INDONESIA Trends and Developments Contributed by: Agus Ahadi Deradjat, Mahiswara Timur, Nina Cornelia Santoso and Dhan Partap Kaur, ABNR Counsellors at Law
for the cross-border data transfer must be given by the data subject. Points (i) to (iii) above must be assessed and imple - mented in sequence. To date there is no indication that an official approved list of countries that meet the Adequacy of Protection requirements will be pub - lished. Data Protection Authority (DPA ) The PDP Law mandates the formation of a DPA that is tasked to act as regulator, supervisor, and executor in data protection matters by the President, which is yet to be formed. In the meantime, pursuant to MOCD Regulation 1/2025 on Organisation and Work Proce - dures, matters concerning personal data protection are currently under the authority of Directorate Gen - eral of Digital Space Supervision at the MOCD (DG). The DG is tasked with formulating and implementing policies related to digital space supervision and per - sonal data protection. Based on statements made by the current Minister in public announcements, the DPA is expected to be established in the near future. DPO The PDP Law requires a data controller or data pro - cessor to appoint a DPO in situations where: (i) it pro - cesses personal data for public interest; (ii) the data controller’s core activities have such a nature, scope, and/or purpose that require regular and systematic monitoring of personal data on a large scale; and (iii) the data controller’s core activities involve large-scale processing of specific/sensitive or criminal-related personal data. The Indonesian Constitutional Court, through Deci - sion No 151/PUU-XXII/2024 dated 30 July 2025, held that this cumulative reading was unconstitutional. The word “and” the PDP Law must instead be read as “and/or,” meaning that fulfilling any one of these con - ditions is sufficient to trigger the obligation to appoint a DPO. Thus, data controllers and data processors should reassess their obligations under the PDP Law to appoint a DPO. Development on artificial intelligence (AI) AI is increasingly being adopted across multiple sec - tors in Indonesia, including by government institutions
in their daily operations. Recognising the growing demand for AI technologies, the government has indi - cated its support for AI development and is planning to accommodate its use through forthcoming regula - tions and infrastructure initiatives. While Indonesia has yet to introduce binding regula - tions governing the use of AI, MOCD issued Circular Letter No 9 of 2023 on Ethics of Artificial Intelligence (“CL 9”). As of early 2026, CL 9 remains the only gen - eral regulatory guidance addressing the use of AI by business undertakings. In summary, CL 9 contains the following salient items: • general definitions, general guidelines for values, ethics, and control of consulting, analysis and pro - gramming activities with an AI basis by business undertakings and electronic systems operators (ESOs); • emphasis that the CL 9 is applicable to: (i) busi - ness undertakings operating under Indonesian Standard Business Classification (KBLI, similar to ISIC) 62015 on AI-Based Programming Activities; (ii) ESOs in public scope; and (iii) ESOs in private scope; however, with the issuance of KBLI 2025 version, KBLI 62015 is no longer applicable (AI- based programming activity is now encompassed under several different KBLIs, which are the issuance of AI-based software under KBLI 58290 (Other Software Publication) and development of AI fundamental components under KBLI 62194 (Activities for Developing Fundamental Compo - nents of Artificial Intelligence)); and • emphasis on ethical use of AI by adhering to the principles of inclusivity, humanity, safety, acces - sibility, transparency, credibility and accountability, personal data protection, sustainable development and environment, and protection of intellectual property. Additionally, the Financial Services Authority ( Otoritas Jasa Keuangan, or OJK) has issued a Code of Ethics for Responsible and Trustworthy AI in the Financial Technology Industry, which applies to financial tech - nology providers. The Code also stipulates principles of AI utilisation in the financial services industry, which includes: beneficial, fair and accountable, transpar -
173 CHAMBERS.COM
Powered by FlippingBook