Indonesia Recording Laws: Contested Consent, KUHP & Penalties (2026)

Indonesia's recording consent status is legally contested: KUHP Article 258, in force January 2, 2026, prohibits unlawfully recording non-public electronic transmissions without the participant exception present in prior UU ITE Article 31, leaving the legality of participant recording genuinely unsettled. Third-party interception is clearly prohibited under both statutes.

Quick Answer: Is Indonesia One-Party or All-Party Consent?

Indonesia's participant recording consent classification is genuinely contested and legally unsettled. Prior to January 2, 2026, Indonesian legal practitioners and Hukumonline legal analysis generally concluded that participant recording was not criminally prohibited, relying on the "belonging to another person" language in UU ITE Article 31 and the doctrinal distinction between "penyadapan" (intercepting someone else's communication) and "merekam" (recording a conversation you are a party to). Under that analysis, Indonesia functioned in practice as a one-party consent jurisdiction.

That analysis has been complicated by the entry into force of KUHP Article 258 on January 2, 2026. The new provision dropped the "belonging to another person" limitation and prohibits "unlawfully" listening to or recording transmissions of non-public electronic information -- with no explicit participant exception. The explanatory notes (penjelasan) to Article 258 enumerate three narrow categories that do not constitute unlawful conduct, none of which cover deliberate participant recording. This gap introduces material legal uncertainty that did not exist under the prior UU ITE framework.

Multiple international legal resources and Indonesian law school analyses classify Indonesia as an all-party consent country. Multiple Indonesian practitioner analyses and Hukumonline klinik articles have classified it as one-party consent. Neither position has been definitively settled by the Indonesian Supreme Court or the Mahkamah Konstitusi with respect to the KUHP Article 258 framework now in force.

Practical consequence: Until Indonesian courts or the legislature clarify whether participant recording falls within or outside the "unlawfully" standard in KUHP Article 258, anyone recording a conversation they are a party to in Indonesia faces genuine legal risk. Distributing, sharing, or using a participant recording -- even one made lawfully -- carries additional exposure under UU PDP and potentially UU ITE Article 27.

What is clear and undisputed is that third-party interception -- listening to, recording, or intercepting a communication to which you are not a party -- is strictly prohibited under both UU ITE Article 31 and KUHP Article 258, with penalties up to 10 years imprisonment.

Three overlapping statutes govern this area: the Electronic Information and Transactions Law (UU ITE, Law No. 11/2008 as most recently amended by Law No. 1/2024), the Personal Data Protection Law (UU PDP, Law No. 27/2022), and the Criminal Code (KUHP, Law No. 1/2023), which took effect on January 2, 2026. A fourth instrument, the new Criminal Procedure Code (KUHAP, Law No. 20/2025), signed on December 17, 2025 and also in force since January 2, 2026, reorganizes law enforcement wiretapping authority while creating a notable oversight gap.

Jurisdiction scope: This article addresses Indonesian national law on recording consent, wiretapping, personal data protection, and digital sexual violence as of May 2026. It covers the UU ITE (Law No. 11/2008, amended by Laws No. 19/2016 and No. 1/2024), KUHP (Law No. 1/2023), KUHAP (Law No. 20/2025), UU PDP (Law No. 27/2022), and UU TPKS (Law No. 12/2022). It does not address Indonesian military law or subnational regulations. For US state recording laws, see our US state-by-state recording law guide.

Information last verified on May 2026. This article has not yet been reviewed by a licensed Indonesian attorney.

UU ITE Article 31: The Core Prohibition on Third-Party Interception

The Electronic Information and Transactions Law (UU ITE), first enacted as Law No. 11 of 2008 and most recently amended by Law No. 1 of 2024, established Indonesia's foundational prohibition on electronic interception. Article 31 targets third-party interception: it applies to persons who intercept communications they are not party to, not to participants recording their own conversations. This distinction has significant practical implications for anyone seeking to record business calls, document disputes, or preserve evidence of a conversation they are having.

Article 31: The Text

Article 31 contains two core prohibitions:

Article 31(1): No person may intentionally and without authority intercept or wiretap electronic information or electronic documents stored in a computer or electronic system belonging to another person.

Article 31(2): No person may intentionally and without authority intercept the transmission of non-public electronic information or electronic documents from, to, or within a computer or electronic system belonging to another person, whether or not such interception causes changes, deletion, or termination of the information being transmitted.

The phrase "belonging to another person" and the requirement that the interceptor act "without authority" provided the textual anchors that Indonesian practitioners used to support a participant-recording exception. A party to a communication has inherent authority to perceive and document that communication; a third party does not.

