Indonesia Recording Laws: Consent Rules and Penalties (2026)

Overview of Indonesia Recording Laws

Indonesia treats unauthorized recording and interception of private communications as a serious criminal offense. Three overlapping statutes govern this area: the Electronic Information and Transactions Law (UU ITE, Law No. 11/2008 as amended by Law No. 1/2024), the Personal Data Protection Law (UU PDP, Law No. 27/2022), and the newly enacted Criminal Code (KUHP, Law No. 1/2023), which took effect on January 2, 2026.

The country follows an all-party consent framework. Recording a phone call, video chat, or other electronic communication without the knowledge and approval of every participant is illegal unless you fall within a narrow set of law enforcement exceptions. This applies to Indonesian citizens and foreign nationals alike.

For anyone living in, traveling through, or doing business in Indonesia, understanding these laws is not optional. Penalties are steep, enforcement is active, and the legal landscape shifted significantly when the new KUHP replaced decades-old colonial-era criminal statutes at the start of 2026.

The UU ITE: Indonesia's Foundation for Recording Law

The Electronic Information and Transactions Law (UU ITE), first enacted in 2008 and most recently amended in January 2024, has been the primary statute governing electronic interception in Indonesia for over 15 years.

Article 31: The Core Prohibition

Article 31 contains two main prohibitions:

• Article 31(1): No person may intentionally and without authority intercept or wiretap electronic information or electronic documents stored in a computer or electronic system belonging to another person.

• Article 31(2): No person may intentionally and without authority intercept the transmission of non-public electronic information or electronic documents from, to, or within a computer or electronic system belonging to another person, whether or not such interception causes changes, deletion, or termination of the information being transmitted.

The language is broad. It covers live wiretapping of calls in progress, recording stored voicemails or messages on someone else's device, and intercepting data packets traveling across networks.

Penalties Under the UU ITE

Article 47 of the UU ITE sets the punishment for violating Article 31:

Offense	Maximum Prison Term	Maximum Fine
Interception of electronic information (Art. 31(1))	10 years	IDR 800 million (~USD 49,000)
Interception of transmissions (Art. 31(2))	10 years	IDR 800 million (~USD 49,000)
Interception causing material harm (Art. 36 + 51(2))	12 years	IDR 12 billion (~USD 735,000)

The 2024 amendment (UU 1/2024) increased several fine amounts across the ITE Law and refined provisions around digital evidence handling. Importantly, courts can impose both imprisonment and fines simultaneously.

The Law Enforcement Exception

Article 31(3) carves out a single exception: interception carried out for law enforcement purposes at the request of the police, the prosecutor's office (Kejaksaan), or another institution authorized by statute. This exception does not extend to private citizens, employers, or businesses under any circumstances.

The New Criminal Code (KUHP): What Changed on January 2, 2026

Indonesia's new Criminal Code (UU 1/2023) replaced the colonial-era Wetboek van Strafrecht that had governed criminal law since 1918. The new KUHP absorbed and expanded several provisions previously found only in the UU ITE.

Article 258: The New Wiretapping Statute

Article 258 of the KUHP now serves as the primary criminal provision for illegal interception. It states:

Article 258(1): Any person who unlawfully listens to, records, redirects, alters, obstructs, or notes the transmission of non-public electronic information or electronic documents, whether through wired or wireless communication networks, faces imprisonment of up to 10 years or a fine of up to Category VI.

Article 258(2): Any person who broadcasts or disseminates the results of conversations or recordings obtained through the acts described in subsection (1) faces imprisonment of up to 10 years or a fine of up to Category VI.

Article 258(3): The prohibitions in subsection (1) do not apply to anyone carrying out the provisions of laws and regulations or executing official orders.

Category VI fines under the new KUHP max out at IDR 2 billion (approximately USD 122,000). That is a significant increase from the IDR 800 million ceiling under the old UU ITE penalties.

Key Differences from the UU ITE

The new KUHP provisions differ from the UU ITE framework in several ways:

• Broader verbs: Article 258(1) adds "redirects, alters, obstructs, and notes" to the list of prohibited acts, going beyond the UU ITE's "interception and wiretapping" language.
• Dissemination penalty: Article 258(2) separately criminalizes sharing the results of illegal recordings, even if you were not the person who made the original interception.
• Higher fines: The Category VI fine ceiling of IDR 2 billion is 2.5 times the UU ITE maximum.
• Unified code: Rather than relying on a patchwork of special statutes, these provisions now sit inside the national Criminal Code alongside other offenses.

Because the KUHP took effect on January 2, 2026, and revoked several overlapping ITE provisions, prosecutors can now charge wiretapping offenses under Article 258 directly.

The Personal Data Protection Law (UU PDP)

The Personal Data Protection Law (UU 27/2022) adds another layer of legal risk for anyone who records, stores, or shares recordings containing personal data.

