What prohibitions and criminal penalties on personal data misuse are set in UU 27/2022?

Law Number 27 of 2022 on Personal Data Protection (UU 27/2022) establishes four core prohibitions regarding personal data in Chapter XIII (Articles 65 and 66). The first three prohibitions cover unlawfully obtaining or collecting, disclosing, and using personal data that does not belong to the actor. The fourth prohibition covers creating false personal data or falsifying personal data for gain that may harm another person. Intentional violations carry criminal imprisonment and/or fines, including corporate liability for clinics, hospitals, and employers.

Four prohibitions in Articles 65 and 66

• Unlawful collection (Article 65 paragraph (1)). Prohibits unlawfully obtaining or collecting personal data belonging to others with the intent to benefit oneself or another person in a way that may harm the data subject.
• Unlawful disclosure (Article 65 paragraph (2)): Prohibits unlawfully disclosing personal data belonging to others (without requiring proof of financial gain intent).
• Unlawful use (Article 65 paragraph (3)): Prohibits unlawfully using personal data belonging to others (without requiring proof of financial gain intent).
• Falsification of personal data (Article 66). Prohibits creating false personal data or falsifying personal data with the intent to benefit oneself or another person in a way that may harm others.

"Every Person" covers both individuals and corporations, whether incorporated or unincorporated (Article 1 points 7 and 8). These prohibitions apply to all personal data, including health data classified as specific personal data (Article 4 paragraph (2)(a)).

Individual and corporate criminal penalties (Articles 67–70)

• Individual penalties (Articles 67 and 68). Unlawful collection carries up to 5 years in prison and/or a fine of up to 5 billion rupiah (Article 67 paragraph (1)). Unlawful disclosure carries up to 4 years in prison and/or a fine of up to 4 billion rupiah (Article 67 paragraph (2)). Unlawful use carries up to 5 years in prison and/or a fine of up to 5 billion rupiah (Article 67 paragraph (3)). Falsifying personal data carries up to 6 years in prison and/or a fine of up to 6 billion rupiah (Article 68). Courts may also order profit confiscation and compensation payments (Article 69).
• Corporate penalties (Article 70): Criminal punishment may be imposed on management, control holders, instruction givers, beneficial owners, and/or the corporation itself (Article 70 paragraph (1)). The maximum corporate fine is 10 times the maximum individual fine. Reaching 50 billion rupiah for violating Article 67 paragraph (1) (Article 70 paragraphs (2) and (3)). Corporations may also face business suspension, license revocation, or dissolution (Article 70 paragraph (4)).

Practical notes for clinic and HR management

To prevent unlawful processing, organizations must ensure every patient or worker data workflow rests on a valid legal basis under Article 20 paragraph (1) of UU 27/2022. Strict access controls should prevent staff from copying patient contact lists or sharing full medical records with unauthorized recipients. The two-year transition period from 17 October 2022 (Articles 74 and 76) expired in October 2024.

Legal basis

• Law Number 27 of 2022 on Personal Data Protection (UU 27/2022): Article 1 points 6, 7, and 8. Article 4 paragraph (2)(a). Article 20 paragraph (1). Article 57 paragraphs (2) and (3). Articles 65–70. Article 74. and Article 76.