Hiring Indonesian remote workers: the legal guide (2026)

Foreign companies hiring Indonesian remote workers usually pick one of three legal models. Each carries different compliance work, cost, and risk.

Model 1: Direct employee. The foreign company establishes a local Indonesian entity (PT PMA or local PT) and hires the worker under a PKWT (fixed-term) or PKWTT (indefinite-term) contract. The local entity becomes the employer of record: it runs payroll, withholds PPh 21, registers the worker with BPJS Kesehatan and BPJS Ketenagakerjaan, pays THR, and bears severance liability under UU Cipta Kerja. This is the most compliant model for long-term full-time operators and large teams, but it requires entity setup, a payroll operator, and ongoing local compliance work.

Model 2: Independent contractor. The worker is engaged as a freelance contractor with no BPJS, no PPh 21 withholding by the client, no THR, and no severance. The client issues invoices, the contractor self-reports PPh via annual SPT, and the relationship is governed by a freelance or services agreement. This model is appropriate only for project-based, short-duration, low-integration work — the kind that passes Indonesia's seven-factor contractor test.

Model 3: EOR / PEO via a local entity. The foreign client uses an Employer of Record (EOR) or Professional Employer Organization (PEO) — a local Indonesian entity that becomes the legal employer on paper while the worker reports to the foreign client. The EOR handles PKWT drafting, BPJS enrollment, PPh 21 withholding, THR, payroll in IDR, and statutory filings. Zipang operates this model for global clients running 3–4M annotation tasks/month, 4,000+ KOL programs, and 200+ seat BPO operations — the EOR absorbs the compliance load so the client focuses on KPIs.

UU Cipta Kerja (Undang-Undang Nomor 11 Tahun 2020 tentang Cipta Kerja, commonly called the Omnibus Law) is the most significant rewrite of Indonesian labor and tax law in two decades. For remote hiring, four changes matter.

First, flexible work arrangements. The law formally recognized work-from-home, freelance, and gig arrangements as legitimate employment categories. Companies can register workers under flexible contracts and adjust working hours, location, and payment terms with less friction than pre-2020 rules allowed.

Second, fixed-term (PKWT) flexibility. PKWT can now be used for work that is not strictly time-bound, including outsourced BPO operations and remote project work. Maximum PKWT duration remains 5 years (including extensions) under PP 35/2021; after that, the worker should be converted to PKWTT.

Third, severance reform. Severance calculation was revised: 1x monthly salary for <1 year tenure, 2x for 1–2 years, scaling to 9x for 8+ years under Article 156. Long-service benefits (uang jasa) and separation pay (uang pesangon) are computed on top. Foreign clients using PKWT should budget severance accrual as part of fully-loaded cost.

Fourth, outsourcing rules. UU Cipta Kerja clarified that outsourced work must be peripheral (security, cleaning, catering, support services) — not core business processes. Foreign clients using Indonesian BPOs to handle core support, annotation, or VA work should structure the relationship carefully; many global BPO contracts are structured as direct employment with the BPO, not outsourcing of the client's core process.

PKWT (Perjanjian Kerja Waktu Tertentu) is a fixed-term employment contract. Under PP 35/2021 it is allowed for temporary work, project-based work, seasonal work, or work that is expected to complete within a defined period. Maximum PKWT duration is 5 years including extensions; daily PKWT (pekerja harian) is allowed for very short casual work. PKWT must be in writing, in Indonesian, and registered with KEMNAKER (Ministry of Manpower) through the online TKA Online / reporting system.

PKWTT (Perjanjian Kerja Waktu Tidak Tertentu) is an indefinite-term contract — the Indonesian equivalent of permanent employment. It provides the strongest termination protection, full severance entitlements, and is required when work is permanent in nature. A worker who has been continuously employed for 5 years under successive PKWT contracts is generally deemed PKWTT regardless of paper contract — a key misclassification risk for foreign clients renewing PKWT every 6 or 12 months.

