INDONESIA Trends and Developments Contributed by: Agus Ahadi Deradjat, Mahiswara Timur, Nina Cornelia Santoso and Dhan Partap Kaur, ABNR Counsellors at Law
Indonesia’s Evolving Data Protection Framework: Key Developments in AI, Cyber Resilience and Child Protection PDP Law in a nutshell Law No 27 of 2022 on Personal Data Protection (the “PDP Law”) serves as the overarching law on personal data protection in Indonesia. In addition to the PDP Law, the implementation of personal data protection is subject to the following laws and regulations: • the PDP Law; • Law No 11 of 2008 on Electronic Information and Transactions, last amended by Law No 1 of 2024 (the “EIT Law”); • Government Regulation No 71 of 2019 on the Pro - vision of Electronic Systems and Transactions (“GR 71/2019”); and • other sector-specific regulations. The PDP Law has extraterritorial effect, meaning that overseas organisations, including individuals, public entities, and international organisations, can be pros - ecuted in Indonesia for violating the law, particularly for non-compliance in processing personal data of Indonesian citizens, whether onshore or offshore. The Indonesian government has been working on the Draft Implementing Regulation for Law No 27 of 2022 on Personal Data Protection (“Draft GR PDP”), which is intended to provide further guidance on the law’s implementation and enforcement. However, as of early 2026, there is no clear timeline for its finalisa - tion. Based on the latest available public statement from the Ministry of Communications and Digital Affairs (MOCD) in October 2025, the Draft GR PDP has completed its harmonisation process, and has been passed to the State Secretary for approval by the President. Furthermore, an amendment to the current PDP Law is currently included in the Annual Priority National Legislation Programme (which is prepared jointly by the House of Representatives, the Regional Repre - sentatives Board, and the President) for 2026. The amendment was registered on 23 September 2025 and is only at the planning stage. Some of the notable provisions under the PDP Law are outlined below.
Types of personal data The PDP Law defines “personal data” as “any data related to an individual (natural person), whether iden - tified or capable of being identified independently or in combination with other information, whether directly or indirectly, through the use of an electronic sys - tem and/or non-electronic means”. The individual is referred to as a “data subject”. The PDP Law further categorises personal data as general personal data (name, gender, nationality, reli - gion, marital status, or personal data that together can identify a person) and specific personal data (data on health, biometric or genetic, and criminal records; data on children; financial data; and/or other data in accordance with the laws and regulations). There is no particular differentiation in treatment of the processing of general or specific personal data. However, the pro - cessing of specific personal data would trigger addi - tional obligations, such as the need to perform a Data Protection Impact Assessment (DPIA) and appoint a Data Protection Officer (DPO). Lawful basis for processing of personal data The PDP Law acknowledges several legal bases for personal data processing: (i) consent; (ii) contractual necessity; (iii) compliance with a data controller’s legal obligations; (iv) protection of the vital interests of the data subject; (v) public interest, for the provision of public services or for the exercise of lawful authority; and (vi) legitimate interest. We observe that the above legal bases are very similar to the concept adopted by the EU GDPR. Cross-border data transfer The PDP Law introduces layered requirements to allow data controllers to transfer personal data out - side Indonesian territory, namely: • (i) The country receiving the transfer of personal data has an equal or higher level of personal data protection than afforded under the PDP Law (“Adequacy of Protection”). • (ii) In the absence of Adequacy of Protection, an adequate level of binding personal data protection must be available (“Appropriate Safeguards”). • (iii) In the event that neither Adequacy of Protection nor Appropriate Safeguards are present, consent
172 CHAMBERS.COM
Powered by FlippingBook