Personal Data Protection Law Compliance Readiness Among Industrial Firms Handling Employee and Customer Records

Defi Irwansyah (Universitas Malikussaleh)
Zalfie Ardian (Universitas Malikussaleh)

Journal of Industrial Engineering and Management
Vol 4, No 1 (2026)

Indonesia's Personal Data Protection Law of 2022 gave data controllers two years to adjust, a period commonly cited as ending on 17 October 2024. Industrial firms are controllers of large personnel files and, in many cases, of customer and distributor records, yet their readiness is rarely measured at the level of daily handling. This study assesses compliance readiness in 36 industrial firms across six sectors using an 18-item checklist in six domains, where each item is scored 0 when absent, 1 when written only, and 2 when written and practiced. The firm scores are simulated for this study and are not the result of supervisory inspection. Readiness was low: the mean firm reached 11.6 of 36 possible points, and 58.8% of the 648 item scores were zero. Fifteen firms (41.7%) were mostly absent, twenty (55.6%) were mostly at the written-only stage, and only one firm was mostly practiced. The data inventory domain was weakest, with 63.9% of item scores absent, and 16 of the 24 firms that hold customer records had no list of those records. Governance had the lowest conversion from written to practiced controls (47.9%), and only 8.3% of firms practiced an approved data protection policy. Firms holding customer records were not more ready than firms holding employee records only (median 0.58 against 0.72, exact p = 0.28). Retention readiness moved closely with inventory readiness (Spearman 0.74) while security safeguards did not, which makes the record inventory the natural first step