The enactment of Law No. 27 of 2022 regarding Personal Data Protection (the “PDP Law”) on 17 October 2022 has effectively set new standards on how personal data should be treated in Indonesia. The PDP Law is lauded as one of the most expected laws to be passed this year, taking into account that it has been discussed since 2012.

Along with the numerous introductions of new provisions, the PDP Law provides a transition period of 2 years for existing business to adjust their data processing activities to be in line with the new regulation. In the near future, the impact of PDP Law is expected to modernize the data protection landscape of Indonesia

The Big Update

The PDP Law finally draw a clear differentiation between data controllers and data processors, separating each of their obligations. The PDP Law also recognizes new basis for processing personal data, and data controllers no longer have to rely on explicit consent from the data subjects, as opposed to the previous regime where explicit consent is the only lawful basis to collect and process personal data.

In addition, new limitations have also been introduced, including co-processing of personal data, collection and processing personal data of the disabled, data protection officer, automated data processing, audio-visual data processing (such as CCTV recording) and notification on certain corporate actions, amongst others.

The PDP Law also introduces various new sanctions that can be imposed to data controllers with the aim to regulate a stricter policy to protect the now vulnerable personal data in Indonesia.

What Lies Ahead?

The next 2 years of transition period will surely be busy, as many businesses will need to adjust their policies to comply with the new PDP Law. Some industries will also need to adjust, as more and more sector specific regulations are being formulated, including the recently issued regulation covering health-related data.

Another thing to watch is the establishment of a new independent authority which will oversee data protection matters. After long going debates on which authority will oversee data protection matters, it seems that the government and the parliament finally reached a compromise: to establish a body through a presidential regulation. It remains to be seen on how the president will formulate this new body, but it is surely important to look forward to, considering the importance of data in everyday activities.

If you are interested to learn more about how this new PDP Law will impact you, please do not hesitate to contact us.