The roles of the parties
The PDP Law distinguishes the personal data controller, the party that decides the purposes and means of processing, from the personal data processor, the party that processes data on the controller's behalf. In an executive search, the firm is usually the controller of the candidate data it collects itself, while the client company can be the controller of the data it receives and uses for hiring decisions.
This division of roles matters because it decides who must meet particular obligations and to whom a candidate can address their rights. The roles and responsibilities should be set out in a written agreement between the firm and the client.
The basis for processing: clear consent
One of the bases for processing most often used in recruitment is the valid consent of the data subject. Good consent is clear, specific and given with knowledge of what the data will be used for. Candidates need to know what data is collected, for what purpose, who will see it, and how long it is kept.
Sending a CV to an email address does not automatically mean the candidate understands every use of that data. A notice written in plain language, in a place that is easy to find, helps make sure the consent is meaningful.
Candidates' rights
The PDP Law gives data subjects a number of rights, among them to request information about the processing, to access and obtain a copy of their data, to correct inaccurate data, to request deletion, to withdraw consent, and to object to decisions taken solely through automated processing. Firms and companies need a clear way to receive and respond to such requests within a reasonable time.
More sensitive data
The PDP Law distinguishes general personal data from specific personal data, such as health data, personal financial data and criminal records. Specific data receives stricter protection. In search practice, this relates to background checks. Collect only what is relevant to the role, on a clear basis, and do not keep it longer than necessary.
Using tools and providers abroad
Many firms now use software, including artificial intelligence, to read CVs or draft summaries. When candidate data is processed by a service provider outside Indonesia, there are provisions on transferring personal data outside Indonesian jurisdiction that must be met. In addition, candidates have the right to be told when part of the process is assisted by an automated system, and important decisions should not be left entirely to a system.
Storing and deleting
- Set a reasonable retention period and tell candidates. Data must not be kept forever without a reason.
- Delete or anonymise candidate data that is no longer needed, and take deletion requests seriously.
- Limit who can see the data. Not everyone in the firm or in the company needs to see every candidate.
- Secure the data with access controls, reasonable encryption and a record of who accessed what.
When a breach occurs
The PDP Law requires data subjects and the competent authority to be notified when personal data protection fails, within a set time limit. Prepare a procedure before an incident: who is contacted, who decides, and how the notice is drafted. Preparing it in the middle of a crisis is almost always too late.
The trust of senior candidates is a search firm's main asset. It is lost far faster than it is built.
A practical checklist for companies
- Are candidates told clearly about the data collected, the purpose, the recipients and the retention period?
- Is there a written agreement dividing roles and responsibilities between the company and the search firm?
- Is there an easy way for candidates to request a copy, a correction or deletion of their data?
- Is specific data collected only when it is relevant and on a clear basis?
- Have service providers, especially those abroad, been assessed and bound by suitable terms?
- Is there a procedure for a breach, and who is responsible for it?
What a good privacy notice looks like
A privacy notice for candidates should be readable in a few minutes, in everyday language, and answer the questions people actually ask: what is collected, for what, who sees it, how long it is kept, and how to withdraw consent or request deletion. Avoid legal wording so heavy that it cannot be understood, and avoid long lists that hide what matters.
- Place it where it can be seen before the candidate submits data, not at the bottom of a page that is rarely opened.
- State the identity of the data controller and how to contact it.
- Explain when part of the process is assisted by an automated system, and that the final assessment is made by a person.
- Say that consent can be withdrawn, and what that means for a process already under way.
Handling requests from candidates
One day a candidate will send an email asking for a copy of their data or asking for it to be deleted. If that happens for the first time and nobody knows who should answer, the risk is not only a breach of obligation but also a loss of trust. Decide beforehand on one monitored address, one person in charge and an internal deadline for responding. Record every request and what was done about it.
The relationship with the client
When the firm hands a candidate report to the client, the data changes hands. Make sure the candidate knows their data will be shared with the client at a certain stage, and that the client is bound to use it only for that hiring purpose. Once the process is over, decide what happens to the copies of the data held by the client: deleted, or kept with a clear time limit and reason.
A note for practice
Ask your search firm to show you the privacy notice they give candidates and the retention period they use. If the answer is vague, that is a sign homework needs to be done. Once more: this article is a general overview, not legal advice. For a specific decision, consult your legal adviser.
