INDONESIA Trends and Developments Contributed by: Agus Ahadi Deradjat, Mahiswara Timur, Nina Cornelia Santoso and Dhan Partap Kaur, ABNR Counsellors at Law
adjust age verification decisions and address misuse of such online products, services, or features that vio - late or may violate children’s rights. These measures should align with specified risks and protect children’s personal data, secure electronic systems, and pre - vent unauthorised breaches. Data collected for age verification should only be used for that purpose and deleted once the age requirement is met. ESOs must also ensure that parental/guardian consent has been obtained for all processing of children’s data. There are no exceptions to the requirement to obtain paren - tal or guardian consent for the use of children’s per - sonal data. Additionally, ESOs are prohibited from using children’s personal data in ways that could harm their physical, mental, or overall well-being, and from developing products that encourage excessive data collection. Data should only be processed if necessary for the service, unless there is a strong reason in the child’s best interest. Providers are also banned from using children’s data for other purposes without justifiable cause. Lastly, ESOs must appoint a DPO to oversee compliance with child data protection laws and regu - lations. The MOCD also passed MOCD Regulation No 9 of 2026 on 6 March 2026 on the Implementation of GR 17/2025. Through the MOCD Reg. 9/2026 press release, the MOCD stated that children under the age of 16 are no longer eligible to create accounts on high- risk platforms as of 28 March 2026. Implementation will be conducted in a gradual manner, starting with platforms such as YouTube, TikTok, Facebook, Insta - gram, Threads, X, Bigo Live, and Roblox. Furthermore, there are additional key points as fol - lows: • Self-Assessment of Age Categories: ESOs are to conduct a mandatory self-assessment to ensure that the products, services, and features developed and/or operated by the ESO are in accordance with the minimum age limit of children and the applica - ble child age group classifications. • Child Protection Design: ESOs are required to have and implement a child protection design to ensure that content accessible to children in the products,
services, and features complies with the minimum age limit for children and the age group classifica - tions of children and does not conflict with laws and regulations. • Risk Profile Classification and Mitigation: MOCD Re. 9/2026 introduces the minimum indicators of risk profile categories, and ESOs’ obligation to implement mitigation in relation to the risks. Roles of DPOs in Indonesia The PDP Law mandates that both data controllers and processors appoint an officer or staff member to oversee personal data protection functions and ensure compliance with regulations. Since the law’s enactment, the number of DPOs in Indonesia has increased, along with the formation of DPO associa - tions. To standardise DPO competencies, the Min - ister of Manpower issued Decree No 103 of 2023, setting National Competency Standards for Personal Data Protection. These standards guide authorities in developing qualifications, training, and certification for DPOs. However, there is no requirement to register DPOs with authorities. The government is also actively making efforts to conduct occupational mapping in the information and communication technology field (which encompass - es functional areas such as IT governance (including DPOs and Data Protection Executives)), digital prod - uct development, etc) through Decree of the Head of the Communication and Digital Human Resources Development Agency of MOCD No 8 of 2025 on the National Occupational Map, as amended by Decree No 45 of 2025. The decree details qualifications, scope of work, tasks and authorities, and is intended to ensure the equal spread of occupation in personal data protection in each functional area. Suggested approach to establish compliance in Indonesia Business undertakings should adopt a risk-based approach, which involves identifying, assessing, and managing potential risks associated with personal data processing. Rather than treating all risks equally, businesses should allocate resources to areas that present the greatest threat to data security and pri - vacy, ensuring efforts are proportionate to the risks
177 CHAMBERS.COM
Powered by FlippingBook