How long a company must keep its documents in Indonesia: retention table and schedule

Some companies keep every document forever because they are afraid of throwing away the wrong one, while others destroy old files without knowing whether a duty to keep them still applies. This guide explains how long a company in Indonesia must keep its documents, how to write a retention schedule (jadwal retensi), and how to destroy documents properly.

This guide is general information and is not legal or tax advice. The rules can change and every company's situation differs, so confirm anything important with your lawyer, accountant or tax consultant. Government bodies have their own rules, and those are outside the scope of this guide.

The short answer

In Indonesia, a company's finance records must be kept for 10 years. That covers its records, its bookkeeping evidence and the supporting data. Under the Company Documents Law (UU 8/1997), the 10 years run from the end of the company's financial year (tahun buku). On the tax side, the KUP Law also requires books, records and the documents that underlie the bookkeeping to be kept for 10 years in Indonesia.

Other documents, such as contracts and correspondence, have no single period in the law. The company sets the period itself in its retention schedule, based on how useful the document remains. So it is not true that every company document must be kept for 10 years.

What counts as a company document

UU 8/1997 defines company documents as data, records and information that a company makes or receives in its activities, on paper or on other media. The law splits them into finance documents and other documents. The split matters because the two groups are governed differently.

Retention table

This table summarises what the law supports. The last column shows whether the period comes from a statute or from company policy.

For employee files, no clear statute sets a retention period for private companies. Payroll records are probably bookkeeping evidence or a tax basis, but that is an inference and not the wording of a provision. A sensible approach is to set the period in company policy and use the 10-year rule as the reference.

The UU 8/1997 period and the tax period may start from different points. The safest practice is to follow the longer one.

The duty to keep a document does not remove its role as evidence. Article 11(5) of UU 8/1997 says the retention duty does not reduce a document's evidentiary role under limitation periods or other legal needs. A document whose retention period has ended can therefore still matter if a dispute is possible.

Tax records also carry consequences beyond housekeeping. Intentionally failing to keep the books, records or documents that underlie the bookkeeping can be a crime under Article 39(1)h of the KUP Law. If you have questions about where electronic tax records may be stored, ask a tax consultant.

The old 30-year KUHD rule no longer applies

Article 6 of the KUHD used to set 30 years for keeping bookkeeping. Article 30 of UU 8/1997 states that this provision and any conflicting rules are declared no longer in force. If you still see 30 years in an old SOP or article, it is no longer the reference.

Storing documents electronically

UU 8/1997 allows company documents to be transferred to microfilm or other media, which covers electronic media. The transfer can happen from the time the document is made or received. Several conditions apply.

• Legalisation. Every transfer must be legalised with a berita acara (a signed record) that states the place and date, declares that the copy matches the original, and carries the signature and name of the officer.
• Evidence. The transferred documents and their printouts are recognised as valid evidence.
• Originals. Management must consider whether the originals still need to be kept. Originals that have authentic evidentiary force and a continuing legal interest must be kept. After a transfer, other originals may be destroyed unless management decides otherwise.

One point is unresolved. Article 10(1) of UU 8/1997 says the signed annual balance sheet and profit and loss statement must be made on paper, while other records may be kept in other means. How this interacts with signing financial statements electronically is not settled. Do not assume that keeping everything only in electronic form is always compliant, and ask your accountant first.

Personal data and the PDP Law

Company documents often contain personal data, such as employee ID cards, applicant data or customer data. Under the Personal Data Protection Law (UU 27/2022), personal data is deleted or destroyed after the retention period ends or at the data subject's request, unless the law requires otherwise. Article 44(1) refers to destruction when the retention period under the retention schedule expires.

In practice two things have to line up. A legal duty to keep a record, such as for finance documents, can override a deletion request, but a document with no duty to keep it should not be held indefinitely. The PDP Law itself does not set a fixed retention period.

How to write a retention schedule

A retention schedule is a written list that names each document type, how long it is kept, and what happens afterwards. UU 8/1997 provides that it is set by a decision of company management (keputusan pimpinan).

1. List the document types. Collect what each division makes or receives, for example contracts, invoices, correspondence, employee files and minutes.
2. Group them. Separate finance and tax records from other documents.
3. Set the periods. Use at least 10 years for finance and tax records. For other documents, decide by usefulness, operational need and dispute risk. For employee files, set the period in company policy with the 10-year rule as the reference.
4. Decide the final action. Choose whether the document is destroyed, kept longer or transferred to another medium.
5. Get approval. Management approves the schedule, then it is communicated and reviewed regularly.

Destroying documents

Finance records past their 10 years are destroyed by a management decision, and other documents follow the retention schedule. Every destruction needs a berita acara. An officer who destroys documents too early, or destroys a document known to be still needed, is liable for the resulting losses.

For that reason, hold off on destruction during a dispute or an audit, even if the retention period has ended. Documents involved in a dispute or audit should carry a clear flag so that a routine clean-up does not delete them.

Checklist

• The company has a written retention schedule approved by management.
• Finance and tax records are kept at least 10 years, and where the start dates differ, the longer period is used.
• The retention period for employee files is set in company policy.
• Every transfer to electronic media is legalised with a berita acara.
• Originals that must still be kept are flagged, including a signed balance sheet and profit and loss statement on paper, once confirmed with the accountant.
• Personal data is deleted after the retention period ends, unless a legal duty requires keeping it.
• Every destruction is recorded in a berita acara.
• Destruction is suspended during disputes and audits.

How Obscura helps

Obscura is a document management system, and its features help you carry out a retention policy that you have already set. It does not make a company compliant, because compliance depends on your own schedule and decisions.

• Retention rules by document type. The retention catalogue is organised by document type, and document control holds retention rules and legal holds as part of your records policy. We confirm the scope you need before the pilot starts.
• Legal holds. A document that is under dispute or review can be held so that it cannot be deleted.
• Review, destroy or extend. Reminders appear for records that are due for disposition, so the final decision stays with the people authorised to make it.
• Audit log. Changes, decisions and activity on each document are recorded, so evidence does not have to be gathered from several applications.

The Records Compliance module adds more formal records structure, with retention set per folder and record transfers. The capabilities page lists the details, and the deployment options, on your own servers or run by Valid, decide who runs the server.