INDONESIA Law and Practice Contributed by: Raditya Kosasih, Dimas Triandhanu Utomo, Nicholas Glenn and Nabila Oktavia Annyndira, ALTA Advocates
the PDP Law has not been established. As a result, although the administrative sanctions framework under the PDP Law is formally in force, no formal PDP Authority-led administrative penalties have yet been issued. Unlike administrative sanctions, criminal sanction enforcement under the PDP Law has been active and there are several court decisions in relation to crimi - nal sanctions in the PDP Law. The first court deci - sion is Karanganyar District Court Decision No 5/Pid. Sus/2023/PN Krg dated 16 March 2023, in which the perpetrator was found guilty of data falsification and imprisoned for four years, and also ordered to pay an IDR1 billion fine. The number of privacy-related proceedings in Indo - nesian courts remains relatively low, with the legal framework still developing following the enactment of the PDP Law. Claimant Types and Legal Standing Issues The primary category of claimants in privacy-related disputes consists of individual data subjects who have suffered direct harm from personal data processing violations. These individuals typically include affected customers or users following data breaches, unau - thorised disclosure incidents, or other forms of per - sonal data protection failure. The second category of claimants are consumer groups or public interest litigants. However, in practice, significant legal standing challenges have emerged regarding collective or representative actions brought by consumer groups or public interest organisations. The legal standing of such entities to represent broad - er classes of affected individuals remains debatable under Indonesian procedural law, with courts dem - onstrating inconsistent approaches to these claims. Available Remedies Under PDP Law The PDP Law provides a framework of remedies for data subjects who suffer harm from personal data pro - tection violations, including the right to claim com - 2. Privacy Litigation 2.1 Privacy Litigation Overview
pensation. The mechanism to claim compensation is expected to be further elaborated in the implementing regulation of the PDP Law. In addition to compensation, the PDP Law allows courts to order injunctive and corrective measures, including requiring the suspension of unlawful data processing, the implementation of appropriate secu - rity safeguards, and the correction of inaccurate per - sonal data. 2.2 Recent Case Law The ongoing enforcement cases have mainly relied on criminal sanctions under the PDP Law and the EIT Law, particularly in cases involving unlawful access, disclosure, or forgery of personal data. Aside from the criminal cases, there are several con - stitutional court decisions in Indonesia related to the PDP Law. The landmark decision on the PDP Law is Constitutional Court Decision No 151/PUU-XXII/2024 dated 30 July 2025, which clarifies the interpretation of the fulfilment of criteria requiring a data protection controller or data protection processor to appoint a DPO. 2.3 Collective Redress Mechanisms Indonesia allows collective redress through class actions under Supreme Court Regulation No 1 of 2002 on Class Action Procedure. This mechanism permits one or more plaintiffs to represent a larger group with common facts and legal issues. In principle, personal data protection violations may be pursued through this mechanism. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation Indonesia does not currently have a single, compre - hensive legal framework specifically governing the protection and processing of non-personal data. Instead, the regulation of non-personal data is pri - marily fragmented into several sectoral laws. By way of example, in the electronic ecosystem, the relevant regulations include (among others) GR
165 CHAMBERS.COM
Powered by FlippingBook