Protecting your personal data when applying for jobs: what to share, when, and with whom
Applying for a job means handing a lot of information about yourself to people you have never met. Most recruiters use that data properly. But application files are also a target for fraudsters, because they contain your name, date of birth, address and sometimes a photo of your KTP (national ID card). That is enough to open a loan account in someone else's name.
Resmi.ID Team · 5 min read ·
Photo: Kelly Sikkema / Unsplash
The good news is you don't need to be paranoid. Just share data in stages: a little at the start, more once things are certain, and your most sensitive documents only with an employer whose identity is clear.
What is reasonable to share at each stage
Use the three stages below as a guide. If someone asks for data from a later stage without a reason, treat it as a cue to ask questions first.
- 1ApplyingA CV with your name, city, email, phone number, education, experience and skills.
- 2Selection and interviewsCopies of diplomas, transcripts, certificates or a portfolio if requested to assess your qualifications.
- 3After a written offerKTP, family card (KK), tax number (NPWP), salary account and BPJS details for HR administration.
Your CV does not need your NIK (national ID number), family card number, full street address down to the RT/RW, mother's maiden name, marital status or a photo of your KTP. Just write your city, for example "Bekasi, West Java". Guard your mother's maiden name carefully, as banks often use it as a security question.
Documents like your KTP and bank details are genuinely needed, but for payroll, BPJS registration and tax. All of that only becomes relevant after you accept an offer from a company whose identity you have checked.
Watermark copies of your documents
If you must send a photo or scan of your KTP, add text over it, for example "Only for application to PT Maju Jaya, 1 November 2026". Place it diagonally across the photo and part of the numbers, but not so heavily that the data becomes unreadable.
A watermark makes the copy harder to reuse for other purposes, such as signing up for an online loan. If the copy ever circulates, you will also know where the leak came from. Many phone photo-editing apps can add text like this in a minute.
Scams to watch for
- 1"Applicant data verification"You are asked to fill in a form with your NIK, mother's maiden name and bank account before any interview has taken place.
- 2OTP requestsA scammer posing as HR asks you to forward a code that just arrived by SMS or WhatsApp, when the code is actually for taking over your account.
- 3Selfie with KTPRequested "for verification", although such photos are often used to register online loan accounts in your name.
- 4Unfamiliar links or filesA link to a site that mimics a company portal, or an app file (such as an .apk) sent by chat as a "test invitation".
- 5Bank details for "transport money"Used as a way in to request a transfer back or a bank code.
Sending documents safely
Send documents only through official channels: the company's careers portal, a trusted job platform, or email from the company's own domain. Avoid forms behind short links sent by strangers, especially ones asking for sensitive data before any interview.
- Check the website address and the sender's email. Recruitment emails from free email services are worth double-checking.
- Save documents as clearly named PDFs, and never upload your KTP to a shared folder that anyone with the link can open.
- Note who you sent each document to and when. This simple record helps a lot if misuse happens later.
- If in doubt, ask: "What is this data for, and how will it be stored?" A legitimate recruiter can usually answer.
On Resmi.ID Karir, your contact details are hidden from companies until you pass the CV screening, and applicants are never charged. If a vacancy asks for data or money in a suspicious way, use the Report vacancy button so our team can review it.
Your rights under the Personal Data Protection Law
Law No. 27 of 2022 on Personal Data Protection (UU PDP) has been in force since 17 October 2022, with a two-year adjustment period for data controllers. A company collecting applicant data is a data controller and must respect your rights as a data subject.
- To be told who is requesting the data, the legal basis and the purpose of its use.
- To access and obtain a copy of your data, and to correct inaccurate data.
- To ask for processing to stop and the data to be deleted, and to withdraw consent you previously gave.
- To sue and receive compensation for violations in the processing of personal data.
You exercise these rights through a written request to the data controller, electronically or otherwise. For example, once recruitment is over and you were not hired, you may ask the company to delete its copy of your KTP. Some technical provisions are set out in further government regulations, so follow developments through official sources.
If your data has already been misused
- 1Secure your accountsChange passwords, turn on two-step verification and sign out unknown devices.
- 2Contact your bank or e-walletAsk for a block if there are transactions you did not make.
- 3Report to OJK's IASCThe Indonesia Anti-Scam Centre helps handle funds of financial fraud victims.
- 4File a police reportIASC does not replace a police report, which is still needed for legal action.
- 5Gather evidenceKeep chat screenshots, links, sender numbers and your record of documents sent.
References
- BPK — UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi
- Wikisumber — Teks UU No. 27 Tahun 2022
- OJK — Indonesia Anti-Scam Centre (IASC)
This information is general. For important decisions, check the latest rules at official sources or consult the relevant authorities.
