Indonesia Recording Laws: Contested Consent, KUHP & Penalties (2026)

Indonesia's recording consent status is legally contested: KUHP Article 258, in force January 2, 2026, prohibits unlawfully recording non-public electronic transmissions without the "belonging to another person" wording that practitioners read into prior UU ITE Article 31 as leaving room for participant recording, so the legality of participant recording is genuinely unsettled. Third-party interception is clearly prohibited under KUHP Article 258, as it was under UU ITE Article 31 before that article was repealed on January 2, 2026.

Quick Answer: Is Indonesia One-Party or All-Party Consent?

Indonesia's participant recording consent classification is genuinely contested and legally unsettled. Prior to January 2, 2026, Indonesian legal practitioners and Hukumonline legal analysis generally concluded that participant recording was not criminally prohibited, relying on the "belonging to another person" language in UU ITE Article 31 and the doctrinal distinction between "penyadapan" (intercepting someone else's communication) and "merekam" (recording a conversation you are a party to). Under that analysis, Indonesia functioned in practice as a one-party consent jurisdiction.

That analysis has been complicated by the entry into force of KUHP Article 258 on January 2, 2026. The new provision dropped the "belonging to another person" limitation and prohibits "unlawfully" listening to or recording transmissions of non-public electronic information -- with no explicit participant exception. The explanatory notes (penjelasan) to Article 258 enumerate three narrow categories that do not constitute unlawful conduct, none of which cover deliberate participant recording. This gap sharpens a legal uncertainty that already existed in a weaker form under the prior UU ITE framework: the official elucidation of UU ITE Article 31 listed recording as a form of interception, and the Constitutional Court in 2016 described wiretapping as including recording.

Multiple international legal resources and Indonesian law school analyses classify Indonesia as an all-party consent country. Multiple Indonesian practitioner analyses and Hukumonline klinik articles have classified it as one-party consent. Neither position has been definitively settled by the Indonesian Supreme Court or the Mahkamah Konstitusi with respect to the KUHP Article 258 framework now in force.

Practical consequence: Until Indonesian courts or the legislature clarify whether participant recording falls within or outside the "unlawfully" standard in KUHP Article 258, anyone recording a conversation they are a party to in Indonesia faces genuine legal risk. Distributing, sharing, or using a participant recording -- even one made lawfully -- carries additional exposure under the UU PDP and, depending on the content, KUHP Article 407 (references to former UU ITE Article 27(1) now point to it).

What is clear and undisputed is that third-party interception -- listening to, recording, or intercepting a communication to which you are not a party -- is strictly prohibited under KUHP Article 258, with penalties up to 10 years imprisonment. Before January 2, 2026, it was prohibited under UU ITE Article 31.

Three overlapping statutes govern this area: the Electronic Information and Transactions Law (UU ITE, Law No. 11/2008 as most recently amended by Law No. 1/2024), whose interception offense was repealed on January 2, 2026 but whose lawful-interception and evidence provisions remain, the Personal Data Protection Law (UU PDP, Law No. 27/2022), and the Criminal Code (KUHP, Law No. 1/2023), which took effect on January 2, 2026. A fourth instrument, the new Criminal Procedure Code (KUHAP, Law No. 20/2025), signed on December 17, 2025 and also in force since January 2, 2026, reorganizes law enforcement wiretapping authority while creating a notable oversight gap.

Jurisdiction scope: This article addresses Indonesian national law on recording consent, wiretapping, personal data protection, and digital sexual violence as of September 2026. It covers the UU ITE (Law No. 11/2008, amended by Laws No. 19/2016 and No. 1/2024), KUHP (Law No. 1/2023), KUHAP (Law No. 20/2025), UU PDP (Law No. 27/2022), and UU TPKS (Law No. 12/2022). It does not address Indonesian military law or subnational regulations. For US state recording laws, see our US state-by-state recording law guide.

Key statutory provisions last verified against official Indonesian sources in September 2026. This article has not yet been reviewed by a licensed Indonesian attorney.

UU ITE Article 31: The Former Prohibition on Third-Party Interception

The Electronic Information and Transactions Law (UU ITE), first enacted as Law No. 11 of 2008 and most recently amended by Law No. 1 of 2024, established Indonesia's foundational prohibition on electronic interception. Practitioners read Article 31 as targeting third-party interception: persons who intercept communications they are not party to, not participants recording their own conversations. This distinction has significant practical implications for anyone seeking to record business calls, document disputes, or preserve evidence of a conversation they are having.

Article 31: The Text

Article 31 contained two core prohibitions:

Article 31(1): No person may intentionally and without authority intercept or wiretap electronic information or electronic documents stored in a computer or electronic system belonging to another person.

Article 31(2): No person may intentionally and without authority intercept the transmission of non-public electronic information or electronic documents from, to, or within a computer or electronic system belonging to another person, whether or not such interception causes changes, deletion, or termination of the information being transmitted.

The phrase "belonging to another person" and the requirement that the interceptor act "without authority" provided the textual anchors that Indonesian practitioners used to support a participant-recording exception. A party to a communication has inherent authority to perceive and document that communication; a third party does not.

That reading was never settled. The official elucidation of Article 31(1), restated in Law No. 19/2016, defined interception as listening to, recording, redirecting, altering, obstructing and/or noting non-public transmissions, and in Decision 20/PUU-XIV/2016 the Constitutional Court described wiretapping as including recording and as unlawful outside law enforcement.

Article 31(3) carves out a single statutory exception: interception carried out for law enforcement purposes at the request of the police, the prosecutor's office (Kejaksaan), or another institution authorized by statute. This exception does not extend to private citizens, employers, or businesses under any circumstances.

Important note on KUHP Article 258: The new Criminal Code (KUHP, Law No. 1/2023, in force January 2, 2026) replaced the UU ITE Article 31 wiretapping prohibition with Article 258. KUHP Article 622(1)(r) repealed UU ITE Articles 27(1), 31(1), 31(2), 36, 47 and 51(2), among others, with effect from January 2, 2026. As discussed in the KUHP section below, Article 258 omits the "belonging to another person" limitation that was the primary textual basis for the participant-recording exception. The UU ITE Article 31 analysis above reflects the law as it applied before January 2, 2026 and remains relevant for conduct that occurred during that period.

