The long-awaited Personal Data Protection Bill was finally passed by the Indonesian legislative on 20 September 2022 after initiating the prioritised legislative program three years ago. This legislative milestone would make it the first law to set comprehensive rules regarding personal data protection. The finalized bill is still due for approval from the President before it is enacted as law

1. AHRP Legal Alert Page 1 of 6
Legal Alert September 2022
Indonesian Legislatives Passes Personal Data
Protection Bill
I. Introduction
On 20 September 2022, the People's Representative Council/Dewan Perwakilan
Rakyat (“DPR”) finalised the Personal Data Protection Bill after years of
comprehensive deliberation. The goal to enact a law on data protection was
initiated in 2019 when it was included in the national’s prioritised legislative
program/program legislatif nasional and had been subject to many academic and
political debates.
The passing of the Personal Data Protection Bill still requires approval from the
President, despite, in the absence of such, it will automatically pass on as a new
law (“PDP Law”). The new PDP Law would be the first legislature to regulate how
personal data is to be treated intended to protect data owners. The enactment also
coincides with the arising of personal data breach cases in recent times that
strongly urged the government to pass the bill.
The PDP Law covers a broad aspect of rules, including (i) the extraterritoriality of
the PDP Law, (ii) the rights and obligations of the data subjects, (iii) data
processing, (iv) regulators, and (v) prohibitions, sanctions, and dispute resolutions,
and (vi) the transition period – all of which shall be elaborated further below.
II. Jurisdictional Aspect
The PDP Law exerts an extraterritorial jurisdiction that allows it to be enforced
domestically and beyond the Indonesian territory. The scope is regulated under
Article 2 (1) of the PDP Law, which mentions its applicability for any legal acts
committed in Indonesia, including other acts with legal effects felt in Indonesia
and/or by Indonesian personal data subjects abroad. Unfortunately, the law is
unclear in defining what constitutes a ‘legal effect’ in that regard.
The extraterritorial nature is not entirely new in the Indonesian legal system. The
same approach can be tracked back in Law Number 21 of 2008 on Electronic
Information and Transactions as amended by Law Number 19 of 2016 (“ITE Law”).
It is regulated that the ITE Law also applies to persons within and outside the
Indonesian jurisdiction who commit legal acts that result in legal consequences
that are ‘detrimental to Indonesia’s interest’ felt in Indonesia and overseas.1
Unlike the PDP Law, Article 2 of the ITE Law defines in its elucidation the phrase
‘detrimental to Indonesia’s interest’ as situations that jeopardise national economic
interests, strategic data protection, the dignity of the nation, state defence and
security, state sovereignty, citizens, as well as Indonesian legal entities.2
1
Article 2 ITE Law.
2
Elucidation of Article 2 ITE Law.
The long-awaited
Personal Data Protection
Bill was finally passed by
the Indonesian legislative
on 20 September 2022
after initiating the
prioritised legislative
program three years ago.
This legislative milestone
would make it the first law
to set comprehensive
rules regarding personal
data protection. The
finalised bill is still due for
approval from the
President before it is
enacted as law.

2. AHRP Legal Alert Page 2 of 6
Contrarily, a similar phrase is not found in the PDP Law – instead, it mentions the
‘legal effect’ in the broadest sense; thus, it can be expected that the derived
regulations following the PDP Law enactment may provide clarity on how such
effects are to be determined.
Subject-wise, although the protection applies to Indonesian nationals with due
regard to the extraterritorial jurisdiction, Article 2 (2) of the PDP Law regulates a
limitation to the law’s applicability that exempts personal data processing by
individuals for personal or household activity.
III. Regulations Introduced in the PDP Law
The PDP Law is intended to safeguard people’s rights through implementing
personal data protection and introducing public awareness of such importance,3
where a set of rules is needed to outline how personal data protection must be
carried out.4 Insofar, once enacted, the PDP Law will cover the following areas:
A. General Provisions and Tax Procedures
Personal Data is defined as the data of individuals that have been identified or is
identifiable separately or in combination with other information, either directly or
indirectly through an electronic or non-electronic system.5 The PDP Law classifies
personal data into 2 (two) categorisations, as follows:6
1. General personal data, such as full name, gender, citizenship, religion,
marital status, and/or a combination of personal data to identify a
person;7 and
2. Specific personal data, such as medical records, biometrics, genetic
data, criminal records, children’s data, personal financials, and/or other
data is considered by law.
Under the PDP Law, personal data protection materialises the government's effort
to guarantee the constitutional rights of personal data subjects8 with which the
personal data are associated.9 Some rights of data subjects are acknowledged
and regulated in the PDP Law comprise the right to obtain information,10 to
3
Point b Consideration of PDP Law.
4
Point c Consideration of PDP Law.
5
Article 1 (1) PDP Law.
6
Article 4 (1) PDP Law.
7
Article 4 (3) PDP Law.
8
Article 1 (2) PDP Law.
9
Article 1 (6) PDP Law.
10
Article 5 PDP Law.

