Indonesia's PDP Law and Customer Chat Data: A Practical Guide for Customer Service Teams

Indonesia's PDP Law and customer chat data are often seen as a matter for the legal team, yet day to day it is customer service teams who handle the most personal data. Every conversation contains names, phone numbers, delivery addresses and sometimes photos of ID cards or transfer receipts. Law No. 27 of 2022 on Personal Data Protection provided an adjustment period of up to two years from its enactment, so its obligations have applied in full since October 2024. For chat teams, the practical principles are simple: ask only for what you need, explain why, never request sensitive data such as PINs or OTP codes, limit who can see conversations and prepare procedures for when customers ask to delete their data or when a breach happens.

Important note: this article is a practical guide for operations teams, not legal advice. For official company policies or specific cases, consult a legal expert.

What personal data is in your chats?

Many teams do not realise how much personal data flows through chat every day:

• Basic identity: name, phone number, email.

• Addresses: delivery addresses or home addresses for services.

• Documents: photos of ID cards, tax numbers or other verification documents.

• Transaction data: order history, transfer receipts, bank account numbers.

• Health data: for clinics, patient complaints or treatment history.

• Photos and voice recordings: photos of damaged products showing faces or homes, customer voice notes.

Some of this data falls into more sensitive categories, such as health and financial data, and needs stricter protection.

Basic principles relevant to chat teams

Various summaries of the PDP Law describe a range of duties for parties that control personal data. For customer service teams, the most relevant principles can be summarised as follows:

Penalties for violations include administrative sanctions such as written warnings, temporary suspension of processing, data deletion and fines, as well as criminal penalties for certain violations. Check the details directly in the law and its implementing regulations.

Data you should never request in chat

Some types of data are almost never needed to serve customers in chat, and requesting them opens up serious risk:

• PINs and passwords for any account.

• OTP or verification codes.

• Full card numbers with the security code on the back.

• Irrelevant biometric data.

• ID card photos, unless truly required for a specific process with a clear basis.

Make this rule part of agent training and your welcome message. A simple line such as "Our team will never ask for your PIN, password or OTP code" also protects customers from scammers impersonating your business.

Limiting team access

Many data leaks in small businesses come not from sophisticated attacks but from loose access. A few practices that help:

One account per agent. Avoid sharing one account. With an account per agent, you know who accessed which conversation and can revoke access when someone leaves.

Need-based access. New hires, part-timers or partners only need to see chats assigned to them, not the full customer history.

No customer data on personal phones. Chats handled on an agent's phone leave with them or are lost with the phone.

Two-factor authentication. Turn it on for every account with access to customer data.

Regular access reviews. Remove access for people you no longer work with.

In ChatMo, every agent signs in with their own account, and the account owner can limit certain agents to chats assigned to them or their team. Conversation history is stored in the shared inbox, not on each agent's personal phone.

Handling customer requests about their data

Customers may ask to see the data you hold about them, correct wrong data or delete it. Prepare a simple procedure:

1. Record the request with the date and channel.

2. Verify the customer's identity reasonably, for example by matching the phone number and order history, without asking for excessive sensitive data.

3. Forward it to the data owner in your company.

4. Follow up according to the rules and company policy, keeping in mind other retention duties, such as transaction records for tax purposes.

5. Tell the customer the outcome.

Chat agents do not need to decide on their own, but they need to know where to forward the request and what to tell the customer.

Automatic messages and AI agents

AI agents and automatic messages also process customer data. Make sure the AI does not ask for unnecessary data, does not repeat sensitive data in its replies and hands the conversation to a human agent for personal data matters, such as deletion requests or identity changes. Be honest that the customer is talking to an automated assistant if they ask.

Preparing for a data breach

No system is fully immune. What separates prepared businesses from unprepared ones is procedure. Several summaries of the PDP Law cite a duty to report a personal data protection failure within 3x24 hours to the data subjects and the relevant authority. Prepare basic steps:

1. Stop the source of the breach, for example by revoking a misused account's access.

2. Assess the impact: what data leaked and how many customers are affected.

3. Involve the responsible person and a legal expert.

4. Notify the relevant parties as required.

5. Fix the cause so it does not happen again.

Privacy policy and communication with customers

Publish a privacy policy on your website explaining what data you collect through chat, what it is used for and how customers can contact you about their data. On your pre-chat form, add a short line about how the data will be used. A guide to short, clear forms is in live chat pre-chat forms.

Team training: the most often skipped part

A good privacy policy means nothing if agents do not understand it. Many data incidents come from everyday habits: sending screenshots of customer chats to an internal group to ask a question, keeping ID photos in a phone gallery or sharing customer details with colleagues through personal apps. Set aside time for short training whenever a new agent joins, and repeat it regularly for the whole team.

The training does not need to be complicated. Explain what counts as personal data, which data must never be requested, how to share customer information safely inside the system with internal notes, where to report anything suspicious and what to say when a customer asks to delete their data. Real examples from daily work are far easier to remember than legal articles.

Storing and deleting data wisely

Keeping data forever is not a safe choice. The more old data you hold, the bigger the impact of a breach. Decide how long each type of data needs to be kept, considering business needs and other legal duties such as transaction records for tax purposes. Document photos needed only for a one-time verification, for example, should not be kept longer than necessary.

Also make a habit of reviewing attachments in conversations. ID photos, transfer receipts or medical documents sent by customers should be moved to the appropriate system if they truly need to be kept, rather than left scattered in many places.

Example: a beauty clinic

A beauty clinic with three branches served patients through WhatsApp and website live chat. Agents used personal phones, and patients often sent face photos and treatment history. When one agent left, the patients' chat history left with her on her phone.

The clinic moved every conversation to a shared inbox with an account per agent, limited each branch's agents to their own branch's patients and added a line to the welcome message stating that the clinic never asks for OTP codes or card details. They also wrote a short procedure for data deletion requests and named one manager as the responsible person. The risk of leaks from personal phones disappeared, and patients felt safer consulting the clinic.

Choosing a chat platform that supports data protection

When choosing a platform to manage customer conversations, look for features that support data protection: per-user logins with configurable roles, conversation access restrictions, two-factor authentication and activity history. Also ask how the provider stores and protects data, and how data can be exported or deleted when needed. The right platform does not make a business compliant automatically, but it makes it easier for the team to follow good practice every day without relying on each agent's memory.

Common mistakes

1. Sharing one account across agents. There is no record of who accessed data.

2. Keeping customer chats on personal phones. Data is lost or leaves with the agent.

3. Asking for unnecessary data. It adds risk with no benefit.

4. Asking for OTP codes or PINs. It breaks basic security practice and damages trust.

5. No breach procedure. Panic and slow responses when an incident happens.

Summary

• The PDP Law's obligations have applied in full since October 2024, and chat data is personal data.

• Ask only for what you need, explain why and never request PINs, passwords or OTPs.

• Use an account per agent, limit access and keep data in a system, not on personal phones.

• Prepare procedures for customer requests and data breaches.

• Confirm official policies with a legal expert.