Former Penalties Under UU ITE Article 47 (Conduct Before January 2, 2026)

Courts could impose both imprisonment and fines. Articles 31(1), 31(2), 36, 47 and 51(2) were repealed on January 2, 2026; conduct from that date is charged under KUHP Article 258.

KUHP Article 258: The New Wiretapping Statute (In Force January 2, 2026)

Indonesia's Criminal Code (KUHP, Law No. 1/2023) replaced the colonial-era Wetboek van Strafrecht that had governed criminal law since 1918. The new KUHP entered force on January 2, 2026, following a three-year transition period. It absorbed the UU ITE interception offense into a unified criminal code.

Article 258: Text and Scope

Article 258(1): Any person who unlawfully listens to, records, redirects, alters, obstructs, or notes the transmission of non-public electronic information or electronic documents, whether through wired or wireless communication networks, faces imprisonment of up to 10 years or a fine of up to Category VI.

Article 258(2): Any person who broadcasts or disseminates the results of conversations or recordings obtained through the acts described in subsection (1) faces imprisonment of up to 10 years or a fine of up to Category VI.

Article 258(3): The prohibitions in subsection (1) do not apply to anyone carrying out the provisions of laws and regulations or executing official orders, as referred to in Articles 31 and 32.

Category VI fines under the KUHP cap at IDR 2 billion (approximately USD 122,000). That is 2.5 times the IDR 800 million ceiling under former UU ITE Article 47.

The Participant Recording Problem Under KUHP Article 258

This is the critical change that creates legal uncertainty about participant recording under current law.

Under the prior UU ITE Article 31, the prohibition was anchored to interception of communications in systems "belonging to another person." Indonesian practitioners and Hukumonline legal analysis used that limiting language to argue that a participant recording their own conversation was not covered, because the communication was also "belonging to" the recorder.

KUHP Article 258(1) contains no equivalent limitation. It prohibits "unlawfully" listening to or recording transmissions of non-public electronic information, without restricting that prohibition to systems belonging to someone else. The official elucidation states that the provision is meant to protect the speaker against a person who unlawfully listens to or records the conversation; it does not say whether a participant in the conversation can be that person. The explanatory notes (penjelasan) to Article 258 identify three narrow examples of what does not constitute "unlawful" conduct: (a) technical devices installed by the occupant of a house causing unintentional recording; (b) radio telephone conversations received unintentionally; and (c) telephone conversations heard by authorized telephone employees monitoring network operation. None of these examples address deliberate participant recording of a conversation.

The exception in Article 258(3) covers only those "carrying out the provisions of laws and regulations or executing official orders" -- that is, people acting to carry out a statutory provision or an official order from an authorized official (Articles 31 and 32), such as law enforcement, not private individuals simply recording their own conversations.

We have not found a reported Indonesian court ruling clarifying whether the "unlawfully" standard in KUHP Article 258(1) reaches participant recording. The legal landscape has shifted since January 2, 2026, and the previously reliable practitioner consensus on participant recording has been unsettled by this statutory change.

How KUHP Article 258 Differs from UU ITE Article 31

For conduct from January 2, 2026, wiretapping offenses are charged under KUHP Article 258: KUHP Article 622(1)(r) repealed UU ITE Articles 31(1), 31(2), 36, 47 and 51(2) on that date. The UU ITE remains in force for its other provisions, including the Article 31(3) rule on law enforcement interception.

The KUHAP Oversight Gap (Law No. 20/2025)

A parallel development deserves attention alongside the KUHP. Indonesia's new Criminal Procedure Code (KUHAP, Law No. 20/2025), signed on December 17, 2025 and in force since January 2, 2026, reorganizes law enforcement authority. Article 136(1) authorizes investigators (penyidik) to conduct wiretapping for criminal investigations. Article 136(2) states that a separate law will regulate the specifics of such eavesdropping.

The problem: no such implementing law exists. Legal scholars at Universitas Gadjah Mada, the Indonesian Legal Aid Foundation, and civil society organizations have flagged that Article 136(1) as written gives investigators broad wiretapping authority without the judicial oversight safeguards previously in place. Human rights organizations characterized the situation as a "legal emergency." Until a wiretapping implementing law is enacted, this gap creates uncertainty about the oversight mechanism for law enforcement interception activities.

The Baiq Nuril Case: What It Actually Establishes

The conviction of Baiq Nuril Maknun under Indonesia's ITE Law is widely cited in discussions of Indonesia's recording law. Understanding exactly what it established -- and what it did not -- is essential for any accurate analysis.

The Facts

Nuril was a teacher in Lombok whose school principal subjected her to repeated sexually explicit and unwanted phone calls. She recorded one of those calls to document the harassment and protect herself against false accusations of an affair. The recording later circulated widely in Mataram, and the principal reported Nuril to police for spreading it. Her supporters said it was a colleague, not Nuril, who circulated it.

What She Was Convicted For

After the Mataram District Court acquitted her and prosecutors appealed, the Supreme Court of Indonesia convicted Nuril under UU ITE Article 27(1) in conjunction with Article 45(1), for distributing or making accessible electronic information containing content that violated decency. She was sentenced to six months imprisonment and a fine of IDR 500 million.

Nuril was not charged under or convicted of UU ITE Article 31 (interception/wiretapping). The act of recording itself was not the basis of her criminal liability. The Court's theory of liability concerned the downstream distribution of the recording's content -- and even that was legally controversial, since Nuril maintained she had not spread the recording herself, and the content that "violated morality" was her harasser's own words.

The Supreme Court then rejected her request for case review (peninjauan kembali). On July 29, 2019, following sustained public outcry over the injustice of her case, President Joko Widodo signed a decree granting her amnesty (Presidential Decree No. 24 of 2019).

What the Case Establishes and What It Does Not

The Baiq Nuril case establishes: (1) that recordings made by a participant for self-protection can be used as a vehicle for prosecution of that participant under a decency provision (in her case UU ITE Article 27(1)) if the recording is subsequently distributed by any party; (2) that, as critics noted, the Supreme Court did not apply its own gender-equality guidelines in her case; and (3) that the legal environment for participant recording in Indonesia carries genuine practical risk beyond the abstract question of whether the recording act itself is criminal.

