INDONESIA Law and Practice Contributed by: Raditya Kosasih, Dimas Triandhanu Utomo, Nicholas Glenn and Nabila Oktavia Annyndira, ALTA Advocates
ALTA Advocates Sampoerna Strategic Square South Tower Level 16 Jl. Jenderal Sudirman Kav. 45-46 Jakarta 12930 Indonesia Tel: +62-811-978-2024 Email: office@altaadvocates.com Web: www.altaadvocates.com
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws Law No 27 of 2022 on Personal Data Protection (the “PDP Law”) constitutes the primary legal framework for privacy and personal data protection in Indone - sia. The PDP Law is enacted as an implementation of the constitutional right to privacy (as elaborated in its General Elucidation) pursuant to Article 28G(1) of the 1945 Constitution of the Republic of Indonesia. In Indonesia, personal data is defined as data regard - ing individuals (referred to as data subjects) who are identified or can be identified separately or in combi - nation with other information, either directly or indi - rectly, through an electronic or non-electronic system. Personal data is classified into two categories: • general personal data: name, gender, nationality, religion, marital status, and/or personal data that is combined to identify an individual; and • specific personal data: health data and informa - tion, biometric data, genetic data, criminal records, children’s data, personal financial data, and/or other data as stipulated under applicable laws and regulations. The PDP Law establishes key principles and lawful bases for personal data processing, personal data cat - egorisation, the processing requirements for children and persons with disabilities, data subjects rights, the scope of personal data processing, and role-based compliance obligations (ie, personal data controllers,
personal data processors, and joint controllers). In addition, the PDP Law regulates the appointment of a Data Protection Officer (DPO), requirements for per - sonal data transfer (both domestically and cross bor - ders), administrative sanctions for non-compliance, and criminal sanctions in the event of violation. The PDP Law also addresses international co-operation in the field of personal data protection, public participa - tion, and mechanisms for dispute resolution. The PDP Law is expected to be supplemented by implementing regulations in the form of a government regulation. While the PDP Law governs the general framework of personal data protection in Indonesia, it is also subject to other existing and sector-specific laws and regulations. These include, among others: • regulations in the electronic systems ecosystem: (a) Law No 11 of 2008 on Electronic Information and Transactions, as lastly amended by Law No 1 of 2024 (“EIT Law”); (b) Government Regulation No 71 of 2019 on the Operation of Electronic Systems and Transac - tions (“GR 71/2019”); (c) Ministry of Communication and Digital (MOCD) No 20 of 2016 on Personal Data Protection in Electronic Systems (“MOCD Reg 20/2016”); and (d) Government Regulation No 17 of 2025 on the Governance of Electronic Systems for Child Protection (“PP TUNAS”), • other sector-specific regulations, for example, in highly regulated industries such as financial ser - vices and fintech sectors:
158 CHAMBERS.COM
Powered by FlippingBook