Article 31(3) carves out a single statutory exception: interception carried out for law enforcement purposes at the request of the police, the prosecutor's office (Kejaksaan), or another institution authorized by statute. This exception does not extend to private citizens, employers, or businesses under any circumstances.

Important note on KUHP Article 258: The new Criminal Code (KUHP, Law No. 1/2023, in force January 2, 2026) replaced the UU ITE Article 31 wiretapping prohibition with Article 258. As discussed in the KUHP section below, Article 258 omits the "belonging to another person" limitation that was the primary textual basis for the participant-recording exception. The UU ITE Article 31 analysis above reflects the law as it applied before January 2, 2026 and remains relevant for conduct that occurred during that period.

Penalties Under UU ITE Article 47

Courts may impose both imprisonment and fines simultaneously. The 2024 amendment (Law No. 1/2024) refined provisions around digital evidence handling and increased several fine ceilings across the UU ITE framework.

KUHP Article 258: The New Wiretapping Statute (In Force January 2, 2026)

Indonesia's Criminal Code (KUHP, Law No. 1/2023) replaced the colonial-era Wetboek van Strafrecht that had governed criminal law since 1918. The new KUHP entered force on January 2, 2026, following a three-year transition period. It absorbed and expanded the wiretapping provisions previously spread across the UU ITE into a unified criminal code.

Article 258: Text and Scope

Article 258(1): Any person who unlawfully listens to, records, redirects, alters, obstructs, or notes the transmission of non-public electronic information or electronic documents, whether through wired or wireless communication networks, faces imprisonment of up to 10 years or a fine of up to Category VI.

Article 258(2): Any person who broadcasts or disseminates the results of conversations or recordings obtained through the acts described in subsection (1) faces imprisonment of up to 10 years or a fine of up to Category VI.

Article 258(3): The prohibitions in subsection (1) do not apply to anyone carrying out the provisions of laws and regulations or executing official orders.

Category VI fines under the KUHP cap at IDR 2 billion (approximately USD 122,000). That is 2.5 times the IDR 800 million ceiling under the UU ITE's Article 47 penalties.

The Participant Recording Problem Under KUHP Article 258

This is the critical change that creates legal uncertainty about participant recording under current law.

Under the prior UU ITE Article 31, the prohibition was anchored to interception of communications in systems "belonging to another person." Indonesian practitioners and Hukumonline legal analysis used that limiting language to argue that a participant recording their own conversation was not covered, because the communication was also "belonging to" the recorder.

KUHP Article 258(1) contains no equivalent limitation. It prohibits "unlawfully" listening to or recording transmissions of non-public electronic information, without restricting that prohibition to systems belonging to someone else. The explanatory notes (penjelasan) to Article 258 identify three narrow examples of what does not constitute "unlawful" conduct: (a) technical devices installed by the occupant of a house causing unintentional recording; (b) radio telephone conversations received unintentionally; and (c) telephone conversations heard by authorized telephone employees monitoring network operation. None of these examples address deliberate participant recording of a conversation.

The exception in Article 258(3) covers only those "carrying out the provisions of laws and regulations or executing official orders" -- meaning law enforcement and officials, not private individuals recording their own conversations.

As of May 2026, no Indonesian court has issued a reported ruling clarifying whether the "unlawfully" standard in KUHP Article 258(1) reaches participant recording. The legal landscape has shifted since January 2, 2026, and the previously reliable practitioner consensus on participant recording has been unsettled by this statutory change.

How KUHP Article 258 Differs from UU ITE Article 31

Because the KUHP took effect on January 2, 2026, prosecutors may now charge wiretapping offenses under Article 258 directly, alongside or instead of UU ITE charges. The UU ITE remains in force for its remaining provisions.

The KUHAP Oversight Gap (Law No. 20/2025)

A parallel development deserves attention alongside the KUHP. Indonesia's new Criminal Procedure Code (KUHAP, Law No. 20/2025), signed on December 17, 2025 and in force since January 2, 2026, reorganizes law enforcement authority. Article 136(1) grants police investigators the authority to conduct wiretapping for criminal investigations. Article 136(2) states that a separate law will regulate the specifics of such eavesdropping.

The problem: no such implementing law exists. Legal scholars at Universitas Gadjah Mada, the Indonesian Legal Aid Foundation, and civil society organizations have flagged that Article 136(1) as written gives police broad wiretapping authority without the judicial oversight safeguards previously in place. The Indonesian Legal Aid Foundation noted that civil society received the official KUHAP text only on December 30, 2025, one day before the bill became effective. Human rights organizations characterized the situation as a "legal emergency." Until a wiretapping implementing law is enacted, this gap creates uncertainty about the oversight mechanism for law enforcement interception activities.