The case does not establish: (1) that the act of participant recording is itself a crime under Article 31; (2) that Article 31 applies to conversations you are a party to; or (3) that Indonesia is definitively an all-party consent jurisdiction.

The case is best understood as a warning that even if participant recording is not itself criminal, the surrounding circumstances -- particularly any distribution of the recording -- expose the recorder to serious criminal liability under other provisions. In her case that was UU ITE Article 27(1), which was repealed on January 2, 2026; references to it now point to KUHP Article 407.

KUHP Article 322 and the Old Secret-Disclosure Framework

Before the new KUHP took effect, Article 322 of the old Criminal Code addressed unauthorized disclosure of professional secrets (a provision protecting, for example, doctor-patient or lawyer-client confidentiality). The new KUHP under Law No. 1/2023 carries forward analogous provisions but renumbers them. Article 258 is the primary interception and wiretapping provision; separate articles address professional secret disclosure.

The old Article 322 should not be confused with wiretapping law. It was and remains a narrow professional-secrecy obligation, not a general prohibition on participant recording of conversations.

UU PDP: Personal Data Protection Law (Law No. 27/2022)

The Personal Data Protection Law (UU PDP, Law No. 27/2022) adds a second layer of legal exposure for anyone who records, stores, or shares recordings containing personal data. The two-year compliance transition period ended on October 17, 2024; full compliance has been mandatory from that date.

How UU PDP Applies to Recordings

Any audio or video recording that captures identifiable individuals constitutes personal data under the UU PDP. "Processing" that data includes collecting, storing, sharing, and publishing. Processing requires a lawful basis. The six lawful bases under the PDP Law are:

1. Explicit, informed consent from the data subject
2. Performance of a contract to which the data subject is a party
3. Compliance with a legal obligation
4. Protection of vital interests of the data subject
5. Performance of a public interest task or exercise of official authority
6. Legitimate interests pursued by the controller, provided those interests do not override the data subject's fundamental rights

For a private recording of a conversation, even one the recorder participated in and was legally entitled to make, the subsequent storage, sharing, or publication of that recording still requires a PDP-compliant lawful basis.

PDP Law Penalties

These fine ceilings were set by Law No. 1/2026 on Criminal Penalty Adjustment, in force January 2, 2026, which converted the PDP Law fines into KUHP fine categories (Category IV is IDR 200 million and Category V is IDR 500 million). The original 2022 text stated fines of IDR 4 billion to 6 billion.

Corporations can be fined only, up to 10 times the maximum fine for the offense (Art. 70(3)), and may face additional penalties including forfeiture of proceeds, freezing or closure of all or part of the business, revocation of permits, or dissolution (Art. 70(4)).

Since January 2, 2026, KUHP Article 613(3) also requires that, under administrative laws carrying criminal sanctions (a group whose official elucidation names the PDP Law), guidance and administrative sanctions be applied before criminal penalties.

Administrative sanctions include written warnings, temporary suspension of data processing activities, forced deletion of data, and fines of up to 2% of annual revenue.

PDP Agency Status

The PDP Law assigns its administration to a dedicated agency (lembaga) established by the President and responsible to the President, with details to be set by Presidential Regulation (Art. 58), and it is this agency that imposes administrative sanctions (Art. 57(4)). We have not been able to confirm from an official source that the agency is operational. Companies should prepare now for stricter enforcement once it is.

UU TPKS: Sexual Violence Crimes Law and Non-Consensual Recording (Law No. 12/2022)

The Sexual Violence Crimes Law (UU TPKS, Law No. 12/2022) adds a third statutory layer specifically targeting non-consensual recording and distribution of sexual content.

Article 14: Voyeurism and Non-Consensual Intimate Images

Article 14(1) of the UU TPKS punishes, as electronic-based sexual violence, (a) recording or capturing images or screenshots with sexual content without the consent of the person recorded, (b) sending sexual content to a recipient against their will, and (c) electronic stalking or tracking for sexual purposes. Penalties under Article 14(1):

• Maximum imprisonment: 4 years
• Maximum fine: IDR 200 million (approximately USD 12,200)

Where the act is done to extort, threaten, coerce, or deceive someone, the maximum rises to 6 years and a fine of up to IDR 500 million (Art. 14(2), fine as adjusted by Law No. 1/2026). Prosecution requires a complaint by the victim, except where the victim is a child or a person with a disability (Art. 14(3)). Recording or sending under Article 14(1)(a) or (b) is not punishable where it is done in the public interest or to defend oneself against a sexual violence crime (Art. 14(4)).

This provision is distinct from the UU ITE and KUHP wiretapping articles. It targets the content of what is recorded, not merely the act of interception. A participant who records their own sexual encounter without their partner's consent can face prosecution under Article 14 even though they were a party to the encounter.

Layered Liability for NCII Cases

Non-consensual intimate image (NCII) cases in Indonesia can attract prosecution under multiple overlapping statutes:

• Former UU ITE Article 27(1), now KUHP Article 407: Article 27(1) prohibited transmission of electronic information with content "violating decency" and was applied to NCII cases, though legal scholars note interpretive inconsistency and risk of gender bias in how courts applied it. It was repealed on January 2, 2026, and references to it now point to KUHP Article 407, which punishes producing or distributing pornography.
• UU TPKS Article 14: The dedicated voyeurism provision. On its text it covers recording sexual content without consent and sending unwanted sexual content to a recipient, not sharing an existing intimate image with third parties as such.
• UU PDP: Sharing intimate images of identifiable individuals without consent is unauthorized disclosure of personal data.
• Pornography Law (Law No. 44/2008): May apply depending on content.

Note on UU ITE Article 27A: The 2024 amendment (Law No. 1/2024) inserted Article 27A into the UU ITE. This provision addresses criminal defamation (intentionally attacking someone's honor or good name), not NCII. The two provisions serve different purposes and should not be confused.

Deepfake and AI-Generated Content

We have not identified Indonesian legislation aimed specifically at deepfake content. Prosecutors apply the existing framework on a case-by-case basis, with significant enforcement challenges.

