How does UU 27/2022 distinguish a data controller from a data processor?

Article 1 point 4 defines the controller as the party determining the purpose and means of processing, while point 5 defines the processor as processing on the controller's behalf.

Can a hospital transfer its data protection liability entirely to a cloud software vendor?

No. Under Article 51 paragraph (3) of UU 27/2022, processing performed by a vendor on the controller's instructions remains the controller's legal responsibility.

What is the deadline for notifying patients of a personal data breach under UU 27/2022?

Article 46 paragraph (1) requires written notification to affected data subjects and the data protection authority within 3 x 24 hours (72 hours).

What are personal data controller obligations under UU 27/2022?

UU 27/2022 defines personal data controllers, mandating a valid processing basis, rigorous security, 72-hour request fulfillment, and retention of vendor processing responsibility.

A personal data controller is any party that determines the purposes and exercises control over the processing of personal data. A clinic or hospital that decides which patient data is collected and how it is used qualifies as a controller under this definition. Law Number 27 of 2022 (UU 27/2022) requires controllers to maintain a lawful processing basis. Secure data, respond to patient requests within 3 x 24 hours (72 hours). In addition, Retain legal accountability for vendor processing.

Who qualifies as a personal data controller

Under Article 1 point 4, a controller is any individual, public body, or international organization that determines the purpose and controls personal data processing. "Every Person" covers both individuals and corporations, whether incorporated or unincorporated (Article 1 points 7 and 8). Patient health data is classified as specific personal data (Article 4 paragraph (2)(a)).

Core obligations of personal data controllers

Lawful processing basis (Article 20): Controllers must establish a lawful basis for processing. Recognized bases include explicit consent, contractual necessity, statutory obligation, vital interest protection, public interest duties, and legitimate interests.
Consent transparency (Articles 21 and 22): When relying on consent, controllers must disclose the processing purpose, data types, retention period, and data subject rights. Proof of written or recorded consent must be maintained (Article 24).
Purpose limitation and data accuracy (Articles 27–29, 31). Processing must be limited to stated purposes, kept accurate, and recorded in a log of personal data processing activities.
Impact assessment (Article 34): High-risk processing involving specific health data requires a prior Data Protection Impact Assessment (DPIA).
Security and oversight (Articles 35–37): Controllers must maintain security safeguards and supervise all parties processing data under their direction.

The 3 x 24-hour statutory deadline and vendor management

Controllers must fulfill data subject rights within 3 x 24 hours (72 hours) of receipt. This includes Data correction (Article 30), data access (Article 32), processing termination (Article 40 paragraph (2)), and restriction (Article 41 paragraph (1)). In the event of a personal data breach, the controller must notify data subjects. Furthermore, The PDP authority in writing within 3 x 24 hours (Article 46 paragraph (1)).

Software and AI vendors process personal data on the controller's behalf as data processors (Article 1 point 5). Processing conducted by a vendor on controller instructions remains the controller's legal responsibility (Article 51 paragraphs (1) and (3)). A vendor that processes data outside controller instructions assumes independent liability for that processing (Article 51 paragraph (6)).

Administrative sanctions and transition timeline

Violating controller obligations carries administrative sanctions. This includes Written warnings, temporary suspension, data destruction. And/or fines of up to 2 percent of annual revenue against the violation variable (Article 57 paragraphs (2) and (3)). The two-year transition period from 17 October 2022 (Article 74) ended on 17 October 2024.

Legal basis

Law Number 27 of 2022 on Personal Data Protection (UU 27/2022): Article 1 points 4, 5, 7, and 8. Article 4 paragraph (2)(a). Articles 20–22. Article 24. Articles 27–29. Article 31. Articles 34–37. Articles 30, 32, 40, 41, 43, 46. Article 51. Article 56. Article 57 paragraphs (2) and (3). and Article 74.