What does the Draft Implementing Regulation of UU PDP propose regarding Data Protection Officers?

The obligation to appoint a Data Protection Officer (DPO) is already enacted in Law Number 27 of 2022 on Personal Data Protection (UU 27/2022 Articles 53 and 54). Its draft implementing regulation (Draft PP PDP)—a public consultation draft dated 31 August 2023 that is not yet enacted law—elaborates on appointment governance. Articles 165 through 169 of the draft address organizational size, resource support, officer independence, and coordination with the data security unit.

When appointment is required and who may be appointed

Article 165 paragraph (1) of the draft repeats the three DPO appointment conditions from Article 53 paragraph (1) of UU 27/2022:

• personal data processing for public service purposes;
• core controller activities requiring regular and systematic monitoring of personal data on a large scale. and
• core controller activities consisting of large-scale processing of specific personal data or crime-related data.

Health data is classified as specific personal data (UU 27/2022 Article 4 paragraph (2)(a). Draft PP Article 7 paragraph (1)(a)). Consequently, hospitals or clinics whose core operations process health data on a large scale must evaluate the third condition. The elucidation of Draft Article 127 paragraph (2)(c) notes that large-scale factors include data volume, number of data subjects, and processing duration.

A DPO is selected based on professionalism, legal knowledge, data protection practice, and ability to perform the duties (Article 165 paragraph (2)). Appointments consider organizational structure, size, and needs, and may involve one or more internal or external officers (Article 166 paragraphs (1) and (2)).

Officer duties and organizational support proposed in the draft

• Four minimum duties (Article 167 paragraph (1)): Advising on compliance, monitoring internal compliance, advising on Data Protection Impact Assessments (DPIA). In addition, Acting as the contact point for data processing issues. Controllers must also document the DPO's advice when conducting a DPIA (Article 128 paragraph (3)).
• Organizational support and job protection (Article 168 paragraphs (1) and (2)): Controllers. Furthermore, Processors must involve the DPO in a timely manner, provide adequate resources, and grant direct reporting access to top management. Organizations must ensure the DPO works objectively without conflicts of interest and is not dismissed or penalized for performing DPO duties.
• Security unit coordination (Article 169 paragraphs (1) and (2)): The DPO collaborates with the data security unit, issues recommendations. In addition, Reports performance assessments of that unit to the board of directors and/or the PDP Agency.

Sanctions for failing to appoint a DPO

Article 57 paragraphs (1) and (2) of UU 27/2022 already impose administrative sanctions for violating Article 53 paragraph (1). Sanctions include written warnings, temporary suspension of processing, data erasure, and/or administrative fines imposed by the data protection authority. The Draft PP PDP repeats these administrative sanctions in Articles 213 and 214, though all draft-only provisions remain non-binding until formally promulgated.

Legal basis

• Law Number 27 of 2022 on Personal Data Protection (UU 27/2022): Article 4 paragraph (2)(a). Articles 53 and 54. Article 57 paragraphs (1), (2), and (4). and Article 58 paragraph (2).
• Draft Government Regulation Implementing UU 27/2022 (public consultation draft dated 31 August 2023, not yet in force): Article 7 paragraph (1)(a). Article 32(a) point 8. Elucidation of Article 127 paragraph (2)(c). Article 128 paragraph (3). Articles 165–169. Article 213. and Article 214.