The Regulatory Gap

The three primary statutes applicable to deepfake sexual content are:

1. Former UU ITE Article 27(1) and KUHP Article 407: Article 27(1) (distributing content "violating decency") was repealed on January 2, 2026, and references to it now point to KUHP Article 407 on pornography. Neither provision addresses AI-generated content specifically.
2. UU TPKS Article 14: Covers recording or capturing sexual content without the consent of the person recorded, and sending sexual content to a recipient against their will. Whether AI-generated images of a real person count as "recordings" of that person is an open legal question.
3. Pornography Law (Law No. 44/2008): General prohibition on pornographic content; does not distinguish AI-generated from authentic content.

Academic commentary published in 2025 in the International Journal for the Semiotics of Law (Springer Nature) confirms that Indonesia's existing frameworks have not specifically addressed the characteristics and risks of generative AI, and that regulatory gaps remain concerning. Enforcement faces additional barriers including technical detection of AI manipulation, perpetrator anonymity, and cross-border jurisdiction.

Recent Cases

Cases involving AI-generated intimate images emerged at universities in Udayana (Bali) and Semarang in 2025. Prosecutions proceeded under the existing UU ITE and UU TPKS framework. Results from those proceedings are not yet publicly reported in accessible English-language sources.

What This Means Practically

Anyone in Indonesia who creates, distributes, or uses AI tools to generate intimate images of real, identifiable people risks prosecution under the patchwork of existing statutes even absent AI-specific law. The absence of a targeted statute does not create a safe harbor; it creates unpredictability in enforcement and outcome.

Phone Call Recording

Recording a phone call in Indonesia involves significant legal uncertainty, and the answer depends on which legal framework controls.

Participant Recording: The Contested Question

When you are a party to a phone call, is recording that call without notifying the other parties lawful in Indonesia?

The prior analysis (under UU ITE Article 31): Under UU ITE Article 31, the prohibition targeted interception of communications "belonging to another person." Indonesian legal practitioners and Hukumonline analyses, applying the distinction between "penyadapan" (intercepting someone else's communication) and "merekam" (recording your own conversation), concluded that participant recording was not criminally prohibited. Under this view, Indonesia functioned as a one-party consent jurisdiction.

The current uncertainty (under KUHP Article 258): Since January 2, 2026, the operative wiretapping statute is KUHP Article 258. That provision omits the "belonging to another person" limitation. The explanatory notes list only three narrow examples of non-unlawful conduct, none of which cover participant recording. No Indonesian court has clarified whether "unlawfully" in Article 258 reaches participant recording. Until that clarification comes, the legal risk for participant recording has increased materially compared to the prior UU ITE framework.

The practical risk dimension (the Baiq Nuril cautionary lesson): Even if participant recording is ultimately held not to violate Article 258, the Baiq Nuril case illustrates that recordings made by participants can be used against the recorder under other provisions -- in her case the decency provision then in UU ITE Article 27(1), whose references now point to KUHP Article 407, once the recording was distributed. The combination of an unclear Article 258, the separate dissemination offense in Article 258(2), and UU PDP data-processing obligations means that anyone recording a conversation in Indonesia should consult an Indonesian attorney before making or using that recording.

The legal conclusion: The participant recording question is genuinely unsettled under current law. Anyone who needs to record conversations in Indonesia for legal, business, or evidentiary purposes should obtain specific legal advice rather than relying on the prior one-party consent characterization.

Third-Party Interception (Prohibited)

Recording a conversation between two other people, neither of whom you are, is prohibited under KUHP Article 258 (and, before January 2, 2026, under UU ITE Article 31), regardless of your purpose. There is no private citizen exception for third-party wiretapping.

What Counts as Valid Consent for Recorded Calls

When a business or individual seeks to obtain consent rather than rely on participant recording:

• Consent must be explicit and informed, not merely implied.
• A beep tone at the start of a call satisfies consent only if the other party has been clearly told the call is being recorded and agrees to continue.
• Automated disclosures like "this call may be recorded for quality assurance" satisfy the requirement only if the caller has a genuine opportunity to decline and disconnect.
• Silence or continued participation after a brief disclosure may be treated as implied consent in some court interpretations, but best practice is to obtain affirmative agreement.

Can a Recorded Call Be Used as Evidence in Court?

Under the new Criminal Procedure Code (KUHAP, Law No. 20/2025, in force January 2, 2026), electronic evidence is a recognized category of evidence (Article 235(1)), subject to these conditions:

• The recording must be authentic, and its authenticity must be provable (Article 235(3)).
• The recording must have been obtained lawfully (Article 235(3)). A recording made through prohibited third-party interception fails this test.
• The judge decides both questions, and a recording found inauthentic or unlawfully obtained cannot be used as evidence and has no probative force (Article 235(4)-(5)).

In Decision 20/PUU-XIV/2016 the Constitutional Court (Mahkamah Konstitusi) held that electronic information used as evidence, in particular interception results, must be obtained in law enforcement at the request of the police, prosecutors, or another authorized agency. Law No. 19/2016 wrote this into the elucidation of UU ITE Article 5(2), limiting it to the results of interception or wiretapping, or recordings that are part of an interception. Whether a participant's own recording counts as a recording that is part of an interception has not been settled, and because the lawfulness of participant recording under KUHP Article 258 is itself unsettled, so is whether such a recording passes the Article 235 test.

In-Person Conversation Recording

The legal framework for face-to-face recording in Indonesia applies the same participant-versus-third-party logic -- and inherits the same uncertainty introduced by KUHP Article 258.

Article 258 of the KUHP targets "transmission of non-public electronic information or electronic documents" over wired or wireless communication networks. Its primary application is to electronic communications. Recording a purely in-person conversation on a smartphone creates an electronic document, and the UU PDP applies to that document if it captures identifiable personal data.

The participant-recording question that is unsettled for phone calls is equally unsettled for in-person recording under the KUHP Article 258 framework. Participants recording their own in-person meetings for personal reference occupy a legally defensible position under the prior UU ITE analysis, but that analysis has been weakened by the structural change in Article 258. The PDP Law governs what you may then do with any recording. Secret recording of a conversation between third parties carries the same serious criminal risks as phone interception.

Recording Police and Public Officials

Indonesian law does not contain an explicit provision prohibiting members of the public from filming police officers or other public officials performing their official duties in public.