The Baiq Nuril Case: What It Actually Establishes

The 2019 conviction of Baiq Nuril Maknun under Indonesia's ITE Law is widely cited in discussions of Indonesia's recording law. Understanding exactly what it established -- and what it did not -- is essential for any accurate analysis.

The Facts

Nuril was a teacher in Lombok whose school principal subjected her to repeated sexually explicit and unwanted phone calls. In August 2014, she recorded one of those calls to document the harassment and protect herself against false accusations of an affair. Nuril did not distribute the recording. A colleague obtained the recording and shared it online without her involvement. The principal reported Nuril to police.

What She Was Convicted For

The Supreme Court of Indonesia (Decision No. 574K/Pid.Sus/2018) convicted Nuril under UU ITE Article 27(1) for distributing or making accessible electronic information containing content that violated morality. She was sentenced to six months imprisonment and a fine of IDR 500 million.

Nuril was not charged under or convicted of UU ITE Article 31 (interception/wiretapping). The act of recording itself was not the basis of her criminal liability. The Court's theory of liability concerned the downstream distribution of the recording's content -- and even that was legally controversial, since Nuril herself did not distribute it, and the content that "violated morality" was her harasser's own words.

The Constitutional Court (Mahkamah Konstitusi) rejected her challenge to the conviction in July 2019. President Joko Widodo granted Nuril a presidential amnesty in 2019 following sustained public outcry over the injustice of her case.

What the Case Establishes and What It Does Not

The Baiq Nuril case establishes: (1) that recordings made by a participant for self-protection can be used as a vehicle for prosecution of that participant under UU ITE Article 27 (distribution and morality provisions) if the recording is subsequently distributed by any party; (2) that Indonesian courts will not apply gender-equity guidelines when doing so would complicate a criminal conviction; and (3) that the legal environment for participant recording in Indonesia carries genuine practical risk beyond the abstract question of whether the recording act itself is criminal.

The case does not establish: (1) that the act of participant recording is itself a crime under Article 31; (2) that Article 31 applies to conversations you are a party to; or (3) that Indonesia is definitively an all-party consent jurisdiction.

The case is best understood as a warning that even if participant recording is not itself criminal, the surrounding circumstances -- particularly any distribution of the recording -- expose the recorder to serious criminal liability under other ITE Law provisions.

KUHP Article 322 and the Old Secret-Disclosure Framework

Before the new KUHP took effect, Article 322 of the old Criminal Code addressed unauthorized disclosure of professional secrets (a provision protecting, for example, doctor-patient or lawyer-client confidentiality). The new KUHP under Law No. 1/2023 carries forward analogous provisions but renumbers them. Article 258 is the primary interception and wiretapping provision; separate articles address professional secret disclosure.

The old Article 322 should not be confused with wiretapping law. It was and remains a narrow professional-secrecy obligation, not a general prohibition on participant recording of conversations.

UU PDP: Personal Data Protection Law (Law No. 27/2022)

The Personal Data Protection Law (UU PDP, Law No. 27/2022) adds a second layer of legal exposure for anyone who records, stores, or shares recordings containing personal data. The two-year compliance transition period ended on October 17, 2024; full compliance has been mandatory from that date.

How UU PDP Applies to Recordings

Any audio or video recording that captures identifiable individuals constitutes personal data under the UU PDP. "Processing" that data includes collecting, storing, sharing, and publishing. Processing requires a lawful basis. The six lawful bases under the PDP Law are:

1. Explicit, informed consent from the data subject
2. Performance of a contract to which the data subject is a party
3. Compliance with a legal obligation
4. Protection of vital interests of the data subject
5. Performance of a public interest task or exercise of official authority
6. Legitimate interests pursued by the controller, provided those interests do not override the data subject's fundamental rights

For a private recording of a conversation, even one the recorder participated in and was legally entitled to make, the subsequent storage, sharing, or publication of that recording still requires a PDP-compliant lawful basis.

PDP Law Penalties

Corporations face fines up to 10 times the individual maximum. A company convicted of unlawfully collecting personal data through recordings could face penalties up to IDR 50 billion (approximately USD 3 million), along with business suspension, license revocation, or forced dissolution.

Administrative sanctions include written warnings, temporary suspension of data processing activities, forced deletion of data, and fines of up to 2% of annual revenue.

