INDONESIA Law and Practice Contributed by: Raditya Kosasih, Dimas Triandhanu Utomo, Nicholas Glenn and Nabila Oktavia Annyndira, ALTA Advocates
readiness of national industry and infrastructure, and other factors determined by Bank Indonesia. 5.3 Data Localisation Requirements In general, the PDP Law does not require data locali - sation. Remote access from abroad is generally treat - ed as a cross-border data transfer and is therefore subject to the PDP Law transfer safeguards. The following are some sectors in which data localisa - tion is mandatory or required: • Healthcare: GR 28/2024 requires health data and health information systems to be stored and pro - cessed in data centres located within Indonesian jurisdiction. This includes hospitals, clinics, digital health platforms, and other healthcare service providers. • Banking: OJK Regulation No 11 of 2022 (“OJK Reg 11/2022”) establishes comprehensive data localisation obligations for the banking sector. This provision mandates that both primary data centres and disaster recovery centres must be located within Indonesian territory, ensuring complete domestic control over critical banking infrastruc - ture. • Digital Financial Asset (including Crypto-Assets): OJK Reg 27/2024 and Government Regulation No 49 of 2024 on the Implementation of Crypto Asset Trading (“GR 49/2024”) require crypto-asset ser - vice providers to maintain both their data centres and disaster recovery centres within Indonesian territory, thereby imposing comprehensive data localisation and infrastructure residency obliga - tions. • Financial Technology: OJK Regulation No 3 of 2024 on the Implementation of Financial Technology Innovation and Aggregation Services (“OJK Reg 3/2024”) establishes specific data localisation obli - gations for the financial technology sector, includ - ing payment system aggregators and technological innovation organisers in financial services. OJK Reg 3/2024 requires that data centres and data recovery centres be located within Indonesia, ensuring domestic control over fintech data infra - structure.
• Non-Bank Financial Institutions: OJK Regulation No 4 of 2021 (“OJK Reg 4/2021”) imposes data localisation requirements on non-bank financial institutions, including insurance companies, pen - sion funds, financing institutions, and other non- bank financial service providers, requiring relevant data processing infrastructure to be located within Indonesian territory. 5.4 Blocking Statutes Although the PDP Law does not contain blocking provisions against foreign courts, MOCD Reg 5/2020 authorises the government to implement access blocking of electronic systems. Under these regula - tions, MOCD can block access to a private ESO if: • the private ESO fails to grant access to its systems or data for domestic law enforcement or regulatory oversight; • the system facilitates the distribution of content deemed prohibited under Indonesian law; or • the private ESO fails to meet the mandatory regis - tration requirements. 5.5 Recent Developments The more detailed requirements on international data transfer are expected to be regulated under the upcoming Government Regulation regarding the implementation of PDP Law, including formal crite - ria for assessing foreign data protection regulation, standards for data transfer agreements, binding cor - porate rules, and requirements for transfer impact assessments.
169 CHAMBERS.COM
Powered by FlippingBook