Data & Privasi: Indonesia (2026)
Indonesia has a comprehensive, GDPR-inspired personal data protection regime under Law No. 27 of 2022, which took effect on 17 October 2022 with a two-year transition period that expired on 17 October 2024. Government Regulation No. 33 of 2026, issued on 16 July 2026 and taking effect 16 January 2027, provides detailed implementing rules on data subject rights, controller/processor obligations, DPIAs, DPOs, breach notification, cross-border transfers and sanctions. The dedicated independent Personal Data Protection Authority (Lembaga PDP) mandated by the law has not yet been formally established; supervision and enforcement are handled on an interim basis by the Ministry of Communication and Digital Affairs (Komdigi).
Kerangka kerja utama
Law No. 27 of 2022 on Personal Data Protection (PDP Law), as amended by Law No. 1 of 2026, with Government Regulation No. 33 of 2026 as the primary implementing regulation.
Poin utama
Primary law and scope
Law No. 27 of 2022 (UU PDP) applies to public and private controllers/processors handling personal data of persons in Indonesia, and extraterritorially where processing has legal effects in Indonesia. It distinguishes general and specific (sensitive) personal data and establishes a rights-based framework across electronic and non-electronic systems.
Implementing regulation (GR 33/2026)
Government Regulation No. 33 of 2026, enacted 16 July 2026 and effective 16 January 2027, elaborates data subject rights, controller/processor obligations, DPO appointment, DPIAs, breach notification, cross-border transfer mechanisms, compensation claims and administrative sanctions.
Supervisory authority
The PDP Law mandates an independent Personal Data Protection Authority (Lembaga PDP) reporting to the President, but it has not yet been formally established. In the interim, the Ministry of Communication and Digital Affairs (Komdigi), through its Directorate General of Digital Space Supervision, exercises supervisory and enforcement functions; a Presidential Regulation to formally establish the DPA is being finalized.
Data subject rights
Data subjects are granted GDPR-style rights, including access, correction, deletion/erasure, withdrawal of consent, objection to automated decision-making, restriction of processing, data portability/interoperability, and compensation for damages arising from violations.
Cross-border transfer requirements
Transfers of personal data outside Indonesia are permitted only if the recipient country provides a level of protection equal to or higher than the PDP Law, or, failing that, if there is adequate and binding protection (e.g., standard contractual clauses, binding corporate rules) or the data subject's explicit consent.
Sanctions and penalties
Administrative sanctions include written warnings, temporary suspension, data erasure orders and administrative fines of up to 2% of a controller's/processor's annual revenue. Criminal penalties for offences such as unlawful collection, disclosure or use of personal data include imprisonment of up to 6 years and fines up to IDR 6 billion for individuals; corporations face fines multiplied up to IDR 210 billion (approx. US$14 million) plus profit confiscation, asset freezes or business closure.
Halaman ini merupakan terjemahan untuk kemudahan pembaca; versi bahasa Inggrisnya yang menjadi acuan resmi dan bukan merupakan nasihat hukum.