INDONESIA Law and Practice Contributed by: Raditya Kosasih, Dimas Triandhanu Utomo, Nicholas Glenn and Nabila Oktavia Annyndira, ALTA Advocates
(a) Financial Services Authority ( Otoritas Jasa Keuangan , OJK) Regulation No 22 of 2023 on Consumer and Public Protection in the Finan - cial Services Sector; and (b) Bank Indonesia (BI) Regulation No 3 of 2023 on BI Consumer Protection, These sectoral regulations supplement or specify personal data protection rules, provided they do not conflict with the PDP Law. The PDP Law has extraterritorial reach, applying to individuals or corporations, public bodies, or interna - tional organisations that conduct legal acts as regu - lated under the PDP Law, whether: • within the territory of the Republic of Indonesia; or • outside Indonesia where such acts have legal effects in Indonesia and/or to Indonesian citizens as personal data subjects abroad. The PDP Law does not apply to the processing of personal data by individuals for purely personal or household purposes. 1.2 Rights and Obligations General Principles of Personal Data Processing In Indonesia, the processing of personal data encom - passes the entire life cycle of personal data, from collection, analysis, storage, rectification, display, announcement, transfer, disclosure, deletion, and destruction of personal data. Such personal data pro - cessing must follow these principles: • Lawful, Fair, and Transparent: Processing shall be processed based on a lawful basis provided under the PDP Law. Processing shall be carried out fairly, transparently, and in a limited and specific manner, in line with the purposes communicated to the data subject. Personal data controllers are required to provide clear and accessible information to data subjects regarding the personal data processing practices. • Data Minimisation: Personal data processing shall be relevant and limited to what is necessary for the intended purposes.
• Purpose Limitation: Personal data shall be pro - cessed only for specified purposes that are clearly communicated to data subjects. • Data Subject Rights: The rights of data subjects shall be respected and supported through appro - priate processes. • Accuracy and Completeness: Personal data shall be accurate, complete, and kept up-to-date. • Accountability: Processing shall be carried out responsibly and in a demonstrable manner, sup - ported by appropriate documentation, and super - vised through periodic audits to ensure ongoing compliance with applicable laws. • Security and Confidentiality: Personal data shall be processed with appropriate technical and organi - sational safeguards to ensure security, integrity, confidentiality, and protection against any misuse, loss, and unauthorised access, disclosure, altera - tion, or destruction of personal data. • Retention, Deletion ( Penghapusan ), and Destruc - tion ( Pemusnahan ): Personal data shall be retained only for as long as necessary for lawful processing purposes, in accordance with the retention sched - ule and the applicable laws. Data Subject Rights Under the PDP Law, the data subjects’ rights are rec - ognised, including: (i) the right to obtain clear and transparent informa - tion regarding the personal data controller, lawful basis for processing, purpose of the collection and use of personal data, and the accountability of the party requesting such personal data; (ii) the right to file a claim and receive compensa - tion for any violation of personal data processing relating to the data subject; (iii) the right to obtain and/or use personal data re - lating to the data subject from the personal data controller in a structured format commonly used and/or readable by electronic systems; (iv) the right to complete, update, and/or correct errors or inaccuracies in personal data relating to the data subject; (v) the right to access and obtain a copy of personal data relating to the data subject; (vi) the right to withdraw previously granted consent for the processing of personal data relating to
159 CHAMBERS.COM
Powered by FlippingBook