PDP Agency Status (May 2026)

Indonesia is establishing a dedicated Personal Data Protection Agency (Lembaga PDP). As of May 2026, the agency is not yet operational. The draft Presidential Regulation governing the agency was discussed with stakeholders between March and September 2025. It entered the "harmonization stage" at the Ministry of Law in October 2025, where it remains pending finalization and enactment. In the meantime, enforcement falls to the Ministry of Communication and Digital Affairs (Komdigi), specifically through the General Directorate of Digital Space Supervision under MOCD Regulation No. 1 of 2025. Companies should prepare now for stricter enforcement once the agency becomes operational.

UU TPKS: Sexual Violence Crimes Law and Non-Consensual Recording (Law No. 12/2022)

The Sexual Violence Crimes Law (UU TPKS, Law No. 12/2022) adds a third statutory layer specifically targeting non-consensual recording and distribution of sexual content.

Article 14: Voyeurism and Non-Consensual Intimate Images

Article 14 of the UU TPKS prohibits anyone from recording, photographing, disseminating, or making accessible electronic documents containing sexual content without the consent of the person depicted. Penalties under Article 14:

• Maximum imprisonment: 4 years
• Maximum fine: IDR 200 million (approximately USD 12,200)

This provision is distinct from the UU ITE and KUHP wiretapping articles. It targets the content of what is recorded, not merely the act of interception. A participant who records their own sexual encounter without their partner's consent can face prosecution under Article 14 even though they were a party to the encounter.

Layered Liability for NCII Cases

Non-consensual intimate image (NCII) cases in Indonesia can attract prosecution under multiple overlapping statutes:

• UU ITE Article 27(1): Prohibits transmission of electronic information with content "violating decency." Applied to NCII cases, though legal scholars note interpretive inconsistency and risk of gender bias in how courts have applied this provision.
• UU TPKS Article 14: The dedicated NCII/voyeurism provision, narrower but more specific.
• UU PDP: Sharing intimate images of identifiable individuals without consent is unauthorized disclosure of personal data.
• Pornography Law (Law No. 44/2008): May apply depending on content.

Note on UU ITE Article 27A: The 2024 amendment (Law No. 1/2024) inserted Article 27A into the UU ITE. This provision addresses criminal defamation (intentionally attacking someone's honor or good name), not NCII. The two provisions serve different purposes and should not be confused.

Deepfake and AI-Generated Content

Indonesia has no AI-specific legislation governing deepfake content as of May 2026. Prosecutors apply the existing framework on a case-by-case basis, with significant enforcement challenges.

The Regulatory Gap

The three primary statutes applicable to deepfake sexual content are:

1. UU ITE Article 27(1): "Violating decency" language may cover AI-generated intimate images, but was drafted before generative AI existed.
2. UU TPKS Article 14: Covers electronic documents containing sexual content disseminated without consent. Whether AI-generated images of a real person count as "recordings" of that person is an open legal question.
3. Pornography Law (Law No. 44/2008): General prohibition on pornographic content; does not distinguish AI-generated from authentic content.

Academic commentary published in 2025 in the International Journal for the Semiotics of Law (Springer Nature) confirms that Indonesia's existing frameworks have not specifically addressed the characteristics and risks of generative AI, and that regulatory gaps remain concerning. Enforcement faces additional barriers including technical detection of AI manipulation, perpetrator anonymity, and cross-border jurisdiction.

Recent Cases

Cases involving AI-generated intimate images emerged at universities in Udayana (Bali) and Semarang in 2025. Prosecutions proceeded under the existing UU ITE and UU TPKS framework. Results from those proceedings are not yet publicly reported in accessible English-language sources.

What This Means Practically

Anyone in Indonesia who creates, distributes, or uses AI tools to generate intimate images of real, identifiable people risks prosecution under the patchwork of existing statutes even absent AI-specific law. The absence of a targeted statute does not create a safe harbor; it creates unpredictability in enforcement and outcome.

Phone Call Recording

Recording a phone call in Indonesia involves significant legal uncertainty, and the answer depends on which legal framework controls.

Participant Recording: The Contested Question

When you are a party to a phone call, is recording that call without notifying the other parties lawful in Indonesia?

The prior analysis (under UU ITE Article 31): Under UU ITE Article 31, the prohibition targeted interception of communications "belonging to another person." Indonesian legal practitioners and Hukumonline analyses, applying the distinction between "penyadapan" (intercepting someone else's communication) and "merekam" (recording your own conversation), concluded that participant recording was not criminally prohibited. Under this view, Indonesia functioned as a one-party consent jurisdiction.

The current uncertainty (under KUHP Article 258): Since January 2, 2026, the operative wiretapping statute is KUHP Article 258. That provision omits the "belonging to another person" limitation. The explanatory notes list only three narrow examples of non-unlawful conduct, none of which cover participant recording. No Indonesian court has clarified whether "unlawfully" in Article 258 reaches participant recording. Until that clarification comes, the legal risk for participant recording has increased materially compared to the prior UU ITE framework.