KUHP Article 258, like former UU ITE Article 31, targets non-public electronic transmissions; it does not apply to open observation of public conduct in a public place. A police officer conducting a traffic stop or an arrest in public is not engaged in a "non-public electronic communication" that Article 258 protects.

Practical cautions apply:

• PDP Law triggers on publication. Footage that identifies individual officers or third parties becomes personal data under the UU PDP when you share it online. You need a lawful basis for that processing. Journalism, public interest documentation, and accountability recording are arguable lawful bases, but they are not explicitly defined safe harbors.
• Obstruction laws. Filming police officers who request you to stop or move may implicate separate obstruction or public order provisions unrelated to recording law.
• The new KUHAP. Law No. 20/2025 expands police authority in ways that civil society has flagged as concerning. Individuals filming police in Indonesia should be aware that the legal environment around police powers is in flux.

Watch out: Recording a police officer in Indonesia is legally distinct from the United States, where federal circuit courts have generally recognized a First Amendment right to film public officials. Indonesia has no equivalent constitutional provision establishing such a right. The absence of an explicit prohibition is not the same as a protected right.

Workplace Recording and Employee Monitoring

Indonesia has no standalone workplace surveillance statute. Employers navigate the UU PDP, the UU ITE, and general employment law.

What Employers May Do

Employers may monitor workplace communications and install surveillance equipment under specific conditions:

• Lawful basis under UU PDP: Typically the employment contract (performance of a contract) or legitimate interest. The legitimate interest must not override employees' fundamental rights, requiring a balancing assessment.
• Written notice: Employees must be explicitly informed of what monitoring is taking place, why, and how data will be used. Notice must be specific, not a generic privacy policy clause.
• Proportionality: Monitoring must match its stated purpose. Continuous screen recording, full keystroke logging, and monitoring of personal devices are high-risk activities requiring strong justification and, for the most intrusive forms, explicit written consent.
• Location limits: CCTV may be installed in work areas. Cameras are prohibited in restrooms, changing rooms, prayer rooms, and any other space where employees have a reasonable privacy expectation.

What Employers Cannot Do

Employers cannot secretly record employee conversations, access personal email or messaging accounts without consent, or install hidden cameras anywhere. Violating these rules creates criminal exposure under the KUHP (Articles 258 and 259) and liability under the UU PDP.

KUHP Article 259 separately punishes using deception, or acting unlawfully, to record images of people inside a home or a room not open to the public with a technical device to their detriment, as well as possessing images the person knows or should suspect were obtained that way, or spreading them by information technology, with up to 7 years or a Category VI fine (up to IDR 2 billion).

The UU PDP's corporate penalty multiplier (up to 10 times the maximum fine) makes workplace compliance failures particularly expensive. A business that secretly records employee conversations and then discloses those recordings faces that multiplier on the unlawful-disclosure fine, plus additional penalties such as freezing or closure of the business (Art. 70).

Recording in Public Places

CCTV in Public Areas

The UU PDP governs CCTV and surveillance systems in public spaces. The law permits CCTV in public places and public service facilities only for:

• Security purposes
• Disaster prevention
• Traffic management and monitoring
• Collection, analysis, and regulation of traffic information

Organizations operating CCTV in public spaces must display information in the monitored area that CCTV is in operation, and the equipment must not be used to identify individuals (Art. 17(1)). The notice and no-identification conditions do not apply to crime prevention and law enforcement (Art. 17(2)).

As good practice (not a statutory requirement), notices can also include contact information for the responsible party and be placed at entrances to enclosed spaces or in easily visible positions.

Personal Recording in Public

Taking photos or recording video in genuinely public spaces (streets, parks, markets) is generally permitted under Indonesian law. Publishing recordings that identify specific individuals triggers UU PDP obligations. You need either consent or a recognized lawful basis (such as public interest or journalism) to share such recordings publicly.

Law Enforcement Wiretapping

Indonesia grants wiretapping authority to several law enforcement bodies, each with its own statutory basis and oversight requirements.

Corruption Eradication Commission (KPK)

The KPK has the broadest wiretapping authority among Indonesian agencies. Under Law No. 30/2002 as amended by Law No. 19/2019, the KPK may intercept communications in corruption investigations. The 2019 requirement of prior written permission from the Supervisory Board (Dewan Pengawas) in Article 12B was struck down by the Constitutional Court in Decision 70/PUU-XVII/2019. Completed wiretaps must be accounted for to the KPK leadership and notified to the Supervisory Board within 14 working days (Article 12C(2) as interpreted by the Court).

National Police (Polri)

The National Police may conduct wiretapping under the framework of the new KUHAP (Law No. 20/2025). Article 136(1) of that code authorizes investigators to wiretap in the course of criminal investigations. The critical issue noted above applies here: Article 136(2) defers the specifics to a separate law on wiretapping, and we have not been able to confirm that such a law has been enacted.

Before the new KUHAP, Polri operated under National Police Regulation No. 5/2010, which set internal procedures for police wiretapping. Whether the new KUHAP has effectively replaced that requirement or whether courts and prosecutors will continue to apply the prior standard is an unresolved question pending the implementing regulation.

Attorney General's Office (Kejaksaan)

The Attorney General's Office has statutory authority to conduct wiretapping for law enforcement purposes. Cooperation agreements with telecommunications providers have drawn scrutiny from civil liberties organizations over oversight gaps.

Oversight Gaps

The interaction between the new KUHP, KUHAP, and the absence of an implementing wiretapping law creates the most significant current uncertainty in Indonesian recording law. Scholars at Universitas Gadjah Mada and civil society groups have explicitly flagged that law enforcement agencies have broad statutory authority to wiretap without an adequate existing legal framework to constrain how that authority is exercised. Until a dedicated wiretapping law is enacted under KUHAP Article 136(2), this gap persists.

Business Compliance: What Companies Need to Know

Call Center and Customer Service Recording

Businesses that record customer calls must:

• Provide clear notice at the start of each call that recording is taking place
• Give customers a genuine opportunity to decline (disconnect or opt out)
• Store recordings securely with access limited to authorized personnel
• Establish retention schedules and delete recordings when no longer required
• Comply with data subject access requests under the UU PDP
• Maintain records of processing activities (required for organizations processing data at scale)

Data Processing Impact Assessments

The UU PDP requires organizations to conduct data protection impact assessments (DPIAs) for high-risk processing activities. Recording calls, operating CCTV, and monitoring employee communications all qualify. A DPIA must document the purpose, necessity, proportionality, and safeguards for each high-risk activity.

