INDONESIA Law and Practice Contributed by: Raditya Kosasih, Dimas Triandhanu Utomo, Nicholas Glenn and Nabila Oktavia Annyndira, ALTA Advocates
5.2 Government Notifications and Approvals The PDP Law does not stipulate a prior approval requirement by PDP Authority for international per - sonal data transfers. However, the PDP Law grants the PDP Authority specific powers to conduct assess - ments of cross-border data transfer requirements for fulfillment. In relation to the electronic system, private ESOs are obligated to co-ordinate with MOCD in relation to international transfers. The regulatory requirements in relation to international transfers may be subject to sectoral laws, among oth - ers: • Digital Financial Asset (Including Crypto-Assets): OJK Regulation No 27 of 2024 on the Organisa - tion of Trading of Digital Financial Assets including Crypto Assets (“OJK Reg 27/2024”) establishes specific requirements for personal data handling within the digital asset sector, though it does not explicitly stipulate comprehensive cross-border data transfer procedures. However, the regula - tion mandates that any transfer of data subjects’ personal data to third parties must be notified to the OJK. • Healthcare: Government Regulation No 28 of 2024 concerning Health (“GR 28/2024”) establishes stringent authorisation requirements for interna - tional transfers of health-related personal data, that cross-border transfers of health data must obtain prior approval from the Minister of Health of the Republic of Indonesia, which applies to all cat - egories of health data transfers, including patient records, medical research data, pharmaceutical information, and public health surveillance data. • Banking and Financial Services: Bank Indonesia Regulation No 23/6/PBI/2021 on Payment Sys - tems allows payment transaction processing to be conducted outside the territory of the Republic of Indonesia, provided that prior approval is obtained from Bank Indonesia. Such approval may be grant - ed by taking into account, among others, the use of electronic systems and/or operational activities integrated with the principal office of the payment service provider located outside Indonesia, the
Accordingly, each corporate action must be assessed on a case-by-case basis to determine whether the role of the personal data controller remains unchanged, is transferred to another entity, or is otherwise impacted.
5. International Considerations 5.1 Restrictions on International Data Transfers
Under the PDP Law, a cross-border transfer of per - sonal data occurs where a personal data controller or personal data processor makes personal data available or provides access to another party locat - ed outside the jurisdiction of Indonesia, whether by transmission, remote access, hosting, or any other technical means. This includes cloud hosting, cross- border access to databases, and sharing of data with overseas affiliates or vendors. Based on PDP Law, cross-border transfers of per - sonal data are permitted only if one of the following safeguards is satisfied: • Adequacy Principle: A transfer is permitted where the recipient country or international organisation provides a level of personal data protection that is equal to or higher than that under Indonesian law. • Contractual Safeguards: Where the recipient coun - try does not provide an equivalent level of protec - tion, a transfer may still take place if the personal data controller or processor implements binding contractual safeguards that ensure the protection of personal data in accordance with the PDP Law. • Consent of the Data Subject: If neither adequacy nor contractual safeguards can be satisfied, a cross-border transfer may still be carried out based on the consent of the personal data subject. Cross-border transfers of non-personal electronic data are governed by GR 71/2019, which allows pri - vate ESOs to host, process, store electronic systems and electronic data (including non-personal data) out - side the territory of Indonesia, except for the financial sector, which is subject to sectoral regulations.
168 CHAMBERS.COM
Powered by FlippingBook