What does the Draft Implementing Regulation of UU PDP propose regarding joint personal data controllers?

Article 18 of Law Number 27 of 2022 on Personal Data Protection (UU 27/2022) already permits two or more personal data controllers to process personal data jointly. Its draft implementing regulation (Draft PP PDP)—a public consultation draft dated 31 August 2023 that is not yet enacted law. Elaborates on joint controllership across Articles 17 through 19. Both UU 27/2022 and the draft require three core elements: an inter-controller agreement, interrelated purposes. Furthermore, Jointly determined processing means, and a jointly appointed contact point.

Who qualifies as a joint controller

A personal data controller is any party that determines the purpose and exercises control over personal data processing (UU 27/2022 Article 1 point 4). The Draft PP defines joint controllers as two or more controllers that jointly determine the purposes and means of processing (Draft Article 1 point 20). In healthcare, a hospital and a partner clinic that co-design a screening program. Furthermore, Jointly decide which patient data to collect and how to process it may act as joint controllers, assessed case by case.

Six minimum agreement clauses (Draft PP Article 17 paragraph (3))

Building on Article 18 paragraph (2) of UU 27/2022, Draft Article 17 paragraph (3) proposes that a joint-controller agreement must at least specify:

1. the legal basis of processing for each controller;
2. the relationship between the processing purposes controlled by each party;
3. the agreed means and methods of processing;
4. the categories of personal data processed;
5. the allocation of roles and responsibilities for fulfilling statutory data protection duties. and
6. the jointly appointed contact person for data subjects.

Joint and several liability and related rules

• Joint and several liability (Draft Article 18): Joint controllers bear joint and several legal liability (tanggung renteng) as controllers. Because the draft does not detail how internal contractual role-splitting affects third-party claims, clinics and corporate partners should include clear indemnification clauses in their agreements.
• Patient transparency notice (Draft Article 19). Joint controllers are jointly responsible for informing data subjects about all participating controllers. The legal basis, purposes, data categories, processing methods, and the joint contact point.
• Processors and corporate restructuring (Draft Articles 23, 87, and 143): Joint controllers may appoint a data processor (Article 23). Furthermore, Must list all joint controllers in their records of processing activities (Article 87 paragraph (2)(a)). During a corporate merger, spin-off, or acquisition, the old. Furthermore, New legal entities are treated as joint controllers until the corporate action is formally completed (Article 143 paragraph (2)).

Because the Draft PP remains a public consultation text, its detailed contract list is not yet legally binding. the binding rule in force today is Article 18 of UU 27/2022.

Legal basis

• Law Number 27 of 2022 on Personal Data Protection (UU 27/2022): Article 1 point 4. Article 4 paragraph (2)(a). Article 18 paragraphs (1) and (2). and Article 76.
• Draft Government Regulation Implementing UU 27/2022 (public consultation draft dated 31 August 2023, not yet in force): Article 1 points 4 and 20. Article 7 paragraph (1)(a). Article 17 paragraphs (1)–(4). Article 18. Article 19. Article 23. Article 87 paragraph (2)(a). and Article 143 paragraph (2).