3. AHRP Legal Alert Page 3 of 6
complete and renew or revise their data,11 to be granted access to a copy of their
data,12 as well as to end or terminate personal data.13
Similar to other derogable rights, some data protection rights are also derogable
for the state’s interest. Article 15 (1) of the PDP Law enlists these interests for: (i)
national defence and security; (ii) law enforcement process; (iii) public interest; (iv)
for supervisory purposes in the financial services sector, monetary, payment
system, and financial system stability; or (v) statistics and scientific research.14
B. Personal Data Processing
Personal data processing consists of (i) acquisition, and collection; (ii) filtering and
analysis; (iii) storage; (iv) fixes and updates; (v) display, announcement, transfer,
dissemination, or disclosure; and/or (vi) deletion or destruction,15 and is carried out
by the Personal Data Controller and Personal Data Processor.
B.1. Identification Number as the Taxpayer Number
Data processing is carried out by at least 2 (two) Personal Data
Controllers,16 which can be either a person, public entity, or
international organisation that acts individually or collectively in
processing personal data.17 A Personal Data Controller determines
the purpose(s) and exercises control over the data processing
stage.18 They must fulfil several personal data processing bases, one
of which being explicit valid consent from the personal data subject
for 1 (one) or several specific purposes. 19
Furthermore, Personal Data Controller must process personal data in
a limited and specific manner, lawfully, and transparently for the
personal data processing.20 The role also mandates them to protect
and ensure the security of the personal data that they process by:21
a. preparing and implementing technical operational measures to
prevent disruption during the processing stage that infringes the
law; and
b. determining the security level by ensuring the nature and risk for
the protected data.
11
Article 6 PDP Law.
12
Article 7 PDP Law.
13
Article 8 PDP Law.
14
Article 15 (1) PDP Law.
15
Article 16 (1) PDP Law.
16
Article 18 (1) PDP Law.
17
Article 1 (4) jo. Article 19 PDP Law.
18
Article 1 (4) PDP Law.
19
Article 20 PDP Law.
20
Article 27 and Article 28 PDP Law.
21
Article 35 PDP Law.

4. AHRP Legal Alert Page 4 of 6
Every data processing procedure must be carried out with due regard
to confidentiality and a level of oversight by the Personal Data
Controller.22
B.2. Personal Data Processor
Personal Data Processor is a role given to any person, public entity,
or international organisation that processes data on behalf of the
Personal Data Controller.23 When appointed, Personal Data
Processor assumes the same role in carrying out personal data
processing as the Personal Data Controller instructed.24 Should a
Personal Data Controller performs personal data processing without
order or according to the purpose(s) as instructed, they are subject
to individual responsibility.25
Personal data transfer is permissible when it is done to (i) other Personal Data
Controllers within the Indonesian jurisdiction; and (ii) to other controllers and/or
processors outside of Indonesia26 so long as it upholds the principles applicable to
data processing.27 One safety net imposed in the PDP Law for data transferring
overseas is regulated under Article 56 (2) of the PDP Law that the recipient country
must enforce an equal or stricter personal data protection level from that covered
in the PDP Law.28
C. Data Regulators
Aligned with the intention to establish a proper personal data protection
mechanism following the PDP Law enactment, the President shall establish
an institution29 to carry out the following responsibilities:30 (i) formulating and
stipulating policies and strategies; (ii) supervising; (iii) enforcing; and (iv)
facilitating alternative dispute resolutions in relation to the enforcement of
the PDP Law.
The PDP Law has yet elaborated such institution structure, management,
and specific functions, which can be assumed to be an aspect regulated and
materialised in the forthcoming regulations following the PDP Law
enactment.
D. Prohibitions, Sanctions, and Dispute Resolution Mechanism
The PDP Law strictly regulates how personal data shall be treated and forms
of sanctions entailing any violations. Specific mistreatment of personal data
22
Article 36 and Article 37 PDP Law.
23
Article 1 (5) PDP Law.
24
Article 51 (1) and (3) PDP Law.
25
Article 51 (5) PDP Law.
26
Article 55 and Article 56 (1) PDP Law.
27
Article 16 (2) PDP Law.
28
Article 56 (2) PDP Law.
29
Article 58 (1), (2), and (3) PDP Law.
30
Article 59 PDP Law.