How the PDP Law Applies to Recordings

Any audio or video recording that captures identifiable individuals constitutes personal data under the PDP Law. Processing that data, which includes collecting, storing, sharing, or publishing it, requires a lawful basis. The six lawful bases recognized under the PDP Law are:

1. Explicit, informed consent from the data subject
2. Performance of a contract
3. Legal obligation
4. Protection of vital interests
5. Public interest duties
6. Legitimate interests (balanced against the data subject's rights)

For a private recording of a conversation, the most relevant basis is consent. Without it, you likely have no lawful ground to process that recording.

PDP Law Penalties

The PDP Law imposes its own criminal and administrative penalties, separate from the KUHP and UU ITE:

Offense	Maximum Prison Term	Maximum Fine
Unlawfully collecting personal data	5 years	IDR 5 billion (~USD 306,000)
Unlawfully disclosing personal data	4 years	IDR 4 billion (~USD 245,000)
Unlawfully using personal data	5 years	IDR 5 billion (~USD 306,000)
Falsifying personal data	6 years	IDR 6 billion (~USD 367,000)

Corporations face fines up to 10 times the individual maximum. A company convicted of unlawfully collecting personal data through recordings could face penalties of up to IDR 50 billion (approximately USD 3 million), along with business suspension, license revocation, or forced dissolution.

Administrative sanctions include written warnings, temporary suspension of data processing activities, forced deletion of data, and fines of up to 2% of annual revenue.

Phone Call Recording Laws in Indonesia

Recording a phone call in Indonesia without the consent of all parties on the line violates Article 258 of the KUHP and, depending on the circumstances, the PDP Law as well.

What Counts as Consent

Consent must be explicit and informed. A beep tone at the start of a call does not satisfy the requirement unless the other party has been clearly told the call is being recorded and agrees to continue. Automated disclosures like "this call may be recorded for quality assurance" satisfy the requirement only if the caller has a genuine opportunity to decline and hang up.

One-Party vs. All-Party

Indonesia does not recognize one-party consent for electronic communications. Even if you are a participant in the call, recording it without telling the other parties is illegal. This sets Indonesia apart from countries like the United States (where many states allow one-party consent) and aligns it more closely with Germany and several other civil law jurisdictions.

Can Recordings Be Used as Evidence in Court?

Indonesian courts have addressed this question multiple times. Electronic recordings, including audio files, chat logs, and video, can be admitted as evidence under the UU ITE and the Code of Criminal Procedure, but only if:

• The recording is authentic and has not been altered or manipulated.
• The recording was obtained lawfully, meaning it did not result from illegal interception.
• The recording maintains its integrity and can be verified through forensic examination if challenged.

A recording obtained through illegal wiretapping is generally inadmissible. Courts have excluded evidence where the recording party could not demonstrate lawful acquisition. However, there is some judicial discretion, and outcomes can vary by jurisdiction and the specific facts of the case.

In-Person Conversation Recording

The legal framework for recording face-to-face conversations in Indonesia is less explicitly defined than for electronic communications, but the same principles apply through overlapping statutes.

Article 258 of the KUHP specifically addresses "electronic information" and "electronic documents," which means it primarily targets digital communications. However, recording an in-person conversation with a smartphone or other electronic device creates an electronic document, bringing it within the statute's reach.

The PDP Law applies regardless of how the recording is made. If the recording captures identifiable personal data (a person's voice, image, or statements), it requires a lawful basis for processing.

As a practical matter, secretly recording an in-person conversation in Indonesia carries legal risk under both the KUHP and the PDP Law. The safest approach is always to obtain consent from everyone present before hitting record.

Workplace Recording and Employee Monitoring

Indonesia has no standalone workplace surveillance statute. Instead, employers must navigate the PDP Law, the UU ITE, and general employment regulations.

What Employers Can Do

Employers may monitor workplace communications and install surveillance equipment, but only under specific conditions:

• Lawful basis required: The employer must establish a lawful ground under the PDP Law, typically the employment contract or legitimate interest.
• Written notice: Employees must be explicitly informed that monitoring is taking place. The notice must describe what is being monitored, why, and how the data will be used.
• Proportionality: Monitoring must be proportionate to its stated purpose. Continuous screen recording, full keystroke logging, and unrestricted monitoring of personal devices are considered high-risk activities requiring strong justification and explicit written consent.
• Location limits: CCTV cameras may be installed in work areas but never in restrooms, changing rooms, prayer rooms, or other spaces where employees have a reasonable expectation of privacy.

What Employers Cannot Do

Employers cannot secretly record employee conversations, monitor personal email accounts without consent, or install hidden cameras. Violating these rules exposes the employer to both criminal liability under the KUHP and civil liability under the PDP Law.

The PDP Law's corporate penalty multiplier (up to 10 times the individual fine) makes compliance failures particularly expensive for businesses.