The practical risk dimension (the Baiq Nuril cautionary lesson): Even if participant recording is ultimately held not to violate Article 258, the Baiq Nuril case illustrates that recordings made by participants can be used against the recorder under other provisions -- particularly UU ITE Article 27 (distribution and morality provisions) if the recording is distributed. The combination of an unclear Article 258, aggressive application of Article 27, and UU PDP data-processing obligations means that anyone recording a conversation in Indonesia should consult an Indonesian attorney before making or using that recording.

The legal conclusion: The participant recording question is genuinely unsettled under current law. Anyone who needs to record conversations in Indonesia for legal, business, or evidentiary purposes should obtain specific legal advice rather than relying on the prior one-party consent characterization.

Third-Party Interception (Prohibited)

Recording a conversation between two other people, neither of whom you are, is prohibited under both UU ITE Article 31 and KUHP Article 258, regardless of your purpose. There is no private citizen exception for third-party wiretapping.

What Counts as Valid Consent for Recorded Calls

When a business or individual seeks to obtain consent rather than rely on participant recording:

• Consent must be explicit and informed, not merely implied.
• A beep tone at the start of a call satisfies consent only if the other party has been clearly told the call is being recorded and agrees to continue.
• Automated disclosures like "this call may be recorded for quality assurance" satisfy the requirement only if the caller has a genuine opportunity to decline and disconnect.
• Silence or continued participation after a brief disclosure may be treated as implied consent in some court interpretations, but best practice is to obtain affirmative agreement.

Can a Recorded Call Be Used as Evidence in Court?

Indonesian courts admit electronic recordings as evidence under the UU ITE and the Code of Criminal Procedure, subject to three conditions:

• The recording must be authentic and unaltered.
• The recording must have been obtained lawfully, meaning not through prohibited third-party interception.
• The recording must maintain its integrity and must withstand forensic challenge if the opposing party contests it.

MK Decision 20/PUU-XIV/2016 (Mahkamah Konstitusi) established that electronic evidence consisting of recordings and interceptions must be obtained "in the context of law enforcement at the request of law enforcement officials" to be admissible in criminal proceedings. This ruling creates an additional barrier for participant recordings offered as evidence in criminal cases, beyond the question of whether the act of recording was itself lawful. Courts have excluded recordings where the presenting party could not demonstrate lawful acquisition.

In-Person Conversation Recording

The legal framework for face-to-face recording in Indonesia applies the same participant-versus-third-party logic -- and inherits the same uncertainty introduced by KUHP Article 258.

Article 258 of the KUHP targets "transmission of non-public electronic information or electronic documents" over wired or wireless communication networks. Its primary application is to electronic communications. Recording a purely in-person conversation on a smartphone creates an electronic document, and the UU PDP applies to that document if it captures identifiable personal data.

The participant-recording question that is unsettled for phone calls is equally unsettled for in-person recording under the KUHP Article 258 framework. Participants recording their own in-person meetings for personal reference occupy a legally defensible position under the prior UU ITE analysis, but that analysis has been weakened by the structural change in Article 258. The PDP Law governs what you may then do with any recording. Secret recording of a conversation between third parties carries the same serious criminal risks as phone interception.

Recording Police and Public Officials

Indonesian law does not contain an explicit provision prohibiting members of the public from filming police officers or other public officials performing their official duties in public.

The UU ITE Article 31 interception prohibition targets non-public electronic communications; it does not apply to open observation of public conduct in a public place. A police officer conducting a traffic stop or an arrest in public is not engaged in a "non-public electronic communication" that Article 31 protects.

Practical cautions apply:

• PDP Law triggers on publication. Footage that identifies individual officers or third parties becomes personal data under the UU PDP when you share it online. You need a lawful basis for that processing. Journalism, public interest documentation, and accountability recording are arguable lawful bases, but they are not explicitly defined safe harbors.
• Obstruction laws. Filming police officers who request you to stop or move may implicate separate obstruction or public order provisions unrelated to recording law.
• The new KUHAP. Law No. 20/2025 expands police authority in ways that civil society has flagged as concerning. Individuals filming police in Indonesia should be aware that the legal environment around police powers is in flux.

Watch out: Recording a police officer in Indonesia is legally distinct from the United States, where federal circuit courts have generally recognized a First Amendment right to film public officials. Indonesia has no equivalent constitutional provision establishing such a right. The absence of an explicit prohibition is not the same as a protected right.

Workplace Recording and Employee Monitoring

Indonesia has no standalone workplace surveillance statute. Employers navigate the UU PDP, the UU ITE, and general employment law.

