Indonesia's Regulatory Landscape at a Glance
Indonesia's framework rests on Law No. 27 of 2022, which draws heavily on the GDPR in structure while adding criminal liability. Earlier electronic systems regulation continues to apply alongside it, and sectoral requirements in financial services and health sit on top. Implementing regulation and the institutional arrangements for supervision have developed more slowly than the statute itself.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and regulatory status.
- Jurisdiction
- Indonesia
- Primary data protection framework
- Law No. 27 of 2022 on Personal Data Protection (PDP Law)
- Transition period
- Two years from October 2022, ending October 2024
Key Regulations in Indonesia
Law No. 27 of 2022 (PDP Law)
The PDP Law was enacted on 17 October 2022 and applies to any person, public body, or international organisation processing personal data. Its territorial scope extends beyond Indonesia to processing outside the country that has legal consequences within Indonesia or for Indonesian data subjects outside it.
It distinguishes general personal data from specific personal data, the latter covering health, biometric, genetic, criminal records, children's data, personal financial data, and other categories defined by law.
Depending on applicability, organisations may need to address:
- A lawful basis for processing, including consent and legitimate interests.
- Explicit consent for specific personal data.
- Notice given to data subjects before processing.
- Appointment of a data protection officer where the criteria apply.
- Data protection impact assessments for high-risk processing.
- Records of processing activities.
- Breach notification to the authority and data subjects.
- Conditions for transferring personal data outside Indonesia.
Unlike PIPL and several regional regimes, the Indonesian Law does include a legitimate interests basis, which gives more flexibility than its neighbours.
Lawful Bases and Consent
The PDP Law sets out several lawful bases: consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a public duty or public interest, and the legitimate interests of the controller.
Where consent is relied upon it must be valid, explicit, and recorded, and the data subject must be informed of the purposes, the types of data, the retention period, and their rights. Specific personal data requires explicit consent.
Organisations assessing lawful bases may need to consider:
- Whether an alternative basis is available before defaulting to consent.
- Explicit consent requirements for specific personal data.
- Separate consent where processing purposes differ.
- Recording of consent so it can be evidenced.
- Parental consent for children's data and arrangements for persons with disabilities.
The Law expressly addresses the processing of children's data and the data of persons with disabilities, which several regional regimes do not.
Data Protection Officer
Controllers and processors must appoint a data protection officer where processing is for public service purposes, where the core activities require regular and systematic large-scale monitoring, or where processing involves specific personal data or data relating to criminal offences on a large scale.
The officer must be appointed on the basis of professional expertise and knowledge of data protection, and must be able to act independently and report to the highest level of management.
Organisations assessing the requirement may need to consider:
- Whether their core activities involve regular systematic large-scale monitoring.
- Whether specific personal data is processed on a large scale.
- The officer's required expertise and independence.
- The reporting line to senior management.
- Whether the role may be shared across group entities.
The criteria closely track GDPR Article 37, so an existing GDPR analysis is a reasonable starting point for the Indonesian assessment.
Breach Notification
Where a failure to protect personal data occurs, the controller must provide written notification to the affected data subjects and to the supervisory authority within three times twenty-four hours, that is seventy-two hours, of becoming aware of it.
The notification must set out the personal data disclosed, when and how the disclosure occurred, and the handling and recovery efforts undertaken. In certain cases the controller must also inform the public.
Organisations responding to an incident may need to consider:
- The seventy-two hour period for notifying both the authority and data subjects.
- The prescribed content of the notification.
- When public announcement is additionally required.
- The channel for notification given the institutional arrangements for supervision.
- Documentation of the assessment and response.
Notification to data subjects runs on the same seventy-two hour clock as notification to the authority, rather than on a separate high-risk trigger.
International Transfers
Transferring personal data outside Indonesia is permitted where the destination country has a level of personal data protection equal to or higher than the PDP Law. Where it does not, adequate and binding safeguards must be in place, and failing that, the data subject's consent is required.
The Law establishes this as a tiered test rather than a single mechanism, and the practical application of the first limb depends on how the supervisory arrangements treat assessments of destination countries.
