Has your company requested the candidates’ consent prior to the pre-employment screening? In Indonesia, the protection of personal data is referred to The Minister of Communication and Information Technology Regulation
No. 20 of 2016 concerning The Protection of Personal Data (PPD). PDD regulation is considered to be another challenge for recruitment teams when screening potential employees. The protection of personal data is currently very strict in several industries such as health, finance, taxes, and other industrial sectors.
The scope of PPD includes the protection of acquisition, collection, processing, analyzing, storing, displaying, announcing, sending, disseminating, and destroying personal data as stipulated in Article 2 paragraph (1). Therefore, in order to legally collect and verify a candidate’s data during the screening, the company must require the candidate’s consent. This matter is specifically stated in Article 6 where companies are obliged to provide consent forms in Indonesia. The consent form needs to be signed by the candidate prior to the pre-employment screening.
In the letter, the company and/or designated screening vendor must convey that they have been authorized to verify the information contained in the job application letter. Data that will be obtained is used for the purpose of recruitment only. The points that will be verified are indicated in the approval letter, which usually includes records of employment, performance, salary, competency, and behavior.
The validity period of the letter should also be stated in the letter. Although it has not been specifically regulated, some companies practice a validity period of three to six months effective on the day the letter was signed by the candidate.
The designated parties, in this case, the company and/or the screening vendor, are responsible for storing, maintaining, and protecting the information contained therein. The data storage period depends on company regulations. However, if the company does not have specific regulations, then the period of data storage can be referred to Article 15 paragraph 3 (b), which is stated to be a minimum of five years.