When to use which: PKWT fits project-based remote work, 6–12 month BPO cohorts, ramp-and-stabilize programs, and roles with clear end dates. PKWTT is appropriate for full-time long-tenure operators, key personnel, and roles embedded in the client's operations indefinitely. The financial difference is severance accrual: PKWT may be terminated at expiry without severance (subject to Article 162 rules), while PKWTT termination requires statutory severance under Article 156.

For foreign clients, the practical rule is: use PKWT for any role with a defined endpoint, and plan conversion to PKWTT for stable headcount past 2 years of tenure. Documented performance and KPI history is required to support either path.

Indonesian labor authorities apply a multi-factor test to determine whether a worker is a true independent contractor (freelance) or a de facto employee. Misclassification is a recurring audit trigger and creates exposure for back-due BPJS, PPh 21, THR, and severance.

The seven factors most commonly applied: (1) control — does the client direct how, when, and where the work is performed, or does the contractor set the method? (2) integration — is the worker integrated into the client's core operations, or is the service a peripheral deliverable? (3) tools and equipment — does the client provide laptop, software, and workspace, or does the contractor supply their own? (4) hours — does the client set fixed working hours and shifts, or does the contractor deliver against milestones? (5) exclusivity — can the contractor serve multiple clients, or is the worker dedicated to one? (6) payment — fixed monthly salary with deductions, or invoice-based project fees? (7) business risk — does the contractor bear profit/loss risk on the engagement, or is compensation independent of business outcome?

If five or more factors point toward employment, the relationship is likely an employment relationship in substance — and the client should structure it as PKWT/PKWTT with full statutory obligations. Foreign clients that treat a full-time remote operator as a 1099-equivalent contractor (monthly fixed pay, dedicated hours, company laptop, integrated into team, exclusive engagement) are exposed regardless of how the contract is titled.

Penalty exposure for misclassification includes: back-due BPJS contributions (employer + employee share), back-due PPh 21 plus penalties, unpaid THR, severance claims, and personal-data audit findings under UU PDP if worker data was processed without proper basis. Engaging local counsel before signing 10+ concurrent contractor relationships is standard practice.

BPJS Kesehatan is Indonesia's national health insurance program, mandatory for any employee working more than 10 working days per month, or earning more than the minimum wage in any given month. Both the employer and the employee must register; coverage extends to spouses and up to three children.

Contribution rate: 4% employer + 1% employee of monthly base salary, capped at the upper bound of the salary tier used (the cap is revised periodically — verify with the latest BPJS Kesehatan regulation). Effective employer cost is roughly 4% of base salary. Self-employed and contractor workers can register voluntarily under the PBPU (Pekerja Bukan Penerima Upah) scheme, paying the full 5% themselves.

For foreign remote clients, BPJS Kesehatan is typically handled by the local employer entity (PT PMA, local PT, or EOR). The worker presents a BPJS card at any faskes (fasilitas kesehatan, healthcare facility) for outpatient and inpatient care. Coverage includes primary care, specialist referrals, hospitalization, and major surgery up to the program's ceiling.

Practical note: non-resident contractors who do not meet the 10-day/month threshold are not required to enroll. Resident contractors working full-time should be enrolled through the EOR/PEO; the cost (4% employer + 1% employee) is small relative to total fully-loaded cost and removes a major compliance risk.

BPJS Ketenagakerjaan covers four employment-related social security programs. Together the employer's share is approximately 9.24%–10% of monthly base salary, depending on the program combination and risk tier of the work.

JHT (Jaminan Hari Tua) — old-age savings. Employer contributes 3.7%, employee 2% of base salary. Vesting period is 10 years; partial withdrawal allowed for housing down-payment, marriage, or after 10 years of contribution.

JP (Jaminan Pensiun) — pension. Employer contributes 2%, employee 1% of base salary. Pension benefit starts at age 59 (with at least 15 years of contribution) with a defined benefit formula.

JKK (Jaminan Kecelakaan Kerja) — work accident insurance. Employer pays 0.24%–1.74% of base salary, depending on the risk tier of the role. Coverage includes medical care, rehabilitation, and disability/death benefits from work-related accidents.