Organisations transferring data out of Indonesia may need to consider:
- Whether the destination is assessed as providing an equal or higher level of protection.
- Binding safeguards where it is not, such as contractual commitments.
- Consent as the fallback basis and whether it is realistic.
- Documentation of the assessment undertaken.
- Onward transfers by the recipient.
Indonesia has not published an adequacy list in the manner of the European Commission, so the first limb generally requires the controller's own documented assessment.
Supervision and Implementing Regulation
The PDP Law contemplates a supervisory body established by and reporting to the President, with implementing regulation to set out its structure and powers. The establishment of that institution and the issuance of implementing regulation have proceeded more slowly than the statutory timetable suggested, and in the interim the ministry responsible for communications and digital affairs has handled data protection matters.
Organisations should establish, from official sources:
- Whether the dedicated supervisory authority has been established and is operational.
- Which body currently receives breach notifications and complaints.
- What implementing regulation has been issued and what it covers.
- How administrative sanctions are being applied in practice.
- Any registration or filing requirements introduced by regulation.
This is the most verification-sensitive aspect of Indonesian compliance. The substantive obligations are in force regardless, but the institutional position should be confirmed before assuming how a notification or complaint will be handled.
Who Needs to Comply With Indonesian Data Protection Law?
The PDP Law may apply to:
Organisations in Indonesia
Any person, public body, or international organisation processing personal data within Indonesian jurisdiction.
International companies
Organisations processing personal data outside Indonesia where the processing has legal consequences in Indonesia or for Indonesian data subjects.
Controllers and processors
Both roles carry distinct obligations under the Law, with processors acting only on the controller's instructions.
Organisations needing a DPO
Entities whose core activities involve large-scale systematic monitoring or large-scale processing of specific personal data.
Employers
Organisations handling employee and candidate data, including health and biometric data treated as specific personal data.
Electronic system operators
Providers registered under Indonesian electronic systems regulation, which carries its own obligations alongside the PDP Law.
The precise obligations depend on the organisation's role, processing activities, size, risk profile, and territorial scope.
Understanding Your Obligations Under the PDP Law
Lawful Basis and Notice
Processing requires one of the lawful bases in the Law. Before processing, data subjects must be informed of the lawful basis, the purposes, the types of personal data, the retention period, details of the parties receiving the data, their rights, and the period of processing.
Specific personal data requires explicit consent unless another basis in the Law clearly applies.
Accountability and Records
Controllers must keep records of processing activities, demonstrate that processing is carried out in accordance with the Law, and implement technical and organisational measures. Processing must be accurate, complete, and not misleading, and updated where necessary.
Impact Assessments
A data protection impact assessment must be carried out where processing presents a high potential risk to data subjects, including automated decision-making with legal consequences, processing of specific personal data, large-scale processing, systematic evaluation, and processing that restricts the exercise of rights.
Data Protection Officer
Where the statutory criteria apply, a data protection officer must be appointed on the basis of professional expertise, able to act independently and report to the highest level of management, and tasked with advising, monitoring compliance, and acting as a contact point.
Breach Notification
A failure to protect personal data must be notified in writing to the affected data subjects and to the supervisory authority within seventy-two hours, setting out the data disclosed, the circumstances, and the handling and recovery measures taken.
Confirm the current notification channel, as it depends on the institutional arrangements in place.
Retention, Deletion and Transfers
Personal data must be deleted or destroyed when the retention period ends, the purpose is fulfilled, or the data subject makes a valid request, subject to legal exceptions. Transfers abroad require the tiered test of equivalent protection, binding safeguards, or consent.
Data Subject Rights Under the PDP Law
The PDP Law gives data subjects a number of rights over their personal data. Depending on the circumstances, these may include:
Right to Information
Data subjects may obtain information about the identity of the controller, the lawful basis, the purposes, and the accountability of parties processing their data.
Access and Copy
Data subjects may access and obtain a copy of their personal data in accordance with the provisions of the Law.
Correction and Completion
Data subjects may complete, update, or correct inaccuracies in their personal data.
Deletion and Destruction
Data subjects may request the termination of processing, deletion, or destruction of their personal data, subject to statutory exceptions.
