What rules apply to general personal data transfers under UU 27/2022?

Law Number 27 of 2022 on Personal Data Protection (UU 27/2022) governs personal data transfers under Chapter VII (Articles 55 and 56). Within the jurisdiction of Indonesia, controllers may transfer personal data to other controllers. In addition, Both transferor and recipient must protect the data in accordance with statutory standards. For cross-border transfers outside Indonesia, UU 27/2022 establishes a strict three-tiered legal hierarchy. Verifying equivalent destination laws, establishing binding adequate safeguards, or obtaining explicit data subject consent.

Domestic personal data transfers (Article 55)

Article 55 paragraph (1) authorizes a personal data controller to transfer personal data to another controller within Indonesian jurisdiction. Under paragraph (2), both the transferring controller and the receiving controller are jointly obligated to implement personal data protection pursuant to statutory requirements.

Because transfer is a recognized form of personal data processing (Article 16 paragraph (1)(e)). The transferring controller must maintain a valid legal basis, such as explicit consent, statutory obligation. Alternatively, Contractual necessity (Article 20 paragraphs (1) and (2)).

Three-tiered hierarchy for cross-border transfers (Article 56)

Article 56 paragraph (1) permits cross-border transfers of personal data to recipient controllers or processors outside Indonesian jurisdiction, subject to a mandatory three-tiered hierarchy:

1. Verifying statutory equivalence (paragraph (2)). The transferring controller must ensure that the recipient's country has an equal or higher level of personal data protection than UU 27/2022.
2. Adequate and binding safeguards (paragraph (3)): If the destination country lacks equivalent statutory protection, the controller must ensure adequate. Furthermore, Legally binding safeguards, such as Standard Contractual Clauses (SCCs).
3. Explicit data subject consent (paragraph (4)). If neither of the preceding conditions can be satisfied, the controller must obtain the explicit consent of the data subject for the cross-border transfer.

The personal data protection authority is empowered to assess compliance with cross-border transfer requirements (Article 60(f)). Detailed technical rules are assigned to a Government Regulation (Article 56 paragraph (5)).

Sectoral rules for health data and administrative sanctions

Personal health data is classified as specific personal data requiring a prior Data Protection Impact Assessment (Article 4 paragraph (2)(a). Article 34). In addition, healthcare statutes impose strict sectoral controls: Law 17/2023 Article 349 paragraph (7) and PP 28/2024 Article 972 paragraphs (2). Furthermore, (3) restrict cross-border health data transfers to specific, limited purposes requiring prior approval from the Minister of Health.

Violating transfer rules triggers administrative sanctions under Article 57. This includes Written warnings, temporary suspension, data erasure, and/or fines of up to 2 percent of annual revenue against the violation variable. The two-year statutory transition period (Article 74) expired in October 2024.

Legal basis

• Law Number 27 of 2022 on Personal Data Protection (UU 27/2022): Article 4 paragraph (2)(a). Article 16 paragraph (1)(e). Article 20. Article 22. Article 24. Article 34. Articles 55–57. Article 60(f). and Article 74.
• Law Number 17 of 2023 on Health: Article 349 paragraph (7).
• Government Regulation Number 28 of 2024 (PP 28/2024): Article 972 paragraphs (2) and (3).