JKM (Jaminan Kematian) — death insurance. Employer pays 0.3% of base salary. Provides a lump-sum death benefit, ongoing scholarship for children, and burial allowance.

For foreign clients, the four programs are usually bundled: the EOR or local entity registers the worker, deducts the employee share, contributes the employer share, and remits monthly via the BPJSTK online system. Failure to enroll exposes the employer to benefit claims and administrative penalties under UU Cipta Kerja.

THR is a mandatory annual payment tied to religious holidays (Idul Fitri for Muslim workers, other holidays for non-Muslim workers per Permenaker rules). It is a statutory entitlement under UU Cipta Kerja and government regulations — not a discretionary bonus.

THR amount: 1 month of base salary for workers with 12+ months of continuous tenure. For workers with less than 12 months of tenure, THR is prorated: (months worked / 12) × 1 month of base salary.

Payment timing: THR must be paid no later than 7 working days before the religious holiday. Late payment triggers administrative penalties under Permenaker 6/2016 as amended.

Foreign clients who engage Indonesian remote workers on PKWT should budget THR as a 1-month annualized cost (8.33% of base salary per year). Contractors under a freelance agreement are not entitled to THR. EOR structures handle THR automatically through payroll; direct-hire clients must compute and disburse themselves.

Practical rule: if you commit to remote workers for a full year, assume THR is part of fully-loaded cost. Skip it and you create employee relations, reputational, and statutory exposure.

PPh 21 is Indonesia's individual income tax on employment and service income. Employers withhold PPh 21 monthly from employee salary and remit to the tax office (DJP) by the 10th of the following month. Employees receive bukti potong (withholding slip) and use it to file annual SPT Tahunan.

Resident progressive brackets (per UU HPP, effective 2022): 5% on income up to IDR 60 million, 15% on IDR 60–250 million, 25% on IDR 250–500 million, 30% on IDR 500M–5 billion, 35% above IDR 5 billion. A non-taxable income (PTKP) of IDR 54 million per year for individuals, plus IDR 4.5 million for a spouse and IDR 4.5 million per child (max 3), reduces taxable income before brackets apply.

Contractor withholding: PPh 21 also applies to fees paid to freelance individuals. Withholding is calculated on gross fees at the applicable marginal rate (with PTKP applied); rates vary by status (gross-up, gross, or net). Most mid-range freelance engagements result in 2.5%–7.5% effective withholding by the client.

Foreign clients: a non-resident individual performing work in Indonesia is subject to PPh 26 at a flat 20% (or a lower treaty rate). A US, EU, or APAC client paying a non-resident contractor should consider whether the work is performed in Indonesia — if yes, PPh 26 applies. The client is generally the withholding agent, and the rate may be reduced under an applicable tax treaty (US-Indonesia treaty, for example, caps certain categories at 15%).

Annual filing: individuals earning above the PTKP must file SPT Tahunan via e-Filing by 31 March. Foreign remote workers with NPWP can use e-Filing; those without should register NPWP at the local tax office before first payment.

UU PDP (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi) is Indonesia's first comprehensive personal data protection law, modeled on GDPR principles. It came into force in October 2024 with a two-year transition for full enforcement.

Scope: UU PDP applies to any legal entity (or individual) processing personal data of Indonesian residents, regardless of where the controller or processor is domiciled. Foreign clients processing Indonesian remote worker data — name, KTP, NPWP, bank account, address, even IP address and device fingerprint — are bound by the law.

Roles: the controller (pengendali) determines the purpose and means of processing; the processor (pemroses) processes on the controller's instructions. Foreign clients are typically the controller; EORs and payroll providers are processors.

Consent and lawful basis: processing requires explicit consent, or another lawful basis (contract performance, legal obligation, vital interest, public interest, or legitimate interest with balancing test). Consent must be specific, informed, and withdrawable.

