INDONESIA Law and Practice Contributed by: Raditya Kosasih, Dimas Triandhanu Utomo, Nicholas Glenn and Nabila Oktavia Annyndira, ALTA Advocates
the data subject; (vii) the right to proportionally restrict the processing of personal data relating to the data subject in certain circumstances; (viii) the right to request the termination of process - ing, the deletion and/or destruction of personal data relating to the data subject; and (ix) the right to object to the processing of personal data based on an automated decision-making process, including profiling, which has a signifi - cant impact to the data subject. The PDP Law further provides a response mechanism for the exercise of data subject rights. Where a per - sonal data controller receives a request for the exer - cise of the rights referred to in items (iv) to (vii) above, the controller is required to fulfil such request within 3 × 24 hours (ie, within 72 hours). Role-Based Compliance Obligations under the PDP Law The main compliance of each organisation depends on its role. The PDP Law recognises several distinct roles, each subject to specific responsibilities, liabili - ties, and regulatory obligations, namely the personal data controller, personal data processor, and joint controller. • Personal Data Controller: As the party that deter - mines the purposes of personal data processing and generally exercises control and responsibility, its key obligations include: (a) ensuring that personal data is processed law - fully in accordance with the applicable lawful basis under the PDP Law; (b) establishing and implementing a governance and compliance framework, including appropri - ate data governance structures, internal poli - cies, and procedures, as well as continuously monitoring compliance; (c) providing privacy notices and ensuring trans - parency to data subjects; (d) classifying and handling personal data appro - priately, including applying the required safe - guards for each category of data (general and specific personal data); (e) implementing adequate security and confiden - tiality measures;
(f) ensuring the accuracy and integrity of personal data through verification and update mecha - nisms; (g) conducting a data protection impact assess - ment (DPIA) in the event that the processing of personal data has the potential to pose a high risk to the data subject; (h) establishing and maintaining records of pro - cessing activities (RoPA); (i) ensuring that data transfers and third-party engagements comply with the PDP Law; (j) implementing incident or personal data breach handling procedures, including notification within 3 x 24 hours (ie, within 72 hours); (k) establishing a data retention schedule and mechanism for deletion and/or destruction in accordance with applicable laws; (l) appointing a DPO, where required; and (m) handling data subject rights. • Personal Data Processor: A personal data proces - sor is required to process personal data strictly based on the instructions of the personal data controller and must obtain the controller’s prior written approval if it engages another personal data processor (sub-processor). Primary liability for personal data processing rests with the personal data controller. However, a personal data proces - sor may be held independently liable where it processes personal data contrary to the controller’s instructions, or where it violates applicable laws and regulations. • Joint Controller: Joint controllers are also required to comply with all obligations applicable to per - sonal data controllers. Two key obligations must be observed: (a) The controllers are required to enter into an agreement that sets out the roles, responsibili - ties, and legal relationship between the parties. (b) Joint personal data controllers are jointly responsible for providing information to data subjects, including the controllers involved, lawful basis, purpose, category of personal data, methods and contact person. 1.3 Special Categories of Personal Data The PDP Law does not set out separate processing regimes for general personal data and specific per - sonal data. However, the processing of specific per -
160 CHAMBERS.COM
Powered by FlippingBook