Is a hospital a personal data controller or processor in Indonesia, and what is its AI vendor's role?

A hospital is a personal data controller. Under Government Regulation Number 28 of 2024 (PP 28/2024), every health information system operator. This includes A healthcare facility, is a personal data controller (Article 946(1)(c) and Article 962). A vendor generally acts as a personal data processor when it processes data on the hospital's behalf under Law Number 27 of 2022 (UU PDP Article 1 point 5). However, a vendor operating its own health information system may also qualify as a controller (PP 28/2024 Article 946(1)(d) and (6)(c), and Article 962). Consequently, a vendor's legal role must be assessed case by case.

UU PDP itself does not use the term "data owner". The patient is the Personal Data Subject (Article 1 point 6), not the controller. For medical records, the physical or electronic document belongs to the healthcare facility (PP 28/2024 Article 784(1)), whereas data-processing duties are governed by UU PDP. PP 28/2024 itself refers to the individual whose data is processed as the "data owner" (pemilik data) in Article 963.

Health data is classified as specific personal data (UU PDP Article 4(2)(a)). Its processing is categorized as potentially high-risk, requiring the hospital to conduct a Data Protection Impact Assessment (Article 34(1) and (2)(b)).

For cross-border data transfers, the hospital must ensure the recipient's country provides a level of protection equal to or higher than UU PDP. If not, the hospital must ensure adequate and binding protection. if neither condition is met, the hospital must obtain the patient's consent (UU PDP Article 56(2)–(4)). For health data, PP 28/2024 Article 972 adds further requirements. The transfer must serve specific, limited purposes under paragraph (2), obtain a Minister of Health permit. In addition, Satisfy the UU PDP transfer rules above (paragraph (3)). PP 28/2024 also stipulates that health information system operators store health data in databases in the form of data centers located within Indonesia (Article 966(1) and (2)).

Under UU PDP Article 51, a processor acts on the controller's instructions, while the processing remains the controller's responsibility (paragraphs (1) and (3)). Before engaging a subprocessor, the vendor must obtain prior written consent from the hospital (paragraphs (4) and (5)). If the vendor processes data outside the hospital's instructions and purposes, the vendor becomes legally responsible for that processing (paragraph (6)). Obligations covering accuracy, recording, security, confidentiality, and supervision also bind the processor directly (Article 52, referring to Articles 29, 31, and 35 to 39).

The hospital must supervise every party involved in processing under its control (Article 37) and demonstrate accountability (Article 47). In the event of a data protection failure, the hospital must notify both the patient. Furthermore, The data protection authority in writing within 3 x 24 hours (Article 46(1)).

Violations of these UU PDP obligations by either the hospital or the vendor may incur administrative sanctions (Article 57(1). Covering Articles 34(1), 37, 46(1), 47, 51(1). Furthermore, (5), and 52), including administrative fines of up to 2 percent of annual revenue or receipts for the violation variable (Article 57(2)(d) and (3)).