In many Indonesian companies, AI has made its way into daily work without much discussion. Customer service staff ask ChatGPT to tidy up replies, HR summarises applicant CVs with it, and someone in finance pastes in a list of invoices to check. Almost all of that material contains personal data: names, phone numbers, addresses, NIK numbers and transaction histories.
That is why UU PDP and company use of AI belong in the same conversation. Indonesia's Personal Data Protection Law (UU PDP, Law No. 27 of 2022) does not ban AI. The rules on how personal data is processed still apply, whatever tool you use. This article covers the general principles, how they play out in a typical office, and a checklist you can start working through. It is general guidance and does not replace legal advice.
Why UU PDP matters for AI
UU PDP covers the processing of personal data broadly, from collection and storage to analysis and deletion. When an employee sends customer data to an AI service, that is processing too. Your company remains responsible for the data, even though the work happens on the AI provider's servers.
In most companies, AI use grows from the ground up. Staff try it on their own, find it useful and make it a habit. Management only notices when a client or an auditor starts asking questions. So the first step is usually a simple inventory: who uses AI, for what work, and which data goes along with it.
The data protection principles that matter most
In general terms, five principles have the most direct impact on company AI use.
Lawful basis and consent
Personal data needs a lawful basis for processing. Consent from the data subject is one, and there are others, such as performing a contract. The practical question is straightforward. When customers gave you their data, were they told it might be processed with help from third-party services, including AI? Review your privacy policy and consent forms with that in mind.
Purpose limitation
Data is collected for a specific purpose and should be used for that purpose. Patient data that a clinic collects to provide care, for example, cannot simply be reused to build marketing profiles with AI. Before starting a new AI project, write down its purpose and check it against the reason the data was collected in the first place.
Data minimisation
Send only the data the task actually needs. To summarise a customer complaint, the AI does not need an NIK or a bank account number. To draft an agreement, the parties' names can be replaced with placeholders such as Party A and Party B. Small habits like this reduce risk without making AI any less useful.
Security
Companies are expected to protect personal data with appropriate security measures. For AI, that means using company accounts, controlling who has access, checking chat history settings, and making sure an AI integration cannot reach more data than its task requires.
Accountability
Your company should be able to show what it does with personal data. A simple register goes a long way: which AI services are in use, who uses them, for which processes, and what data is involved. For AI built into internal applications, access logs are far stronger evidence than anyone's recollection.
What this looks like in practice
A distributor that uses AI to summarise customer WhatsApp conversations can start by stripping phone numbers and addresses before the text is processed. The summaries remain useful for the sales team, and far less data leaves the company.
A notary's office using AI to read deeds can limit access per file, so the AI only sees documents for the client currently being handled. A clinic using AI to answer scheduling questions only needs to give it the doctors' timetable, not medical records.
The pattern is the same in almost every case. Define the task clearly, then limit the data that reaches the AI to what that task requires.
Checking your AI provider's terms
Before choosing a service or vendor, read its terms of use and data policy. Find out whether submitted data is used to train models and whether you can switch that off. Check how long conversations and files are retained and how to delete them. Business accounts and API access often come with different data terms from personal accounts, so do not assume they are the same.
Note where the data is processed as well. Most AI services process data outside Indonesia, and UU PDP also has rules on transferring personal data abroad. This is one of the areas most worth discussing with your legal counsel.
A UU PDP checklist for AI use
Treat this list as a starting point and adapt it to your business.
- Map how each department uses AI, including any use through personal accounts.
- Decide which AI services the company approves, and move usage onto company accounts.
- Sort data into three groups: fine to send to AI, fine once masked, and never to be sent.
- Review your privacy policy and consent forms so they cover processing by third parties.
- Write down the purpose of every process that uses AI and check it against the original purpose of collection.
- Turn on access logging for every AI integration in your internal systems.
- Name an owner, schedule regular reviews, and prepare the steps to take if a data incident occurs.
- Ask legal counsel to review the policy before it takes effect.
You do not need to finish this list in a month. What matters is that someone owns it and progress is visible.
Controlling AI access to documents
For firms that handle many client documents, part of this checklist can be enforced by the system. Folders lets you control which folders Claude or ChatGPT can reach through MCP, records every access in an audit log, and masks NIK and NPWP numbers before a document is read by AI. You can find the details on the Folders page.