What Employers May Do

Employers may monitor workplace communications and install surveillance equipment under specific conditions:

• Lawful basis under UU PDP: Typically the employment contract (performance of a contract) or legitimate interest. The legitimate interest must not override employees' fundamental rights, requiring a balancing assessment.
• Written notice: Employees must be explicitly informed of what monitoring is taking place, why, and how data will be used. Notice must be specific, not a generic privacy policy clause.
• Proportionality: Monitoring must match its stated purpose. Continuous screen recording, full keystroke logging, and monitoring of personal devices are high-risk activities requiring strong justification and, for the most intrusive forms, explicit written consent.
• Location limits: CCTV may be installed in work areas. Cameras are prohibited in restrooms, changing rooms, prayer rooms, and any other space where employees have a reasonable privacy expectation.

What Employers Cannot Do

Employers cannot secretly record employee conversations, access personal email or messaging accounts without consent, or install hidden cameras anywhere. Violating these rules creates criminal exposure under the KUHP and UU ITE and civil liability under the UU PDP.

The UU PDP's corporate penalty multiplier (up to 10 times the individual fine) makes workplace compliance failures particularly expensive. A business that secretly records employee conversations and then discloses those recordings could face UU PDP corporate fines of up to IDR 40 billion for unlawful disclosure alone.

Recording in Public Places

CCTV in Public Areas

The UU PDP governs CCTV and surveillance systems in public spaces. The law permits CCTV in public places and public service facilities only for:

• Security purposes
• Disaster prevention
• Traffic management and monitoring
• Collection, analysis, and regulation of traffic information

Organizations operating CCTV in public spaces must:

• Display clear signage that CCTV is in operation
• Include contact information for the responsible party
• Place notices at entrances to enclosed spaces or in easily visible positions

Personal Recording in Public

Taking photos or recording video in genuinely public spaces (streets, parks, markets) is generally permitted under Indonesian law. Publishing recordings that identify specific individuals triggers UU PDP obligations. You need either consent or a recognized lawful basis (such as public interest or journalism) to share such recordings publicly.

Law Enforcement Wiretapping

Indonesia grants wiretapping authority to several law enforcement bodies, each with its own statutory basis and oversight requirements.

Corruption Eradication Commission (KPK)

The KPK has the broadest wiretapping authority among Indonesian agencies. Under Law No. 30/2002 (as amended), the KPK may intercept communications related to corruption investigations subject to:

• Maximum duration of 6 months per authorization
• Prior approval from the KPK Supervisory Board (Dewan Pengawas)
• Ongoing oversight by the Supervisory Board during the interception period

National Police (Polri)

The National Police may conduct wiretapping under the framework of the new KUHAP (Law No. 20/2025). Article 136(1) of that code authorizes investigators to wiretap in the course of criminal investigations. The critical issue noted above applies here: Article 136(2) defers the specifics of oversight to a separate implementing law that does not yet exist as of May 2026.

Before the new KUHAP, Polri operated under National Police Regulation No. 5/2010, which required district court permission before wiretapping. Whether the new KUHAP has effectively replaced that requirement or whether courts and prosecutors will continue to apply the prior standard is an unresolved question pending the implementing regulation.

Attorney General's Office (Kejaksaan)

The Attorney General's Office has statutory authority to conduct wiretapping for law enforcement purposes. Cooperation agreements with telecommunications providers have drawn scrutiny from civil liberties organizations over oversight gaps.

Oversight Gaps

The interaction between the new KUHP, KUHAP, and the absence of an implementing wiretapping law creates the most significant current uncertainty in Indonesian recording law. Scholars at Universitas Gadjah Mada and civil society groups have explicitly flagged that law enforcement agencies have broad statutory authority to wiretap without an adequate existing legal framework to constrain how that authority is exercised. Until a dedicated wiretapping law is enacted under KUHAP Article 136(2), this gap persists.

Business Compliance: What Companies Need to Know

Call Center and Customer Service Recording

Businesses that record customer calls must:

• Provide clear notice at the start of each call that recording is taking place
• Give customers a genuine opportunity to decline (disconnect or opt out)
• Store recordings securely with access limited to authorized personnel
• Establish retention schedules and delete recordings when no longer required
• Comply with data subject access requests under the UU PDP
• Maintain records of processing activities (required for organizations processing data at scale)

Data Processing Impact Assessments

The UU PDP requires organizations to conduct data protection impact assessments (DPIAs) for high-risk processing activities. Recording calls, operating CCTV, and monitoring employee communications all qualify. A DPIA must document the purpose, necessity, proportionality, and safeguards for each high-risk activity.

