Indonesia’s Data Protection Law is now official!

Overview

Following our recent client update (see here) in which we gave a short introduction to the newly approved personal data protection law, Law No.27 of 2022 on Protection of Personal Data (PDP Law) finally came into force on 17 October 2022.

The PDP Law does not revoke the provisions of any earlier laws or regulations that govern personal data protection. However, if any such provisions are inconsistent with the PDP Law, the PDP Law provisions will prevail.

PDP Law key provisions

We set out below some key provisions to assist your understanding of the new PDP Law regime.

1.Main definiton

Personal data

The PDP Law defines personal data as “data concerning individuals who are directly or indirectly identified or identifiable separately or when combined with other information, through an electronic or non-electronic system”. Personal data is now divided into two specific categories: specific personal data; and general personal data, the main characteristics of which are described in the table below

The PDP Law requires a data controller (as defined below) to carry out an additional “risk assessment” if it processes specific personal data. Unfortunately, the PDP Law does not yet regulate how to carry out such risk assessments or state whether there will be any penalties for non-compliance. The PDP Law merely states that these matters will be further regulated under a future Government Regulation. Apart from the (currently unregulated) risk assessment requirement for specific personal data, the PDP Law does not explain the differences in practical application between the two specific personal data categories.

Data controllers and data processors

The PDP Law differentiates between data controllers and data processors in the following manner.

Data subject

The PDP Law defines a “data subject” as an individual who is associated with particular personal data. Importantly, the PDP law will have extra-territorial reach outside of Indonesia if there will be legal consequences: (a) within Indonesia; and/or (b) for data subjects of Indonesian citizenship outside Indonesia.

2.Data subjects’ rights

Data subjects are granted many rights under the PDP Law in relation to their personal data, which are explained in considerable detail. Such rights include the right to information, rectification, access, erasure, withdraw consent, not to be subject to a decision based solely on automated processing, compensation and data portability. To exercise the above rights, data subjects are required to apply either electronically or non-electronically to the data controller.

3.Basis of data processing

The PDP Law provides the following six legal bases that can be used for collecting and processing personal data:

1. 1. with the express consent from the data subject;
   2. in accordance with contractual obligations under a contract to which the data subject is a party;
   3. in accordance with legal obligations of the data subject under applicable law;
   4. to protect the data subject’s vital interests;
   5. to comply with duties in the interest of public service or the implementation of a data controller’s authority/instruction, as required under applicable law; and
   6. with other legitimate reasons.

4. Data controllers’ and data processors’ obligations

Data controllers

The PDP Law extensively regulates data controllers’ obligations by providing 20 separate obligations. Highlighting some examples of these obligations, data controllers must:

1. 1. (if personal data processing is based on consent), give the data subject information on: (1) the legality of the relevant personal data to be processed; (2) the purpose of the personal data processing; (3) the type and relevance of the personal data to be processed; (4) the retention period of documents containing personal data; (5) the details of the collected personal data; (6) the period of personal data processing; and (7) the rights of the data subject;
   2. verify the personal data to ensure its accuracy, completeness and consistency;
   3. record all personal data processing activities;
   4. update and/or correct errors and/or inaccuracies in personal data and subsequently notify the data subject of the update;
   5. give the data subject access to the processed personal data together with the background to the personal data;
   6. assess the impact of personal data protection where the personal data processing has the potential to be of “high risk” to the data subject, according to various regulated parameters;
   7. protect and ensure the security of the processed personal data by taking various regulated measures;
   8. maintain confidentiality, prevent any illegal and unauthorised access, and supervise each party involved in personal data processing;
   9. stop personal data processing if the data subject withdraws consent to personal data processing;
   10. delete personal data and notify the data subject of such deletion (under various regulated circumstances);
   11. notify the data subject (in writing) within three days of a failure to protect a data subject’s personal data, and to also notify the relevant agency (yet to be established by the president); and
   12. notify the data subject of the transfer of personal data, when a data controller carries out a merger, spin-off, acquisition, consolidation, or dissolution.

Data processors

1. 1. If a data controller appoints a data processor, the data processor must process personal data based on the personal data controller’s instructions and the PDP Law, and also obtain the data subject’s written approval before involving other data processors.
   2. Certain data controller obligations (for example, points (b), (c) and (h) in the section on data controllers’ obligations above) will be applicable to data processors.

5.Data protection officers

The PDP Law introduces the obligation for both data controllers and data processors to appoint an official or officer (DPO) to be responsible for ensuring compliance with personal data protection principles and mitigating personal data breach risks under various regulated circumstances.

6.Cross-border transfer of personal data

For a data controller to transfer personal data abroad (whether to other data controllers or processors), the transferring data controller must ensure that the data recipient’s country has a personal data protection level to or higher than that regulated under the PDP Law. Otherwise, the data controller is required to ensure that there is adequate and binding personal data protection. Since the PDP Law does not revoke any earlier regulations, it is likely that data controllers must still report pre- and post-offshore data transfers to the Ministry of Communications and Information Technology.

7.Penalties

Depending on the violation, the PDP Law provides a variety of civil and criminal penalties that can be imposed on the violating party (e.g. data controller or data processor).

Conclusion

The PDP Law introduces some new concepts for personal data protection in Indonesia (including the distinction between data controllers and data processors as well as their respective obligations, additional legal bases for data processing, and the mandatory appointment of data processing officers). All regulations on personal data protection that were in force before the PDP Law remain in force unless they contradict the PDP Law. Finally, there is a sting in the tail for those data controllers and data processers who violate the PDP Law, with an extensive range of potential civil and criminal penalties.

We will continue to monitor developments in the data protection regulatory space and will report on them as and when they arise. If you have any questions on the PDP Law, please get in touch with us.