5. AHRP Legal Alert Page 5 of 6
protection is subjected to administrative sanctions as regulated in Article 57
(2) of the PDP Law, those are: written warning; temporary discontinuation of
data processing activity; termination of personal data; and/or administrative
fine.
Furthermore, as listed in Article 65 and Article 66 of the PDP Law, any
person is prohibited from:
1. unlawfully obtaining and collecting personal data that is not of their own
for personal or benefits of others that could potentially harm the data
owner;
2. unlawfully revealing personal data that is not of their own;
3. unlawfully using personal that is not of their own; and
4. creating fake and forging personal data intended for personal or the
benefit of others that could potentially harm the data owner.
Each or an accumulation of violations of the abovementioned prohibitions is
subject to criminal sanctions,31 depending on the degree of the violation,
consisting of imprisonment, fine, and other forms of sanctions intended for
corporate criminal actions. Corporate criminal sanctions are listed in the
PDP Law include:32 assets or profit seizure obtained from the violation;
freeze the partial or whole business activity; fines; revocation of business
licenses; and/or dissolution of the corporation.
The PDP Law provides a relatively broad selection of dispute resolution
mechanisms that the persons and corporations can undertake to solve an
issue arising from personal data protection activity, other than the
predeterminant criminal violations,33 either by way of arbitration or court or
through other dispute resolution institutions.34 The soon-to-be established
personal data protection institution35 will also be granted the power to
facilitate dispute resolution outside of court,36 subject to the parties’
agreement, primarily by consultation, arbitration, negotiation, mediation,
conciliation, or by an expert’s determination.37
IV. The Next Steps
While drafting this article, the bill has not yet been enacted as law despite being
passed by the DPR as it still requires approval from the President. According to
Law Number 12 of 2011 on the Establishment of Legislations as lastly amended
by Law Number 13 of 2022 (“Establishment of Legislations Law”), the law is
established by the DPR with approval from the President.38
31
See Article 67 - Article 73 PDP Law.
32
Article 70 (4) PDP Law.
33
See Article 67 - Article 73 PDP Law.
34
Article 64 (1) PDP Law.
35
Article 58 jo. Article 59 PDP Law.
36
Article 59 (d) PDP Law.
37
Elucidation of Article 59 (d) PDP Law.
38
Article 1 (3) Establishment of Legislations Law.

6. AHRP Legal Alert Page 6 of 6
Such approval shall be in the form of a signature of the President given within 30
(thirty) days from 20 September 2022, when the finalised bill was issued39. Should
the President not provide a signature within one month, however, the finalised bill
shall be enacted automatically by law.40 The required approval in this instance is
merely administrative, considering that even in the absence of the President’s
signature, the finalised bill can still be enacted – meaning that the PDP Law is
expected to be registered as a law in force in due time.
The PDP Law introduces a new set of rules that would require an overhaul within
the existing laws, raising the need to make certain adjustments and adopt them.
For that purpose, Article 74 of the PDP Law grants 2 (two) years for data subjects,
regulators, processors, and other relevant stakeholders to adjust personal data
procession since the date of the PDP Law is in force.
Additionally, it can be expected that the Indonesian government will enact a
Government Regulation/Peraturan Pemerintah (“GR”) following the enactment of
the PDP Law. The GR will essentially regulate the specific implementation of the
PDP Law41 that the Ministry of Communication and Informatics would prepare as
the relevant ministerial body.42
Bibliography/References
1. Personal Data Protection Bill as finalised on 20 September 2022.
2. Law Number 21 of 2008 on Electronic Information and Transactions as lastly
amended by Law Number 19 of 2016.
3. Law Number 12 of 2011 on the Establishment of Legislations as lastly
amended by Law Number 13 of 2022.
39
Article 72 (2) Establishment of Legislations Law.
40
Article 72 (3) Establishment of Legislations Law.
41
Article 1 (5) jo. Article 12 Establishment of Legislations Law.
42
Article 27 Establishment of Legislations Law.

7. We will continue to follow the developments on this topic and provide additional information
as it becomes available. If you have any questions on this topic, please contact:
This publication has been prepared by AHRP for educational and informational purposes only. The information contained in this publication is not
intended and should not be construed as legal advice. Due to the rapidly changing nature of law, AHRP makes no warranty or guarantee
concerning the accuracy or completeness of this content. You should consult with an attorney to review the current status of the law and how it
applies to your circumstances before deciding to take any action.
World Capital Tower 19th floor
Jl. Mega Kuningan Barat No.3, Kuningan
Jakarta 12950 Indonesia
P: +6221 50917915
+6221 50917916
E: office@ahrplaw.com
www.ahrplaw.com
I Gusti Agung Indiana
indiana@ahrplaw.com
Aryangga Pradana Febrianto
aryangga@ahrplaw.com
Hana Oktaviandri
hana@ahrplaw.com