CLIENT UPDATE
Indonesia’s personal data protection law has finally been passed: What is new?
PUBLISHED DATE
SEP 06, 2022
%2520(8).webp&w=3840&q=75)
CONTENT
- No sections yet
Key Provisions | OLD (Government Regulation No.71 of 2019 (GR 71) and Minister of Communication and Informatics Regulation 20 of 2016 (MoCI Reg 20)) | NEW (Personal Data Protection Law) (Note: Although the bill was passed into law by the House of Representatives and the Government on 20 September 2022, it is not yet effective as it is waiting to be published in the State Gazette, in practice, within one to two weeks. In this update, we use the latest published draft of the PDP Law) |
|---|---|---|
Legal Basis to collect/process personal data | Written consent provided in the Indonesian language or bilingually | 6 legal bases: (i) express consent from the data owner; (ii) obligations under contracts in which the data owner is the party; (iii) legal obligations of the data owner under the applicable regulations; (iv) protection of the data owner's vital interest; (v) duties in the interest of public service or implementation of the authority of the data controller based on the applicable law; and (vi) other legitimate reasons. |
Definition of personal data | Any data about an individual either identified and/or can be identified separately or combined with other information either directly or indirectly through the electronic system | Data on an identified individual, or is capable of, separately or in combination with other information, directly or indirectly, identifying an individual through an electronic or non-electronic system |
Types of personal data | Silent |
|
Notification in the event of breach | Notification to the affected individuals no later than 14 days after the discovery of such incident, and to the government if it has a "serious impact". | Notification to the affected individuals and the government within 3 days whether the breach has a "serious impact" or not. In certain circumstances, the public must also be informed of the breach. |
Offshore data transfer | Must submit certain reports to the Ministry of Communication and Informatics if the personal data is initially collected by an Indonesian company | Allows data transfers out of Indonesia provided that the countries where the data recipient is domiciled is offering adequate or higher protection for personal data than that stipulated under the PDP Bill. |
Penalties | Administrative sanction in the form of written warning, administrative fines, temporary suspension, access termination, and/or removal from list | Criminal penalties and administrative sanctions (written warnings, temporary suspension of personal data processing, deletion, or destruction of personal data, and/or administrative fines). However, note that administrative fines are now calculated based on 2% of the annual revenue or receipt. |
Disclaimer: This client update has been prepared based on the latest published draft of Personal Data Protection Law (21 September 2022) and, therefore, may have some discrepancies with the final version of the Personal Data Protection Law as published in the State Gazette (not yet available-we expect that the law will be published in the State Gazette and officially effective within one or two weeks after being passed on 20 September 2022). However, as the law was passed into law on 20 September 2022 by the House of Representatives and the Government, we expect that any changes to the current draft should be minor changes.
This update is solely for the purpose of providing a brief update on the regulations. Therefore, this client update does not contain any explanation or analysis about the implementation of the regulations and should not be taken to constitute legal advice.
For any follow-up queries on this client update, please contact us referring to: Data Protection – Personal Data Protection Law.
