Indonesia's privacy law is primarily governed by Law No. 27 of 2022 on Personal Data Protection (PDP Law), which is the first comprehensive data protection framework in the country. Here are the key points:
Core Principles
The PDP Law establishes principles including limited and specific collection, transparency, purpose limitation, and strict security protection . Personal data is classified into general (e.g., name, gender) and specific/sensitive categories (e.g., health, biometric, genetic, criminal records) .
Data Subject Rights
Individuals have rights including: access to their data, correction, deletion ("right to be forgotten"), restriction of processing, withdrawal of consent, data portability, and to object to automated decisions .
Legal Basis for Processing
Processing must have a valid legal basis: explicit consent, contractual necessity, legal obligation, vital interests, public interest, or legitimate interest . Consent must be specific, unambiguous, and freely withdrawable.
Breach Notification
Controllers must notify both affected data subjects and the Data Protection Authority within 72 hours of establishing a personal data protection failure . Notification must include what data was breached, when/how it occurred, and remediation efforts .
Cross-Border Transfers
Transfers are permitted if the receiving country has equivalent/higher protection, or if adequate binding safeguards exist, or with data subject consent .
Key Obligations
Organizations must: maintain processing records, conduct Data Protection Impact Assessments (DPIA) for high-risk processing, appoint a Data Protection Officer (DPO) under certain conditions, and implement security measures .
Important Updates
Government Regulation No. 33 of 2026 (GR 33/2026) clarifies operational requirements and takes effect January 16, 2027. It details breach notification procedures, DPIA requirements, cross-border transfer mechanisms, and administrative fines up to 2% of annual revenue .
A recent Constitutional Court ruling (151/PUU-XXII/2024) clarified that DPO appointment criteria under Article 53 are alternative (and/or), not cumulative .
Comments
Post a Comment