Cross-Border Data Transfers

If recorded data is stored on servers outside Indonesia or shared with foreign affiliates, the UU PDP imposes additional requirements. The receiving country must offer personal data protection equal to or higher than the PDP Law's; if it does not, the controller must ensure adequate and binding safeguards; if neither applies, the controller must obtain the data subject's consent (UU PDP Art. 56). Implementing details are left to a Government Regulation. Indonesia has not yet published a whitelist of adequate countries; organizations should seek legal guidance on transfer mechanisms.

Preparing for the PDP Agency

The PDP Agency (Lembaga PDP) is to be set up by Presidential Regulation (Art. 58). Companies should use the time before it becomes operational to complete compliance programs, train staff, and implement technical safeguards, because enforcement is expected to intensify once it does.

Penalties Summary

Penalties can stack. A single act of non-consensual intimate recording and distribution could attract UU TPKS Art. 14 charges, KUHP Art. 259 charges (if made covertly inside a home or private room), and UU PDP disclosure charges simultaneously.

Practical Tips for Staying Legal in Indonesia

Participant recording of your own conversations is legally contested under current law. The prior UU ITE Article 31 analysis supported participant recording as lawful; KUHP Article 258 (in force January 2, 2026) dropped the limiting language that supported that conclusion. Until courts clarify the position, treat participant recording in Indonesia as carrying material legal risk.

Obtaining consent from all parties is the only safe approach. Given the genuine uncertainty about whether participant recording is lawful under KUHP Article 258, the safest practice is to disclose recording and obtain agreement from all participants before recording any conversation.

Never record conversations between third parties. Intercepting a communication you are not party to is a serious criminal offense under KUHP Article 258, as it was under UU ITE Article 31 before January 2, 2026.

Do not share any recording without legal basis. Sharing a recording -- whether or not the act of making it was lawful -- can attract liability under the KUHP (Article 258(2) for disseminating unlawfully made recordings, Article 407 for pornographic content) and the UU PDP. The Baiq Nuril case, decided under former UU ITE Article 27(1), shows how this happens. Consult counsel before distributing any recording.

Businesses must obtain consent or notify before recording customer calls. Clear pre-call disclosure and a genuine opt-out opportunity are the minimum standard.

CCTV operators in public places must post notices in monitored areas (UU PDP Art. 17).

For sexual or intimate content, consent is required. Recording intimate images of another person without their consent violates UU TPKS Article 14 regardless of whether the recorder was a participant, and sharing them can attract liability under the KUHP, the UU PDP, and the Pornography Law.

Consult a local attorney before implementing any recording, surveillance, or monitoring system in Indonesia. The interaction between the KUHP, KUHAP, UU ITE, UU PDP, and UU TPKS creates complexity that requires professional guidance specific to your situation.

Disclaimer

This article provides general legal information about Indonesian recording laws as of September 2026. It is not legal advice and does not create an attorney-client relationship. The laws described include UU ITE (Law No. 11/2008, amended by Laws No. 19/2016 and No. 1/2024), KUHP (Law No. 1/2023), KUHAP (Law No. 20/2025), UU PDP (Law No. 27/2022), and UU TPKS (Law No. 12/2022), as they were in force in September 2026. Indonesian law is subject to ongoing legislative change; the KUHAP oversight gap and the unsettled participant recording question under KUHP Article 258 in particular may be resolved by court decisions or implementing regulations that postdate this article.

Individuals and businesses with questions about their specific situation should consult a licensed Indonesian attorney (advokat) who can advise on current law and the facts of their case.

