What conditions govern exporting patient health data outside Indonesia?

For healthcare facilities and other health information system operators, patient health data must ordinarily be stored and processed within Indonesia. Sending health data abroad is legally permitted only under multi-layered safeguards. Under personal data protection law, the sender must verify equivalent recipient country protections, establish binding adequate safeguards, or obtain explicit patient consent. Crucially, health data export is restricted to specific statutory purposes and requires prior ministerial authorization.

General rules under UU 27/2022 (Article 56)

Health data is classified as Specific Personal Data (Article 4 paragraph (2)(a)). Healthcare facilities act as Personal Data Controllers (Article 1 point 4). Article 56 of UU 27/2022 establishes a tiered hierarchy for cross-border data transfers:

1. verifying that the recipient's jurisdiction provides an equal or higher level of personal data protection (paragraph (2));
2. if statutory equivalence is absent, establishing adequate and legally binding safeguards (paragraph (3)). and
3. if neither is available, obtaining the explicit consent of the patient (paragraph (4)).

The personal data protection authority evaluates cross-border transfer compliance (Article 60(f)). If an overseas vendor serves as a data processor, the domestic facility remains legally responsible for that processing (Article 51 paragraph (3)).

Ministerial approval and specific permitted purposes (PP 28/2024 Article 972)

Law 17/2023 Article 349 paragraph (7) provides that health data may be transferred abroad solely for specific, limited purposes with Central Government approval. PP 28/2024 Article 946 confirms that healthcare facilities qualify as health information system operators subject to this restriction.

Article 972 of PP 28/2024 lists six permitted cross-border health data transfer purposes:

• outbreak response and management;
• epidemic or pandemic containment;
• Hajj pilgrimage healthcare services;
• material transfer agreement (MTA) implementation;
• international healthcare cooperation. or
• other government-approved use purposes.

Article 972 paragraph (3) establishes two cumulative requirements: the transfer must obtain prior approval from the Minister of Health. Furthermore, must satisfy personal data transfer statutory requirements under UU 27/2022.

Domestic storage mandates and cross-border display rules

Under PP 28/2024 Article 966 paragraph (2), databases for storing health data must be located in data centers inside Indonesia. When utilizing third-party services, storage facilities must remain within Indonesia (paragraph (5)(a)). For electronic medical records, Permenkes 24/2022 Article 22 paragraph (1) similarly mandates domestic storage facilities. The elucidation of Article 349 paragraph (6) of Law 17/2023. Furthermore, PP 28/2024 Article 971 paragraph (2) state that displaying health data to overseas parties qualifies as data transmission. Making cross-border remote access subject to strict contractual safeguards.

Legal basis

• Law Number 27 of 2022 on Personal Data Protection. Article 1 point 4, Article 4 paragraph (2)(a), Article 51 paragraph (3), Article 56, and Article 60(f).
• Law Number 17 of 2023 on Health: Article 346 paragraphs (6) and (7), Article 349 paragraph (7), and Elucidation of Article 349 paragraph (6).
• Government Regulation Number 28 of 2024 (PP 28/2024): Articles 946, 966, 971, and 972.
• Ministry of Health Regulation Number 24 of 2022 on Medical Records: Article 22 paragraph (1).
• Government Regulation Number 71 of 2019: Article 21 paragraph (1).