INDONESIA Law and Practice Contributed by: Raditya Kosasih, Dimas Triandhanu Utomo, Nicholas Glenn and Nabila Oktavia Annyndira, ALTA Advocates
71/2019, Government Regulation No 80 of 2019 on Electronic Commerce, MOCD Regulation No 5 of 2020 as amended by Minister of Communication and Informatics Regulation No 10 of 2021 on Private Elec - tronic System Providers (“MOCD Reg 5/2020”), and applicable cybersecurity regulations. In the financial sector, among others, OJK Regulation No 44 of 2024 on Bank Secrecy, OJK Regulation No 22 of 2023 on Consumer and Public Protection in the Financial Services Sector and BI Regulation No 3 of 2023 on BI Consumer Protection also apply. There are also archival and record-keeping laws, including Law No 8 of 1997 on Company Documents (“Company Docu - ments Law”) and Law No 43 of 2009 on Archives. In general, these regimes regulate data manage - ment throughout its life cycle without distinguishing between personal and non-personal data, including data governance and use, security and confidential - ity, sector-specific handling requirements, archiving and retention periods, data transfers, and incident or breach response obligations, including reporting time - lines and notifications to relevant sectoral authorities. Where certain regulations make reference to personal data, their interaction with the PDP Law is addressed in 3.2 Interaction of Data Regulation and Data Pro- tection . 3.2 Interaction of Data Regulation and Data Protection The interaction between sectoral regulations and the PDP Law generally takes two forms. First, certain sector-specific regulations expressly refer to the PDP Law for personal data protection compliance. Second, other regulations impose additional, supplementary, or more specific personal data processing require - ments in respect of particular categories of data or regulated activities. For example, while the PDP Law does not expressly regulate data retention periods, such requirements may be addressed under appli - cable sectoral regulations (eg, under the Company Documents Law, records, bookkeeping evidence, and supporting financial administrative data must be retained for a period of ten years, calculated from the end of the relevant company’s financial year). In essence, sector-specific data handling rules are applicable in parallel with the PDP Law, provided
they do not conflict with its provisions. Where data qualifies as personal data, the PDP Law operates as the primary legal framework, while sectoral regula - tions typically supplement the PDP Law by regulat - ing sector-specific processing scenarios or imposing heightened obligations. 3.3 Rights and Obligations Under Applicable Data Regulation The applicable rights and obligations largely depend on the relevant sector and regulatory context. In prac - tice, contractual arrangements also play a critical role in allocating rights, obligations, and liability. Organisations should therefore ensure that their con - tracts clearly define the agreed arrangements, includ - ing, among others, roles and responsibilities of each party in relation to the data and its processing, per - mitted uses or purposes, and applicable technical and organisational measures, while also ensuring the inclusion of provisions addressing compliance with any applicable sector-specific regulatory require - ments. 3.4 Regulators and Enforcement In relation to non-personal data, enforcement author - ity depends on the nature of the data and the relevant sector. Competent authorities include, among others, the MOCD for ESOs, the OJK for the financial services sector, and the BSSN for cybersecurity matters. Co-ordination among regulators typically arises in practice where incidents affect both non-personal and personal data. In such cases, sectoral regulators may co-ordinate with the personal data protection author - ity under the PDP Law, as well as with other relevant government bodies, depending on the affected sector. A notable recent trend is the increasing frequency and sophistication of cybersecurity incidents in vari - ous sectors, which require more active inter-agency co-ordination, particularly where an incident affects both personal and non-personal data and simultane - ously implicates data protection, system security, and sector-specific compliance obligations.
166 CHAMBERS.COM
Powered by FlippingBook