Cross-border transfer: personal data may be transferred outside Indonesia, but the destination country must have an adequate level of protection, or the transfer must rely on binding corporate rules, standard contractual clauses, or explicit consent with risk acknowledgment.

Breach notification: data controllers must notify the regulator and affected data subjects within 3×24 hours of becoming aware of a personal data breach that risks harm to the subject. Failure to notify, or processing without lawful basis, carries administrative fines up to IDR 50 billion or 2% of annual revenue.

Practical: a foreign client hiring an Indonesian remote worker should (a) post a privacy notice covering data collected, purpose, retention, and third parties; (b) execute a data processing agreement with the EOR/payroll provider; (c) document lawful basis (typically contract performance); (d) restrict data access to operational staff; (e) maintain breach response runbook with 72-hour notification capability.

Intellectual property assignment in Indonesia is enforceable under UU Hak Cipta (Copyright Act, 2014 revision) and UU Paten (Patent Act). The standard rule: work created by an employee within the scope of employment belongs to the employer; work created by an independent contractor belongs to the contractor unless assigned in writing.

For PKWT/PKWTT employees, no separate IP assignment is strictly required for in-scope work — the labor contract plus UU Hak Cipta transfers the work product to the employer. For freelance contractors, a written IP assignment clause is mandatory. Best practice is to execute the IP assignment at the start of the engagement, list deliverables covered, and include moral rights waiver where the law allows.

NDA enforceability: NDAs are enforceable under Indonesian contract law provided the scope is reasonable, the duration is limited (typically 2–5 years post-termination), and the protected information is properly identified as confidential. Perpetual NDAs covering all information are vulnerable to challenge as overbroad.

Non-compete: under UU Cipta Kerja and post-2020 regulations, post-termination non-compete clauses are recognized but narrowly enforced. Compensation must be paid during the restriction period, the scope must be limited geographically and by industry, and the duration is typically capped at 12–18 months. Foreign clients imposing broad non-competes on Indonesian remote workers without compensation should expect enforceability challenges.

Practical checklist: (1) include IP assignment in the PKWT or freelance agreement; (2) execute a separate NDA with clear confidential information definition; (3) limit non-compete to specific roles, geography, and duration, and pay compensation; (4) document training materials, deliverables, and ownership in onboarding; (5) keep assignment records for 5+ years.

Foreign clients paying Indonesian remote workers have several practical rails, each with different cost, speed, and compliance characteristics.

Wise (formerly TransferWise): most common for USD/EUR/GBP → IDR to local BCA, Mandiri, BRI, or BNI accounts. Fees are transparent (typically 0.4%–1.5% of transfer amount), the rate is mid-market, and the receiving worker gets full IDR in their local account. Ideal for monthly salary or invoice payments under $10K per transfer.

Payoneer: similar use case to Wise; preferred by some contractors because of multi-currency wallet and direct invoice flow. Fees are 1%–2% on currency conversion. Best for freelancers on platforms that disburse via Payoneer.

SWIFT bank transfer: used for larger amounts (>$50K) and corporate-to-corporate flows. Banks charge $20–$50 per transfer plus 0.1%–0.3% correspondent fees; total cost is higher than Wise/Payoneer for small amounts but acceptable at scale. Domestic Indonesian banks (BCA, Mandiri) handle SWIFT receipt efficiently.

IDR vs USD invoicing: contractors usually invoice in USD for clarity to the foreign client, with the local payment converted to IDR at receipt. For monthly employment under PKWT, salary is paid in IDR per local law; USD invoicing is more typical for project-based freelance work.

Withholding mechanics: the EOR/PEO handles PPh 21 withholding and remittance for employee engagements. For direct contractor payments, the foreign client is not generally the withholding agent for PPh 21 — the contractor self-reports. But if the foreign client is a PE (permanent establishment) in Indonesia, withholding obligations apply. Local counsel should confirm PE exposure.

Documentation: keep bank transfer records, invoices, kontrak kerja or freelance agreement, NPWP for both parties, and bukti potong for at least 5 years. This is the audit trail DJP and BPJS check during routine reviews.