Cross-Border Data Transfers

If recorded data is stored on servers outside Indonesia or shared with foreign affiliates, the UU PDP imposes additional requirements. The receiving country must provide an adequate level of personal data protection, or the transfer must be covered by binding contractual safeguards approved by Komdigi. Indonesia has not yet published a whitelist of adequate countries; organizations should seek legal guidance on transfer mechanisms.

Preparing for the PDP Agency

The PDP Agency (Lembaga PDP) is expected to be established once the Presidential Regulation completes its current harmonization stage at the Ministry of Law. Companies should use the current enforcement window under Komdigi to complete compliance programs, train staff, and implement technical safeguards before the agency becomes operational and enforcement intensifies.

Penalties Summary

Penalties can stack. A single act of non-consensual intimate recording and distribution could attract KUHP Art. 258(1) charges, UU TPKS Art. 14 charges, and UU PDP disclosure charges simultaneously.

Practical Tips for Staying Legal in Indonesia

• Participant recording of your own conversations is legally contested under current law. The prior UU ITE Article 31 analysis supported participant recording as lawful; KUHP Article 258 (in force January 2, 2026) dropped the limiting language that supported that conclusion. Until courts clarify the position, treat participant recording in Indonesia as carrying material legal risk.
• Obtaining consent from all parties is the only safe approach. Given the genuine uncertainty about whether participant recording is lawful under KUHP Article 258, the safest practice is to disclose recording and obtain agreement from all participants before recording any conversation.
• Never record conversations between third parties. Intercepting a communication you are not party to is a serious criminal offense under both the KUHP and UU ITE.
• Do not share any recording without legal basis. Sharing a recording -- whether or not the act of making it was lawful -- can attract UU ITE Article 27 liability (the Baiq Nuril lesson) and UU PDP liability. Consult counsel before distributing any recording.
• Businesses must obtain consent or notify before recording customer calls. Clear pre-call disclosure and a genuine opt-out opportunity are the minimum standard.
• CCTV operators must post notices in all monitored areas and designate a responsible person whose contact information appears on the notice.
• For sexual or intimate content, consent is required. Recording or sharing intimate images of another person without their consent violates UU TPKS Article 14 regardless of whether the recorder was a participant.
• Consult a local attorney before implementing any recording, surveillance, or monitoring system in Indonesia. The interaction between the KUHP, KUHAP, UU ITE, UU PDP, and UU TPKS creates complexity that requires professional guidance specific to your situation.

Disclaimer

This article provides general legal information about Indonesian recording laws as of May 2026. It is not legal advice and does not create an attorney-client relationship. The laws described include UU ITE (Law No. 11/2008, amended by Laws No. 19/2016 and No. 1/2024), KUHP (Law No. 1/2023), KUHAP (Law No. 20/2025), UU PDP (Law No. 27/2022), and UU TPKS (Law No. 12/2022), as they were in force in May 2026. Indonesian law is subject to ongoing legislative change; the KUHAP oversight gap and the unsettled participant recording question under KUHP Article 258 in particular may be resolved by court decisions or implementing regulations that postdate this article.

Individuals and businesses with questions about their specific situation should consult a licensed Indonesian attorney (advokat) who can advise on current law and the facts of their case.

About the Author

[PLACEHOLDER: Author roster pending. Information last verified in May 2026.]