Authorities Cited

1. Law No. 11 of 2008 on Electronic Information and Transactions (UU ITE), as amended by Law No. 19 of 2016 and Law No. 1 of 2024. https://jdih.komdigi.go.id/produk_hukum/view/id/884/t/undangundang+nomor+1+tahun+2024
2. Law No. 1 of 2023 on the Criminal Code (KUHP), Articles 79, 258, 259, 407 and 622, official text (JDIH BPK). https://peraturan.bpk.go.id/Details/234935/uu-no-1-tahun-2023 2a. Law No. 1 of 2026 on Criminal Penalty Adjustment (amending KUHP Articles 613 and 622; Lampiran I items 136-137 on the UU TPKS and UU PDP). https://peraturan.bpk.go.id/Details/337869/uu-no-1-tahun-2026
3. Law No. 20 of 2025 on the Criminal Procedure Code (KUHAP), Articles 136 and 235, official text: https://peraturan.bpk.go.id/Details/337302/uu-no-20-tahun-2025 . Indonesia Enacts New Criminal Procedure Code: Key Implications. https://ssek.com/blog/indonesia-enacts-new-criminal-procedure-code-key-implications-for-investigations-and-enforcement/
4. Law No. 27 of 2022 on Personal Data Protection (UU PDP), Articles 17, 56, 57, 67, 68 and 70, official text: https://peraturan.bpk.go.id/Details/229798/uu-no-27-tahun-2022 . Library of Congress Global Legal Monitor. https://www.loc.gov/item/global-legal-monitor/2022-12-18/indonesia-personal-data-protection-act-enters-into-force/
5. Law No. 12 of 2022 on Sexual Violence Crimes (UU TPKS), Art. 14, official text (JDIH BPK). https://peraturan.bpk.go.id/Details/207944/uu-no-12-tahun-2022
6. Mahkamah Konstitusi (Constitutional Court), Decision No. 20/PUU-XIV/2016, on electronic evidence obtained by interception. https://www.mkri.id/public/content/persidangan/putusan/20_PUU-XIV_2016.pdf 6a. Law No. 11 of 2008 (UU ITE), Articles 31, 36, 47 and 51, and Law No. 19 of 2016, elucidation of Articles 5(2) and 31(1), official texts (JDIH BPK). https://peraturan.bpk.go.id/Details/37589/uu-no-11-tahun-2008 and https://peraturan.bpk.go.id/Details/37582/uu-no-19-tahun-2016 6b. Law No. 19 of 2019 on the KPK, with Constitutional Court Decision 70/PUU-XVII/2019 recorded (JDIH BPK). https://peraturan.bpk.go.id/Details/122028/uu-no-19-tahun-2019
7. Supreme Court of Indonesia, Baiq Nuril Maknun case, conviction under UU ITE Article 27(1) in conjunction with Article 45(1); Ministry of Law and Human Rights (AHU), July 8, 2019: https://portal.ahu.go.id/id/detail/75-berita-lainnya/2288-baiq-nuril-ajukan-amnesti-melalui-menteri-hukum-dan-hak-asasi-manusia ; State Secretariat, Presidential Decree No. 24 of 2019 on amnesty: https://www.setneg.go.id/baca/index/baiq_nuril_terima_kasih_bapak_presiden . Analyzed in: The Conversation, "Baiq Nuril's case shows sexism still remains in Indonesia's Supreme Court." https://theconversation.com/baiq-nurils-case-shows-sexism-still-remains-in-indonesias-supreme-court-despite-its-equality-guidelines-120289
8. Baiq Nuril, the ITE Law and #MeToo Indonesian style -- Indonesia at Melbourne. https://indonesiaatmelbourne.unimelb.edu.au/baiq-nuril-the-ite-law-and-metoo-indonesian-style/
9. Hukumonline Klinik, "Bolehkah Merekam Suatu Peristiwa Secara Sembunyi-Sembunyi?" (Can You Record an Event Secretly?). https://www.hukumonline.com/klinik/a/bolehkah-merekam-suatu-peristiwa-secara-sembunyi-sembunyi-lt5496be4d1947b/
10. Hukumonline Klinik, "Bisakah Rekaman Diam-Diam Percakapan Telepon Dijadikan Alat Bukti?" (Can a Secretly Recorded Phone Call Be Used as Evidence?). https://www.hukumonline.com/klinik/a/bisakah-rekaman-diam-diam-percakapan-telepon-dijadikan-alat-bukti-lt59c1ebe5c1c71/
11. Chambers and Partners, Data Protection and Privacy 2026: Indonesia. https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/indonesia/trends-and-developments
12. ICLG, Data Protection Laws and Regulations Report 2025-2026: Indonesia. https://iclg.com/practice-areas/data-protection-laws-and-regulations/indonesia
13. Makarim and Taira S., "Second Amendment to Indonesia's ITE Law: What's Changed." https://www.makarim.com/news/second-amendment-to-indonesia-s-ite-law-what-s-changed
14. SSEK Law Firm, "Indonesia Data Protection and Privacy Laws 2026 Guide." https://ssek.com/blog/data-protection-and-privacy-laws-in-indonesia-2026-guide-by-ssek/
15. Windonesia, "The Wiretapping Loophole: A Hasty Future for Indonesian Law." https://windonesia.com/article/the-wiretapping-loophole-a-hasty-future-for-indonesian-law
16. Universitas Gadjah Mada, "Experts at UGM Flag Risks in KUHAP Revision: Coercive Powers Expand Without Clear Safeguards." https://ugm.ac.id/en/news/experts-at-ugm-flag-risks-in-kuhap-revision-coercive-powers-expand-without-clear-safeguards/
17. Springer Nature / International Journal for the Semiotics of Law, "Addressing Deepfake Pornography and the Right to be Forgotten in Indonesia: Legal Challenges in the Era of AI-Driven Sexual Abuse." https://link.springer.com/article/10.1007/s11196-025-10265-0
18. A&Co Law, "Regulatory Framework for Data Processing and CCTV Installation Post-Enactment of the Indonesian Personal Data Protection Law." https://aco-law.com/articles/regulatory-framework-for-data-processing-and-cctv-installation-post-enactment-of-the-indonesian-personal-data-protection-law/
19. Cornell LII, Penal Code of Indonesia (Gender Justice Resource). https://www.law.cornell.edu/gender-justice/resource/penal_code_of_indonesia
20. ICJ, "Indonesia: Newly Revised ITE Law Threatens Freedom of Expression and Must Be Amended." https://www.icj.org/indonesia-newly-revised-ite-law-threatens-freedom-of-expression-and-must-be-amended/
21. Binus University Business Law, "Penyadapan dan Kedudukannya sebagai Alat Bukti Elektronik." https://business-law.binus.ac.id/2020/05/03/penyadapan-dan-kedudukannya-sebagai-alat-bukti-elektronik/

Related Articles

• World Recording Laws: Country-by-Country Consent Guide
• Indonesia Data Privacy Laws: UU PDP Compliance Guide (2026)
• US State Recording Laws: All 50 States

---

Last updated: September 2026. Statutes cited reflect their in-force versions as of September 2026. KUHP in force January 2, 2026. KUHAP in force January 2, 2026. UU PDP compliance mandatory from October 17, 2024.

Frequently Asked Questions

Is Indonesia a one-party or all-party consent country for recording?

Indonesia's participant recording consent status is legally contested and unsettled as of 2026. Prior to January 2, 2026, Indonesian practitioners and Hukumonline legal analysis generally treated Indonesia as a one-party consent jurisdiction, relying on UU ITE Article 31's "belonging to another person" language to exclude participant recording from the wiretapping prohibition. Since January 2, 2026, KUHP Article 258 has replaced UU ITE Article 31 as the primary wiretapping statute -- and Article 258 drops the "belonging to another person" limitation without substituting an explicit participant exception. Until Indonesian courts clarify whether "unlawfully" in Article 258 covers participant recording, the classification is genuinely unsettled. Third-party interception is clearly prohibited under KUHP Article 258, as it was under UU ITE Article 31.

What are the penalties for illegal recording in Indonesia?

Penalties vary by statute and offense. Under KUHP Article 258, illegal interception, and disseminating its results, each carry up to 10 years imprisonment or a fine of up to IDR 2 billion. Before January 2, 2026, UU ITE Article 47 set interception penalties at 10 years and IDR 800 million, rising to 12 years and IDR 12 billion when loss resulted; those articles have been repealed. The UU TPKS adds up to 4 years and IDR 200 million for non-consensual sexual recording. The UU PDP adds up to 5 years and a fine of up to IDR 200 million for unlawfully collecting another person's personal data, with corporate fines up to 10 times the maximum. These charges can be brought simultaneously.

