR director once said to me:

“We’re hiring in Indonesia and honestly, we’re not sure where employment law ends and data privacy begins.”

I hear versions of this more often now. And it reflects a shift many organisations are still catching up with.

Indonesia’s Personal Data Protection Law (PDP Law) is no longer a future concern. It now sits directly on top of everyday employment practices: contracts, payroll, performance reviews, medical records, disciplinary files. All of it.

What makes this difficult is not the law itself, but how these rules collide in day-to-day HR decisions.

Employment law often requires employers to retain records.
Data protection law, on the other hand, requires deletion once data is no longer necessary.

In practice, HR teams are left to reconcile both, often without clear guidance, and under pressure to “just make it work.”

For multinational groups, this is where things usually become messy.

Employee data is commonly stored on regional or global systems, accessed by overseas headquarters, and transferred across borders. Each of these steps can trigger additional obligations under Indonesia’s data protection framework.

Too often, these issues are treated as IT matters. They are not.

From what we see in practice, the risk rarely comes from bad intentions. It usually comes from:

• Employment contracts that say nothing about how employee data is used or retained
• HR teams unfamiliar with PDP obligations
• Legacy data sitting in systems long after its purpose has ended

The exposure is not only regulatory fines. It is the quiet erosion of employee trust.

Indonesia’s workforce is young, digital-first, and increasingly aware of privacy rights. How employers handle employee data now directly affects credibility, retention, and reputation.

The takeaway is simple:

Employment law and data privacy can no longer be treated as separate silos. They are now part of the same compliance conversation.

Organisations expanding in Indonesia should take a hard look at:

• Employment agreements
• HR policies and SOPs
• Cross-border data-handling practices

Doing this early is far easier and far less costly than responding after an issue arises.

Compliance, in this context, is not just about avoiding risk. It is a strategic investment in trust