KTP OCR for Customer Onboarding: How It Works and the Personal Data Rules

Banks, fintechs, cooperatives, and finance companies ask for a photo of the KTP (Indonesian identity card) in almost every customer sign-up. The data on the card, from the NIK (national identity number) to the name and address, is then retyped into a form or core system. The process is slow, and one mistyped NIK digit can cause the customer's data to mismatch at a later stage.

KTP OCR moves that data automatically. But what it reads is personal data, so speed alone is not enough. Companies also need to plan how to check the results, the legal basis for processing, which data they actually keep, and for how long.

In short:

• What it is: technology that reads a KTP photo or scan and turns it into structured data.
• What to check: NIK consistency with the written data and the completeness of every field.
• The rules that apply: Law No. 27 of 2022 on Personal Data Protection requires a valid legal basis, only the data you need, and security.
• What OCR is not: identity verification against official population data is a separate process through authorized channels.

What Is KTP OCR?

OCR (optical character recognition) is technology that turns images of text into text a computer can process. For a KTP, OCR reads a photo or scan of the card and maps each piece of text to the right field.

Here are the fields usually found on an electronic KTP and how they are used in onboarding:

The sixth row matters. Being able to read a field does not mean you should keep it. We come back to this in the section on personal data rules.

How KTP OCR Works in Onboarding

In a digital onboarding flow, KTP OCR usually works like this:

1. Upload or scan. The customer uploads a KTP photo in the app, or staff scan the card at a branch.
2. Read the image. The system finds the card area, recognizes the text, and maps it to fields.
3. Check the results. NIK format, NIK consistency with the written data, and field completeness are checked.
4. Confirm. Data that passes fills the form automatically, and the customer or staff member confirms it.
5. Handle doubtful cases. Inconsistent results are flagged for review, or the customer is asked to upload a clearer photo.
6. Pass to the system. Data is sent to the onboarding system through an API, and other verification steps follow.

As a result, customers do not have to retype data already printed on their card, and staff do not have to copy it by hand.

The Checks You Need

Reading text correctly is not enough. A blurry photo, glare, or a worn card can cause one character to be misread, and that error is not always visible to the eye.

Fortunately, the NIK has a structure that can be checked. It has 16 digits: the first six are a region code, the next six contain the date of birth, and the last four are a sequence number. For women, 40 is added to the day of birth in the NIK. This means part of the NIK can be matched against other data written on the same card.

Lookdocu reads KTP, KK (family card), NPWP (tax ID), and SIM (driving licence) documents, then matches the NIK against the data written on the document. Checks like these confirm that the extracted data is consistent. They do not prove that the card is genuine, or that the person uploading it is the card's owner.

OCR Is Not Identity Verification

Many teams treat KTP OCR as the same thing as eKYC. In fact, the two answer different questions.

Verification against official population data is done through a cooperation arrangement with the Directorate General of Population and Civil Registration (Dukcapil) at the Ministry of Home Affairs, or through a provider with lawful access. Reading and checking a document is a separate layer from that verification. Lookdocu's role covers the first two layers: reading the document and checking its consistency, then handing clean data to the verification process the company runs.

The Personal Data Rules to Follow

KTP data is personal data, and processing it is subject to Law No. 27 of 2022 on Personal Data Protection (the PDP Law). Several things should be designed in from the start, not added later:

• A clear legal basis. The PDP Law requires a valid legal basis for processing. Customer consent is one of them, and that consent must be given for a clear purpose. Other bases, such as meeting legal obligations in the financial sector, are also recognized. Decide on the basis with your legal and compliance teams.
• Transparency. Tell customers which data is taken from their KTP, why, and who processes it, in plain language.
• Only the data you need. Processing must be limited and fit its purpose. If onboarding only needs the NIK, name, date of birth, and address, do not keep religion, blood type, or occupation just because they can be read.
• Security. Restrict access by role, protect data in transit and at rest, and log who accessed what.
• Customer rights. Customers have the right to access and correct their data and, in certain conditions, to request its deletion. Make sure your systems can honor those requests.

Data minimization also reduces risk. The less data you keep, the smaller the impact if an incident occurs.

Redaction and Retention

KTP images often change hands after onboarding: sent to other teams, to vendors, or used as samples for testing. This is where redaction comes in. Lookdocu's Redact Personal Data module masks NIK, KK numbers, NPWP, and bank account numbers, so documents can be shared without exposing data the recipient does not need.

Retention matters just as much. The PDP Law requires personal data to be destroyed or deleted once its retention period ends or it is no longer needed for its purpose. At the same time, financial sector rules may require customer documents to be kept for a certain period. The two need to be aligned:

1. Set a retention period for each type of data based on legal obligations and business needs.
2. Separate KTP images from structured data, because the two may have different needs and retention periods.
3. Delete on schedule once the retention period ends, including copies in other systems and backups in line with company policy.
4. Record the deletion so it can be shown during an audit.

How to Start

1. Map your current onboarding flow. Note where KTP data comes in, who types it, and which systems it goes to.
2. Define the fields you actually need. Start from the purpose of onboarding, not from what can be read.
3. Prepare the legal basis and notices with your legal and compliance teams.
4. Test accuracy on sample documents. Lookdocu offers an accuracy test with 50 to 100 sample documents. Make sure the samples are obtained and shared in line with your company's personal data policy.
5. Set check and review rules. Decide when results are accepted automatically and when staff must look at them.
6. Integrate with your systems. Send files through the REST API and receive checked results through HMAC-signed webhooks.

Frequently Asked Questions

Can KTP OCR read a phone photo?

Yes, as long as the whole card is visible and the text is clear. Blurry, tilted, or glare-affected photos should be flagged, and the customer asked to upload again.

Does KTP OCR confirm that a KTP is genuine?

No. OCR reads the card and the checks confirm the data is consistent. Whether the identity is genuine is confirmed through a separate verification process.

Is KTP OCR the same as verification with Dukcapil?

No. OCR reads and checks what the document says. Verification against official population data is a separate process the company carries out through a cooperation arrangement with Dukcapil or a provider with lawful access.

Do we need customer consent?

Processing personal data requires a valid legal basis under the PDP Law, and consent is one of them. The right basis for your flow should be decided with your legal team.

How long can KTP data be kept?

It depends on the purpose of processing and the legal obligations in your sector. Once the retention period ends, the data needs to be deleted or destroyed.

Conclusion

KTP OCR saves time for customers and staff, but its value depends on two things: checks that catch misreads, and handling personal data correctly from the start. Collect only what you need, explain why, redact before sharing, and delete when the retention period ends.

Remember its limits too. OCR reads and checks documents, while official identity verification remains a separate process.

Want to try KTP reading with built-in checks? See Lookdocu or start free at lookdocu.id.