Privacy laws
One transparent design, four privacy laws.
Built to support Indonesia's UU PDP, and the privacy laws of the Philippines, the European Union and the United States.
ID Indonesia (UU PDP) · PH Philippines (Data Privacy Act) · EU European Union (GDPR) · US United States (state laws)
✓ Required, and supported ◐ Required; partly supported: the product gives you part of it, your process completes it – Not generally required
Laws referred to: Indonesia — UU No. 27 Tahun 2022 on Personal Data Protection (enacted 17 Oct 2022; fully in force 17 Oct 2024) · Philippines — Data Privacy Act of 2012 (Republic Act No. 10173, 15 Aug 2012) · European Union — General Data Protection Regulation (EU) 2016/679 (applies since 25 May 2018) · United States — California Consumer Privacy Act as amended by the CPRA (employee data covered since 1 Jan 2023); New York Civil Rights Law §52-c (since 7 May 2022).
Not covered yet: a formal process for an employee to request a full copy of their data; correcting personal details other than project time (an administrator does it); and reporting a breach to the regulator. These stay with your organisation. The audit trail and tamper incidents give you the evidence for the last one.
How it supports UU PDP, right by right
| Right or obligation | How ASA Workstyle supports it | Status |
| Information & notice | A notice for each purpose, in three languages, checked on the PC so the employee sees the approved text. | Supported |
| Consent & withdrawal | Separate consent for activity, screenshots and location. Withdraw at any time in the app, after clocking out. Expiry, and re-consent. | Supported |
| Access to own data | The employee portal shows their own records, with CSV export on several screens. | Partial |
| Rectification | Employees correct their project time through timesheet adjustments. | Partial |
| Erasure | Request, approval with notes, the key destroyed, and a proof record. | Supported |
| Data minimisation | Blur, reduced resolution, window masking, web addresses without their details, district-level location, nothing outside working time, and PDFs never stored on the server. | Supported |
| Security of processing | Encryption on the PC and the server, role-based access, two-step sign-in, tamper-evident records. | Supported |
| Accountability | An audit trail of who viewed whose data, with a purpose and document number for sensitive views. | Supported |
| Retention | You decide the period for each data type; older data is removed with the housekeeping feature, never automatically. | Supported |
| Data stays in-country | Installed in your own data centre. No cloud transfer. | Supported |
What to know in each market
Indonesia · UU PDPOur home design. Consent for each purpose, erasure and the access audit trail map directly. District location zones are available here.
Philippines · Data Privacy ActRecording must be disclosed, necessary and proportionate, with a privacy impact assessment by the employer. Location uses an approximate area.
European Union · GDPREmployers usually rely on legitimate interest plus a DPIA; our consent for each purpose then serves as the transparency record. Recording working time is a legal duty, and our attendance records support it.
United States · state lawsSome states require written notice; California gives employees access, deletion and correction rights. We collect no biometrics.
Designed to support these laws. Compliance belongs to your organisation as the data controller: ASA Workstyle gives you the tools and the evidence. Indicative, from our own research (September 2026); not legal advice. No AI, no biometrics, no webcam, no video.