Recording in Public Places

Indonesia's PDP Law governs CCTV and surveillance in public spaces with specific requirements:

CCTV in Public Areas

The PDP Law permits CCTV installation in public places and public service facilities only for:

• Security purposes
• Disaster prevention
• Traffic management and monitoring
• Collection, analysis, and regulation of traffic information

Organizations operating CCTV in public spaces must:

• Display clear signage indicating that CCTV is in operation
• Include the contact information of the person responsible for the surveillance system
• Place notices at entrances to enclosed spaces or in easily visible positions

Personal Recording in Public

Taking photos or recording video in genuinely public spaces (streets, parks, markets) is generally permitted, but publishing recordings that identify specific individuals triggers PDP Law obligations. You would need either consent from the identifiable person or another lawful basis, such as journalism or public interest, to share such recordings publicly.

Law Enforcement Wiretapping: Who Can Do It and How

Indonesia grants wiretapping authority to several law enforcement bodies, each with its own rules and oversight mechanisms.

The Corruption Eradication Commission (KPK)

The KPK has the broadest wiretapping authority among Indonesian agencies. Under Law No. 30/2002 (as amended), the KPK can intercept communications related to corruption investigations. Key constraints include:

• A maximum duration of 6 months per wiretap authorization
• Prior permission from the KPK Supervisory Board (Dewan Pengawas)
• The Supervisory Board reviews and oversees all interception activities

National Police (Polri)

The National Police may conduct wiretapping under National Police Regulation No. 5/2010, but only for the purposes of preliminary investigation, formal investigation, prosecution, and examination of criminal acts. Wiretapping requires permission from the head of the relevant district court.

Attorney General's Office (Kejaksaan)

The Attorney General's Office has sought expanded wiretapping powers, particularly for fugitive apprehension. Recent cooperation agreements with telecommunications providers have drawn scrutiny from civil liberties organizations concerned about oversight gaps.

Oversight Gaps

Despite these frameworks, Indonesian legal scholars and privacy advocates have noted that the country's wiretapping regulations lack cohesion. Different agencies operate under different statutes with varying oversight requirements, creating inconsistencies that remain unresolved under the new KUHP.

Business Compliance: What Companies Need to Know

Companies operating in Indonesia face compliance obligations under multiple statutes when it comes to recording and data collection.

Call Center and Customer Service Recording

Businesses that record customer calls must:

• Provide clear notice at the start of every call that recording is taking place
• Give customers a genuine opportunity to decline (opt out or end the call)
• Store recordings securely and limit access to authorized personnel
• Establish retention policies and delete recordings when no longer needed
• Comply with data subject access requests under the PDP Law

Data Processing Impact Assessments

The PDP Law requires organizations to conduct impact assessments for high-risk data processing activities. Recording calls, operating CCTV systems, and monitoring employee communications all qualify as activities that warrant assessment.

Cross-Border Data Transfers

If recorded data is stored on servers outside Indonesia or shared with foreign affiliates, additional PDP Law requirements apply. Indonesia requires that the receiving country provide an adequate level of data protection, or that the transfer is covered by contractual safeguards.

The PDP Agency

Indonesia is in the process of establishing a dedicated Personal Data Protection Agency (Lembaga PDP) to oversee enforcement. Until the agency is fully operational, enforcement falls to the Ministry of Communication and Digital Affairs (Komdigi). Companies should prepare for stricter enforcement once the agency begins operations, which is targeted for 2026.

Penalties Summary

Here is a consolidated view of the penalties across all three major statutes:

Statute	Offense	Max Prison	Max Fine
KUHP Art. 258(1)	Illegal interception/recording	10 years	IDR 2 billion
KUHP Art. 258(2)	Disseminating illegal recordings	10 years	IDR 2 billion
UU ITE Art. 31/47	Electronic interception	10 years	IDR 800 million
UU ITE Art. 36/51(2)	Interception causing material harm	12 years	IDR 12 billion
PDP Law	Unlawful collection of personal data	5 years	IDR 5 billion
PDP Law	Unlawful disclosure of personal data	4 years	IDR 4 billion
PDP Law	Unlawful use of personal data	5 years	IDR 5 billion
PDP Law (Corporate)	Any PDP offense by a company	N/A	Up to 10x individual fine

These penalties can stack. A single act of illegal recording could trigger charges under both the KUHP and the PDP Law, with sentences running consecutively.

Practical Tips for Staying Legal in Indonesia

• Always get explicit consent before recording any conversation, whether by phone or in person.
• Announce recordings clearly at the start of any call or meeting. A mumbled disclaimer is not enough.
• Never record someone else's conversations. Intercepting communications between third parties carries the harshest penalties.
• Do not share illegal recordings. Even if someone else made the recording, disseminating it is a separate crime under KUHP Article 258(2).
• Businesses must post CCTV notices in all monitored areas and maintain records of their data processing activities.
• Consult a local attorney before implementing any recording, monitoring, or surveillance system in Indonesia. The interaction between the KUHP, UU ITE, and PDP Law creates complexity that requires professional guidance.