INDONESIA Trends and Developments Contributed by: Agus Ahadi Deradjat, Mahiswara Timur, Nina Cornelia Santoso and Dhan Partap Kaur, ABNR Counsellors at Law
necessary lawful basis, such as obtaining consent from individuals before processing their personal data on AI platforms. Cross-border data transfer As stated above, the PDP Law provides that a data controller may transfer personal data offshore should they fulfil the layered requirements of Adequacy of Protection, Appropriate Safeguards, or consent of the data subjects. Data controllers are expected to be ful - ly responsible for implementing appropriate security measures in the processing of data transfer. The Draft GR PDP determines the Adequacy of Pro - tection for personal data transfers by assessing the recipient country’s circumstances, including the exist - ence of (i) personal data protection laws; (ii) a super - visory authority; and (iii) international commitments or obligations under legally binding conventions or resulting from participation in multilateral systems. The Data Protection Authority will compile the list of approved countries. When using Appropriate Safeguards for transferring personal data abroad, the Draft GR PDP allows safe - guards such as (i) agreements between the sender’s and recipient’s countries; (ii) standard contractual clauses; (iii) binding company regulations for a group; or (iv) other recognised instruments. Data controllers and processors must also meet additional obliga - tions, such as recording the transfer cycle, mapping its implications, and ensuring that the transferred data is sufficient, relevant, and limited to the transfer’s pur - pose. In July 2025, the MOCD issued a press release on data transfer clauses in a Joint Statement on Framework for United States–Indonesia Agreement on Recipro - cal Trade with the United States issued by the White House on 22 July 2025 (“Joint Statement”) with the intention to remove the barrier in digital information trade. The Joint Statement stipulates that Indonesia will provide certainty regarding the ability to transfer personal data out of its territory to the United States. This statement raised concerns over the potential removal of barriers to cross-border personal data transfers, as this could undermine the level of per - sonal data protection and appear inconsistent with
the layered cross-border transfer requirements under the PDP Law. However, the MOCD assured that the Joint Statement is not a form of free transfer of per - sonal data and that transfers will still be conducted based on Adequacy of Protection under Indonesian law. There is currently no further clarification on the implementation of such barrier removal for data trans - fers with the USA. Online Child Protection Government Regulation Government Regulation No 17 of 2025 on the Govern - ance of Child Protection in the Operation of Electronic Systems focuses on mitigating the negative impacts of the digital space for children (“GR 17/2025”). Under GR 17/2025, “children” is defined as anyone under 18 years old. GR 17/2025 outlines the responsibilities of ESOs in managing online products, services, or features, overseeing child protection governance in electronic systems, and enforcing administrative sanctions. It applies to ESOs that develop or operate internet- connected products, services, or features, such as websites, mobile apps, social media platforms, or gaming services. Regarding children’s personal data protection, GR 17/2025 addresses the following. DPIA for children ESOs must conduct a DPIA for any online product, service, or feature accessible to children before it is used by them. The DPIA should cover the processing activities, the provider’s interests, the necessity and proportionality of the processing, a risk assessment for children’s protection, and risk mitigation meas - ures. Additionally, the ESO must maintain the DPIA documentation for as long as the product, service, or feature remains accessible to children, and include a plan to address identified risks before marketing the product. Obligation to protect children’s personal data ESOs must provide clear information on minimum age requirements and implement technical and operation - al measures to ensure appropriate age verification for children using online products, services, or features, and establish reporting mechanisms to challenge or
176 CHAMBERS.COM
Powered by FlippingBook