On 21 September 2026, the DJP released comprehensive guidelines on employee tax data governance under the Coretax ecosystem, operationalizing the data protection principles in PMK-55/2026 and the Personal Data Protection Law (UU PDP). The framework establishes role-based access control (RBAC), audit logging, and encryption standards for employers handling Article 21/26 withholding data. Non-compliance attracts administrative sanctions under Article 18 of UU PDP.
Key Takeaways
- Mandatory Data Protection Officer: Companies with over 100 employees must appoint a certified Data Protection Officer (DPO) responsible for tax data processing activities.
- Granular Consent Management: Employees must provide explicit, revocable consent for each tax data processing purpose, recorded in the Coretax employer portal.
- Cross-Border Transfer Restrictions: Transmission of employee tax data to foreign affiliates requires prior DJP adequacy assessment or standard contractual clauses approved by the Ministry of Finance.
Disclaimer: This article is compiled and summarized by the AI based on publicly available information and is for general information purposes only. It does not constitute any form of formal tax advice, legal opinion, or basis for performance. Please consult a qualified professional tax advisor or legal counsel for tax advice.
Source: Read Official Announcement