Authorities Cited

1. Law No. 11 of 2008 on Electronic Information and Transactions (UU ITE), as amended by Law No. 19 of 2016 and Law No. 1 of 2024. https://jdih.komdigi.go.id/produk_hukum/view/id/884/t/undangundang+nomor+1+tahun+2024
2. Law No. 1 of 2023 on the Criminal Code (KUHP), Article 258 (wiretapping and interception). https://the-world-is-watching.org/wp-content/uploads/2023/02/2023-Indonesia-Penal-Code.pdf
3. Law No. 20 of 2025 on the Criminal Procedure Code (KUHAP). Indonesia Enacts New Criminal Procedure Code: Key Implications. https://ssek.com/blog/indonesia-enacts-new-criminal-procedure-code-key-implications-for-investigations-and-enforcement/
4. Law No. 27 of 2022 on Personal Data Protection (UU PDP). Library of Congress Global Legal Monitor. https://www.loc.gov/item/global-legal-monitor/2022-12-18/indonesia-personal-data-protection-act-enters-into-force/
5. Law No. 12 of 2022 on Sexual Violence Crimes (UU TPKS), Art. 14. ADB Legal Resource. https://lpr.adb.org/sites/default/files/resource/%5Bnid%5D/indonesia-anti-sexual-violence-law-uu-tpks-nomor-12-tahun-2022-tindak-pidana-kekerasan-seksual-english.pdf
6. Mahkamah Konstitusi (Constitutional Court), Decision No. 20/PUU-XIV/2016, on admissibility of electronic evidence; lawful-acquisition requirement for intercept recordings. https://www.mkri.id/public/content/persidangan/putusan/20_PUU-XIV_2016.pdf
7. Supreme Court of Indonesia, Decision No. 574K/Pid.Sus/2018 (Baiq Nuril Maknun case), conviction under UU ITE Article 27(1). Analyzed in: The Conversation, "Baiq Nuril's case shows sexism still remains in Indonesia's Supreme Court." https://theconversation.com/baiq-nurils-case-shows-sexism-still-remains-in-indonesias-supreme-court-despite-its-equality-guidelines-120289
8. Baiq Nuril, the ITE Law and #MeToo Indonesian style -- Indonesia at Melbourne. https://indonesiaatmelbourne.unimelb.edu.au/baiq-nuril-the-ite-law-and-metoo-indonesian-style/
9. Hukumonline Klinik, "Bolehkah Merekam Suatu Peristiwa Secara Sembunyi-Sembunyi?" (Can You Record an Event Secretly?). https://www.hukumonline.com/klinik/a/bolehkah-merekam-suatu-peristiwa-secara-sembunyi-sembunyi-lt5496be4d1947b/
10. Hukumonline Klinik, "Bisakah Rekaman Diam-Diam Percakapan Telepon Dijadikan Alat Bukti?" (Can a Secretly Recorded Phone Call Be Used as Evidence?). https://www.hukumonline.com/klinik/a/bisakah-rekaman-diam-diam-percakapan-telepon-dijadikan-alat-bukti-lt59c1ebe5c1c71/
11. Chambers and Partners, Data Protection and Privacy 2026: Indonesia. https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/indonesia/trends-and-developments
12. ICLG, Data Protection Laws and Regulations Report 2025-2026: Indonesia. https://iclg.com/practice-areas/data-protection-laws-and-regulations/indonesia
13. Makarim and Taira S., "Second Amendment to Indonesia's ITE Law: What's Changed." https://www.makarim.com/news/second-amendment-to-indonesia-s-ite-law-what-s-changed
14. SSEK Law Firm, "Indonesia Data Protection and Privacy Laws 2026 Guide." https://ssek.com/blog/data-protection-and-privacy-laws-in-indonesia-2026-guide-by-ssek/
15. Windonesia, "The Wiretapping Loophole: A Hasty Future for Indonesian Law." https://windonesia.com/article/the-wiretapping-loophole-a-hasty-future-for-indonesian-law
16. Universitas Gadjah Mada, "Experts at UGM Flag Risks in KUHAP Revision: Coercive Powers Expand Without Clear Safeguards." https://ugm.ac.id/en/news/experts-at-ugm-flag-risks-in-kuhap-revision-coercive-powers-expand-without-clear-safeguards/
17. Springer Nature / International Journal for the Semiotics of Law, "Addressing Deepfake Pornography and the Right to be Forgotten in Indonesia: Legal Challenges in the Era of AI-Driven Sexual Abuse." https://link.springer.com/article/10.1007/s11196-025-10265-0
18. A&Co Law, "Regulatory Framework for Data Processing and CCTV Installation Post-Enactment of the Indonesian Personal Data Protection Law." https://aco-law.com/articles/regulatory-framework-for-data-processing-and-cctv-installation-post-enactment-of-the-indonesian-personal-data-protection-law/
19. Cornell LII, Penal Code of Indonesia (Gender Justice Resource). https://www.law.cornell.edu/gender-justice/resource/penal_code_of_indonesia
20. ICJ, "Indonesia: Newly Revised ITE Law Threatens Freedom of Expression and Must Be Amended." https://www.icj.org/indonesia-newly-revised-ite-law-threatens-freedom-of-expression-and-must-be-amended/
21. Binus University Business Law, "Penyadapan dan Kedudukannya sebagai Alat Bukti Elektronik." https://business-law.binus.ac.id/2020/05/03/penyadapan-dan-kedudukannya-sebagai-alat-bukti-elektronik/

Related Articles

• World Recording Laws: Country-by-Country Consent Guide
• Indonesia Data Privacy Laws: UU PDP Compliance Guide (2026)
• US State Recording Laws: All 50 States

---

Last updated: May 2026. Statutes cited reflect their in-force versions as of May 2026. KUHP in force January 2, 2026. KUHAP in force January 2, 2026. UU PDP compliance mandatory from October 17, 2024.