INDONESIA Trends and Developments Contributed by: Agus Ahadi Deradjat, Mahiswara Timur, Nina Cornelia Santoso and Dhan Partap Kaur, ABNR Counsellors at Law
Based on the publicly available draft, the key points in the Cybersecurity Bill include the following: • Relevant entities are encouraged to report cyber incidents within a certain timeframe, with a view to facilitating improvement and mitigation measures rather than imposing sanctions. • It mandates the implementation of security stand - ards throughout the digital product process to protect national infrastructure from cyber threats. The Cybersecurity Bill is expected to be the legal basis for maintaining Indonesia’s cybersecurity, sover - eignty, and resilience amidst escalating global threats, complementing the existing EIT Law. On the House of Representatives’ website, the Bill is only registered in the Medium-Term Annual Priority National Legisla - tion Programme (2025-2029), and was last updated in November 2024. However, based on news articles in August 2025, the Bill is currently at the harmonisation stage, where the draft is deliberated among various ministries/agencies and relevant stakeholders. Likely implementation of the Draft GR PDP As noted above, the Indonesian government has been preparing the Draft GR PDP for some time. While it is expected to provide further guidance on the imple - mentation of the PDP Law, the regulation has yet to be issued. In addition, the Draft GR PDP contemplates the conferral of certain regulatory powers on the DPA, which has not yet been established. Some notable provisions under the Draft GR PDP (latest publicly available draft as of August 2023) are outlined below. Requirements for reliance on lawful bases The Draft GR PDP provides further guidance or requirements on reliance upon lawful bases of pro - cessing, including: • Express Consent: If the data subject refuses to provide consent, the data controller cannot deny goods or services to the data subject, provided no personal data processing is involved. Additionally, the data controller must implement measures to identify users and ensure relevant personal data
protection, including for services targeting children and individuals with disabilities. • Contractual Necessity: In relying on contractual necessity, the agreement that serves as a basis for the personal data processing must: (i) obtain valid express consent from the data subject; (ii) fulfil relevant personal data protection measures; (iii) assess the risk impact on the data subject; (iv) balance interests between the data subject and controller; and (v) acknowledge the data subject’s rights. If the data subject does not provide valid consent, the personal data processing is consid - ered null and void. • Legitimate Interest: This lawful basis can be relied upon if the data controller: (i) analyses the needs, objectives, and balance between the rights of data subjects and its own interests, demonstrating a legitimate interest in processing personal data, and (ii) assesses that processing for other legitimate interests does not harm or impact the data subject, ensuring steps are taken to reduce any potential impact. Practical challenges arising from the existence of various lawful bases for data processing include the need for data controllers to appropriately identify the correct lawful basis for each processing activity. Giv - en that the PDP Law lacks sufficient guidance, data controllers must exercise caution when identifying the purpose of data processing and selecting the appro - priate lawful basis. This task requires careful assess - ment to ensure compliance with the law and to avoid potential risks associated with unlawful data process - ing. Therefore, it is advisable for data controllers to engage in continuous consultation with authorities or legal consultants to ensure proper understanding and implementation of the law, as well as to address any ambiguities or uncertainties related to the lawful bases for personal data processing. AI technology providers and users must consider the use of personal data for AI learning, output creation, and feedback. The processing of personal data using AI must: (i) adhere to data protection principles under the PDP Law; (ii) rely on an appropriate lawful basis for processing; and (iii) implement safeguards throughout the processing stages. For instance, users of genera - tive AI platforms must ensure they have secured the
175 CHAMBERS.COM
Powered by FlippingBook