How quickly must a patient data breach be reported under Indonesian law?

At the latest within 3 x 24 hours (72 hours). The notification must be made in writing to the affected patients and to the personal data protection authority (Lembaga PDP). This duty is established in Article 46 paragraph (1) of Law Number 27 of 2022 on Personal Data Protection (UU 27/2022). Furthermore, Falls directly upon the Personal Data Controller, which in practice is the hospital or clinic.

Who must notify and what constitutes a breach

The notification duty rests on the Personal Data Controller that determines processing purposes and exercises control (Article 1 point 4). Patient health data is classified as Specific Personal Data (Article 4 paragraph (2)(a)).

A healthcare software vendor or cloud provider acts as a Personal Data Processor. Processing conducted by a vendor on the clinic's instructions remains the clinic's legal responsibility as controller (Article 51 paragraph (3)). Article 52 does not extend the Article 46 breach notification duty directly to processors. Therefore, the healthcare facility must notify patients and the authority. Furthermore, Its service contracts should require vendors to report any security incident immediately to the facility.

Under the elucidation of Article 46 paragraph (1), a "personal data protection failure" covers any breach of data confidentiality, integrity. Alternatively, Availability, whether intentional or accidental. This encompasses destruction, loss, alteration, unauthorized disclosure, or unauthorized access, making its legal scope much broader than external hacking alone.

Three minimum notification requirements (Article 46 paragraph (2))

Article 46 paragraph (2) requires the written notice to include at least:

1. the specific categories of personal data disclosed or compromised;
2. when and how the personal data was compromised. and
3. the remediation and recovery measures undertaken by the controller.

In certain cases, controllers must also issue a public notice to the general public (Article 46 paragraph (3)). Such as when the breach disrupts public services or causes widespread impact. Article 50 exempts notification to data subjects only for specific statutory state interests such as national defense and law enforcement.

Healthcare sector obligations and legal consequences

Law 17/2023 Article 351 paragraph (5) requires Health Information System operators to notify data owners when a protection failure affects individual health data. PP 28/2024 Articles 791(1) and 792(1) further mandate that healthcare facilities implement information security management systems and handle cybersecurity incidents promptly.

Violating Article 46 triggers administrative sanctions under Article 57. Ranging from written warnings to fines of up to 2 percent of annual revenue against the violation variable. Affected patients also have the statutory right to sue for compensation under Article 12 paragraph (1). The two-year transition period (Article 74) expired in October 2024.

Legal basis

• Law Number 27 of 2022 on Personal Data Protection (UU 27/2022): Article 1 point 4. Article 4 paragraph (2)(a). Article 12 paragraph (1). Article 46 and its Elucidation. Article 50. Article 51 paragraphs (3) and (6). Article 52. Article 57. Article 58. and Article 74.
• Law Number 17 of 2023 on Health: Article 351 paragraph (5).
• Government Regulation Number 28 of 2024 (PP 28/2024): Article 791 paragraph (1) and Article 792 paragraph (1).