Can I record my own phone calls in Indonesia?

This is a contested legal question under current Indonesian law. Under UU ITE Article 31 (the framework that applied before January 2, 2026), Indonesian practitioners generally concluded that participant recording was lawful because the prohibition was limited to interception of communications belonging to "another person." Since January 2, 2026, KUHP Article 258 applies -- and it prohibits "unlawfully" recording transmissions of non-public electronic information without the "belonging to another person" limitation. The explanatory notes to Article 258 do not list participant recording as a permitted exception. No Indonesian court has resolved whether participant recording violates Article 258. Until that question is settled, recording your own phone calls carries material legal risk. Additionally, even if recording is held lawful, the UU PDP governs what you may do with the recording afterward.

What does the Baiq Nuril case establish about recording laws in Indonesia?

The Baiq Nuril case is frequently cited but widely misunderstood. Nuril was a teacher who recorded her school principal's sexually explicit phone calls to document harassment. The Supreme Court convicted her under UU ITE Article 27(1) for distributing content violating decency -- not under Article 31 for the act of recording. The recording itself was not the basis of her conviction; distribution of the recording (which her supporters said a colleague, not Nuril, carried out) was. The case does not establish that participant recording is a crime. What it does establish is that recordings made by participants can be weaponized against them under other provisions, particularly Article 27(1), even when the recording was made for self-protection. After the Supreme Court rejected her request for case review, President Joko Widodo granted Nuril amnesty by Presidential Decree No. 24 of 2019, signed on July 29, 2019, after sustained public outcry. Article 27(1) was repealed on January 2, 2026; references to it now point to KUHP Article 407.

Can employers record employees in the workplace in Indonesia?

Employers may monitor workplace communications and operate CCTV, but only with a lawful basis under the UU PDP, specific written notice to employees, and monitoring proportionate to its stated purpose. Cameras are prohibited in restrooms, changing rooms, and prayer rooms. Continuous screen recording or keystroke logging requires strong justification and, in the most intrusive cases, explicit written consent. Secret recording of employees violates both the KUHP and UU PDP, exposing employers to criminal and civil liability. Corporate fines under the UU PDP can reach 10 times the individual maximum.

Can a recorded conversation be used as evidence in Indonesian courts?

Under the new Criminal Procedure Code (Law No. 20/2025, Article 235), electronic evidence is admissible if its authenticity can be proved and it was not obtained unlawfully; the judge decides both questions, and evidence that fails either test cannot be used. Constitutional Court Decision 20/PUU-XIV/2016, written into the elucidation of UU ITE Article 5(2) by Law No. 19/2016, requires that interception results, or recordings that are part of an interception, be obtained in law enforcement at the request of the police, prosecutors, or another authorized agency. Whether a participant's own recording falls within that rule, and whether it was lawfully made under KUHP Article 258, has not been settled. Outcomes vary by case and court.

Can I film police officers in Indonesia?

Indonesian law does not contain an explicit prohibition on filming police officers performing public duties in public spaces. KUHP Article 258, which replaced UU ITE Article 31, targets non-public electronic transmissions and does not apply to observing and recording public conduct. However, publishing footage identifying individual officers or bystanders triggers UU PDP obligations, requiring a lawful basis such as public interest or journalism. Individuals should also be aware that Indonesia's new KUHAP (Law No. 20/2025) expands police authority in ways that civil society has flagged, making the legal environment around police interactions uncertain.

What does Indonesia's Sexual Violence Crimes Law say about recording?

UU TPKS Article 14 (Law No. 12/2022) punishes recording or capturing images or screenshots with sexual content without the consent of the person recorded, sending sexual content to a recipient against their will, and electronic stalking for sexual purposes. Penalties reach up to 4 years imprisonment and IDR 200 million in fines, or 6 years where the act is used to extort, threaten, coerce, or deceive. This applies even if the recorder was a participant in the encounter: a participant who records sexual activity without their partner's consent can be prosecuted under Article 14. It is generally a complaint-based offense, except where the victim is a child or a person with a disability. Sharing intimate images can attract overlapping liability under the KUHP, the UU PDP, and the Pornography Law.

How does Indonesia handle deepfake or AI-generated intimate content?

We have not identified Indonesian legislation aimed specifically at deepfake content. Prosecutors have applied UU ITE Article 27(1) (violating decency; repealed on January 2, 2026, with references now pointing to KUHP Article 407), UU TPKS Article 14 (non-consensual sexual content), and the Pornography Law on a case-by-case basis. Cases involving AI-generated intimate images emerged at Indonesian universities in 2025. Legal scholars have confirmed that Indonesia's current framework was not designed for AI-generated content and significant enforcement challenges remain, including technical detection, perpetrator anonymity, and cross-border jurisdiction. The absence of an AI-specific law does not create a safe harbor; it creates legal unpredictability.

Which Indonesian agencies can legally wiretap, and what oversight applies?

The Corruption Eradication Commission (KPK) can wiretap for corruption investigations; since Constitutional Court Decision 70/PUU-XVII/2019 struck down the prior-permission requirement, completed wiretaps are accounted for to KPK leadership and notified to the Supervisory Board (Dewan Pengawas) within 14 working days. The National Police (Polri) can wiretap criminal investigations under KUHAP Article 136(1) (Law No. 20/2025), but the implementing regulation required by Article 136(2) does not yet exist, creating an oversight gap that civil society has flagged. The Attorney General's Office has wiretapping authority for law enforcement purposes. Private citizens and businesses have no legal authority to wiretap under any circumstances.

Does the UU PDP apply to recordings even if the recording itself was legal?

Yes. Even if a participant recording of your own conversation is ultimately held lawful under KUHP Article 258, the subsequent storage, sharing, or publication of that recording is separately governed by the UU PDP (Law No. 27/2022). Any recording that captures identifiable individuals is personal data under the UU PDP. Processing that data requires one of six lawful bases: consent, contract performance, legal obligation, vital interests, public interest, or legitimate interest. If you share a recording without a lawful basis, you risk UU PDP criminal penalties of up to 4 years imprisonment and a fine of up to IDR 200 million for unlawfully disclosing personal data that is not your own.