Withdrawal and Objection
Data subjects may withdraw consent, object to automated decision-making, and restrict processing in defined circumstances.
Portability and Compensation
Data subjects may obtain and transmit their personal data to another controller, and may sue for and receive compensation for violations.
The Law provides exceptions to several rights, including for national security, criminal proceedings, supervision of the financial sector, and statistical and research purposes.
Indonesia's Regulatory Timeline
Indonesia moved from sectoral regulation to a comprehensive statute in 2022.
- 2016 onwards
Electronic Systems Regulation
Personal data protection was addressed through electronic information and transactions law and ministerial regulation before a dedicated statute existed.
- October 2022
PDP Law Enacted
Law No. 27 of 2022 was enacted on 17 October 2022, introducing a comprehensive GDPR-influenced framework with a two-year transition.
- October 2024
Transition Period Ends
The two-year transition expired, from which point controllers and processors were expected to comply in full.
- 2024 onwards
Institutional Arrangements Developing
Establishment of the dedicated supervisory authority and issuance of implementing regulation have progressed more slowly than the statutory timetable indicated.
Important: the substantive obligations are in force, but the supervisory institution and implementing regulation should be confirmed from official sources, as the practical compliance route depends on them.
Data Protection Authorities in Indonesia
The PDP Law provides for a supervisory body established by and accountable to the President, with functions including issuing guidance, supervising compliance, handling complaints and breach notifications, and imposing administrative sanctions. The establishment of that institution and the regulation defining its powers have taken longer than the statute anticipated.
In the interim, data protection matters have been handled by the ministry responsible for communications and digital affairs, which also administers electronic system operator registration. Sectoral regulators remain relevant, including the financial services authority and the central bank for financial institutions, and the health ministry for health data.
Because the institutional position has been in flux, confirm which body currently receives notifications and complaints before an incident occurs rather than during one.
Penalties for Non-Compliance
The PDP Law provides administrative sanctions comprising written warnings, temporary suspension of processing activities, deletion or destruction of personal data, and administrative fines of up to 2% of annual revenue or annual receipts in respect of the violation. These are imposed by the supervisory authority, and the practical application of the fine power depends on the institutional arrangements in place.
Unusually among GDPR-influenced statutes, the Law also creates criminal offences. These cover unlawfully obtaining or collecting personal data, unlawfully disclosing personal data, and unlawfully using personal data, as well as falsifying personal data, with penalties of imprisonment and substantial fines. Corporations may be sanctioned, with additional penalties including asset confiscation and suspension or dissolution, and directors may face liability.
How RegulatoryBridge Supports Compliance in Indonesia
RegulatoryBridge helps organisations assess Indonesia's regulatory requirements and coordinate their compliance activities with wider international programmes.
PDP Law Compliance Assessment
Review your processing activities, legal bases, notices, policies, governance arrangements, and operational controls to identify potential gaps.
Data Protection Officer and Governance Assessment
Review whether your processing triggers the obligation to appoint a data protection officer, and the policies, records, and impact assessments the Law expects.
Data Subject Rights
Review request-handling processes, response timelines, privacy notices, and related documentation against the requirements applicable to you.
Breach Response and supervisory authority Notification
Evaluate breach assessment procedures, escalation responsibilities, supervisory authority notification readiness, and coordination between privacy, security, and legal teams.
International Data Transfers
Assess transfers out of Indonesia against the adequacy, safeguards, and consent routes in the Law, and the documentation each requires.
Sectoral Compliance Coordination
Help organise requirements across the PDP Law, electronic systems regulation, financial sector rules, and health sector requirements.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, supervisory authority guidance, or enforcement decisions change.
The scope of support is tailored to the organisation's activities, risk profile, and applicable legal requirements.
Our Approach to Indonesia Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to Indonesia.
- 02
Map Regulatory Obligations
Identify applicable provisions, relevant authorities, effective dates, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions About Indonesia Compliance
Need Indonesian PDP Law support?
We support your data protection officer arrangements, impact assessments, and breach notification readiness - so your global product team doesn't have to.