INDONESIA Law and Practice Contributed by: Raditya Kosasih, Dimas Triandhanu Utomo, Nicholas Glenn and Nabila Oktavia Annyndira, ALTA Advocates
• assess the fulfilment of requirements for the trans - fer of personal data outside the jurisdiction of the Republic of Indonesia; • issue orders as follow-up to the results of supervi - sion of personal data controllers and/or personal data processors; • publish the results of personal data protection supervision in accordance with applicable laws and regulations; • receive complaints and/or reports concerning alleged violations of personal data protection; • conduct examinations and tracing in relation to complaints, reports, and/or supervisory findings of alleged violations of personal data protection; • summon and require the attendance of any person and/or public institutions related to alleged viola - tions of personal data protection; • request explanations, data, information, and docu - ments from any person and/or public institutions in connection with alleged violations of personal data protection; • summon and require the attendance of experts as necessary for examinations and tracing relating to alleged violations of personal data protection; • conduct examinations and tracing of electronic systems, facilities, rooms, and/or premises used by personal data controllers and/or personal data pro - cessors, including obtaining access to data and/or appointing third parties; and • request legal assistance from the public prosecu - tor in the resolution of personal data protection disputes. As of the date of this guide, the President has yet to appoint the PDP Authority to assume the roles above. Hence, it is also important to identify other authorities who might have mandates based on sectoral regula - tions. Sectoral Regulators Subject to the applicable sectoral laws and regula - tions, there are sectoral regulators who might have mandates to supervise the personal data processing, as outlined below. MOCD The MOCD derives its authority in personal data pro - tection from the EIT Law and GR 71/2019 and cur -
rently serves as the primary supervisory authority for ESOs. Its mandate includes issuing data protection- related regulations for electronic systems, overseeing compliance, conducting investigations and adminis - trative enforcement for violations, and co-ordinating with law enforcement agencies and other relevant sectoral authorities. OJK The OJK holds specialised supervisory authority over personal data protection within the financial services sector, covering banks and other financial institutions, financial technology and digital payment providers, capital markets and securities companies, as well as insurance, pension funds, and other non-bank finan - cial service institutions. The OJK conducts regular co-ordination with the MOCD regarding overlapping jurisdictions, particularly for fintech and digital finan - cial services utilising electronic systems. National Cyber and Crypto Agency (Badan Siber dan Sandi Negara, BSSN) The BSSN is the primary technical authority for cyber - security aspects of personal data protection in Indo - nesia, particularly in cases involving cyber incidents, national vital infrastructure, or cross-border cyber threats. Under BSSN Regulation No 1 of 2024 on Cyber Incident Management (“BSSN Reg 1/2024”), ESOs, especially those operating vital information infrastructure, must report cyber incidents to the National Cyber Incident Response Team (Nat-CSIRT) within 24 hours. The BSSN is empowered to conduct technical investigations and digital forensics, identify system vulnerabilities, provide incident containment and recovery assistance, and lead the response to major cyber incidents affecting the security of per - sonal data. Law enforcement Law enforcement agencies, including the Indonesian National Police and Attorney General’s Office, pos - sess authority in handling criminal cases related to personal data protection based on (i) criminal sanc - tions in the PDP Law and (ii) cyber-crimes and criminal sanctions under the EIT Law. Criminal law enforce - ment is conducted in accordance with the Criminal Procedure Code (KUHAP), special procedures in the
163 CHAMBERS.COM
Powered by FlippingBook