INDONESIA Law and Practice Contributed by: Raditya Kosasih, Dimas Triandhanu Utomo, Nicholas Glenn and Nabila Oktavia Annyndira, ALTA Advocates
Criminal Sanctions The PDP Law also regulates the criminal sanctions, as follows: • Unlawful Collection or Obtaining of Personal Data: Any person who intentionally and unlawfully obtains or collects personal data that does not belong to them, for their own benefit or the benefit of another person, and which results in loss to the data subject, is subject to imprisonment of up to five years and/or a fine of up to IDR5 billion. • Unlawful Disclosure of Personal Data: Any person who intentionally and unlawfully discloses personal data that does not belong to them is subject to imprisonment of up to four years and/or a fine of up to IDR4 billion. • Unlawful Use of Personal Data: Any person who intentionally and unlawfully uses personal data that does not belong to them is subject to imprison - ment of up to five years and/or a fine of up to IDR5 billion. • Forgery of Personal Data: Any person who inten - tionally creates false personal data or falsifies personal data with the intent to obtain a benefit for themselves or another person, and which causes loss to another person, is subject to imprisonment of up to six years and/or a fine of up to IDR6 billion. Further, Law No 1 of 2026 on Criminal Sentencing Adjustment introduced a category-based fine system that substantially reduced the monetary penalties. Unlawful collection, disclosure, and use of personal data are now subject to fines capped at IDR200 mil - lion, while the forgery of personal data is subject to fines capped at IDR500 million, without any reduction in the applicable prison terms. Where these offences are committed by or for a cor - poration, criminal liability may be imposed on both the company and the individuals involved, and corporate fines may be increased by up to ten times the statu - tory maximum fines applicable to individuals. 1.9 Enforcement Trends The PDP Law came into effect in October 2024, fol - lowing the end of the two-year statutory grace period. However, administrative enforcement has not yet been fully implemented, as the PDP Authority mandated by
EIT Law for cyber crimes, and digital evidence han - dling protocols. Law enforcement agencies co-ordinate with the MOCD, the OJK, and the BSSN regarding (i) informa - tion exchange for investigation purposes; (ii) techni - cal assistance in digital forensic analysis; (iii) cross- jurisdictional case co-ordination; and (iv) prevention Pursuant to the cross-border co-ordination, the PDP Law grants the authorities, including the PDP Author - ity, the power to conduct international co-operation in personal data protection, including: (i) information exchange with foreign data protection authorities; (ii) mutual legal assistance in investigations; (iii) harmo - nisation of data protection standards; and (iv) joint capacity development. 1.8 Enforcement Proceedings and Fines The PDP Authority possesses comprehensive investi - gative powers, including the ability to conduct exami - nations, request documentation, interview relevant parties, and co-ordinate with other authorities. The PDP Authority may initiate investigations based on data breach notifications, public complaints, audits, or referrals from other government agencies. Administrative Sanctions The PDP Law grants the PDP Authority the power to impose administrative sanctions, including written warnings, temporary suspension of personal data pro - cessing activities, permanent suspension of process - ing operations, deletion of personal data, and imposes administrative fines. The PDP Law imposes fines of up to 2% of the annual revenue of the personal data controller or personal data processor in the preceding financial year. of overlapping legal processes. Cross-Border Co-Ordination However, as of the date of this guide, the detailed procedures for imposing administrative sanctions, including assessment criteria, severity violations, pen - alty calculation guidelines, and appeal mechanisms, have not been fully elaborated through implement - ing regulations. The PDP Law provides the statutory foundation, but operational procedures remain under development by the competent authorities.
164 CHAMBERS.COM
Powered by FlippingBook