What Indonesia’s PDP Law Means for Voice AI in Financial Services

Indonesia’s Personal Data Protection Law, Law No. 27 of 2022, applies to every call an AI voice agent makes or takes for a bank, multifinance company or fintech. Call recordings, transcripts, account details and any voiceprints are personal data, and financial and biometric data are specific personal data. Lenders need a lawful basis for each call, clear notice of recording, secure storage, defined retention, and a plan to report breaches within 72 hours.

The law’s two-year transition ended in October 2024, so its duties apply now. The agency that issues administrative fines is still being established, and the implementing regulation (Government Regulation No. 33 of 2026) takes effect on 16 January 2027.

This article summarises published regulation and commentary. It is not legal advice. Confirm current requirements with your legal and compliance teams.

What Counts as Personal Data on a Call

The recording itself. A voice recording identifies a person.

The transcript. Names, account numbers, balances and payment promises are all personal data.

Financial data. Loan amounts, balances and payment history are specific personal data under the law, according to CMS.

Biometric data. If you use voiceprints to recognise customers, those are specific personal data too.

What the PDP Law Requires, in Practice

A lawful basis for each purpose. Reminders, collections, verification and marketing are different purposes. Each needs its own basis.

Notice. Tell the customer at the start of the call that it is recorded and why.

Rights. Customers can ask what data you hold, correct it, restrict its processing and withdraw consent. Several of these requests carry a 3 x 24 hour response clock.

Breach notification. Article 46 requires written notice to affected individuals and the authority within 3 x 24 hours of a data protection failure.

Sanctions. Administrative fines can reach 2% of annual revenue once the agency and the implementing regulation are in force, and criminal penalties for unlawful collection, use or disclosure of personal data already apply.

Impact assessment. Article 34 requires a data protection impact assessment for high-risk processing, including processing of specific personal data such as financial and biometric data. Voice AI that records calls and handles account details should expect to complete one before go-live.

Setting Up a PDP-Ready Voice AI Deployment

Step 1. Map the data. List what each call collects, where it is stored and who can access it.

Step 2. Write the call opening. Name the company, state the purpose and mention recording in the first few seconds.

Step 3. Set retention periods. Keep recordings as long as your policy and OJK requirements need, then delete them.

Step 4. Restrict access. Only the people who review calls should hear recordings.

Step 5. Check your vendor. The voice AI provider processes personal data on your behalf. Ask where data is stored, who can access it and how breaches are reported to you.

Step 6. Check calls automatically. Automated Quality Assurance flags calls where the notice was skipped or data was shared before verification.

Questions to Ask a Voice AI Vendor

Where is call data stored, and can it stay in-region?

Which security standards is the platform built to meet?

How quickly will you tell us about a breach? You have 72 hours, so your vendor should tell you much faster.

Can we set and enforce retention periods?

Can we export or delete a customer’s data on request?

What a Good Call Opening Sounds Like

AI voice agent: Selamat pagi, saya asisten virtual dari bank Anda. Panggilan ini direkam untuk keperluan layanan dan kepatuhan. Saya menghubungi terkait tagihan kartu kredit Anda. Apakah saya berbicara dengan Bapak Rudi?

How Local Rules Compare With US and EU Guidance

Buyers often ask how local rules compare with US and EU guidance. These references help.

GDPR Article 22. In the EU, people have the right not to be subject to decisions based solely on automated processing that significantly affect them. It is a useful benchmark for when a person should review an AI outcome.

NIST AI Risk Management Framework. NIST’s AI RMF 1.0, published in January 2023, organises AI risk work into four functions: govern, map, measure and manage. It stresses human oversight, documentation and ongoing monitoring.

Common Failure Points

One consent for everything. A reminder and a cross-sell are different purposes.

No retention limit. Recordings kept indefinitely increase breach risk.

Vendors with no breach process. Your 72 hours start when you become aware, so the vendor’s timeline matters.

Voiceprints without a separate basis. Biometric data needs extra care.

Practical Considerations

AI Rudder has an office in Indonesia and is built to meet SOC 2 and ISO 27001, alongside GDPR and PDPA requirements and relevant IMDA and CSA standards. Its AI Contact Center includes Quality Assurance that checks calls against your SOPs. AI Rudder is named in Tech in Asia’s Singapore’s Top Fintech Companies 2027 list, in the Enterprise Fintech category.

Frequently Asked Questions

Does Indonesia’s PDP Law apply to call recordings?
Yes. Recordings and transcripts are personal data, and financial details on the call are specific personal data.

When did the PDP Law take full effect?
The two-year transition ended in October 2024.

How fast must a data breach be reported?
Within 72 hours, to affected individuals and the authority.

Can a bank use voice biometrics under the PDP Law?
Biometric data is specific personal data, so it needs a clear basis, strong security and careful handling.

Next Step

Write down where your call recordings live today. Get a Demo and we’ll show you how an AI voice agent handles notice, recording and retention.