Data Pribadi Spesifik (Specific Personal Data) under Indonesia's PDP Law

Under Law Number 27 of 2022 on Personal Data Protection (PDP Law) Article 4(2). Furthermore, Its Elucidation, Specific Personal Data (Data Pribadi yang bersifat spesifik) is personal data whose processing can result in a greater impact on the data subject. Such as discrimination or heightened harm. In addition, Therefore triggers stricter governance duties. Health data and information sit at the top of this category (Article 4(2)(a)).

Statutory Lists in Law 27/2022 vs. Permenkominfo 5/2020

Law 27/2022 Article 4(1) divides personal data into specific and general personal data. Article 4(2) lists specific personal data as: health data. Furthermore, Information, biometric data, genetic data, criminal records, child data, personal financial data, and/or other data in accordance with laws and regulations. Under the Elucidation of Article 4(2)(a), health data and information means individual records or information relating to physical health, mental health, and/or healthcare services.

Earlier, Permenkominfo Number 5 of 2020 (as amended by Permenkominfo 10/2021) Article 1 point 21 defined the phrase Data Pribadi Spesifik with a slightly different list that included sexual life/orientation. Furthermore, Political views, whereas criminal records appear in Law 27/2022 Article 4(2)(d).

Practical Impact for Clinics, Hospitals, and Employers

Because patient health records and medical check-up results are Specific Personal Data, two core obligations in Law 27/2022 apply directly:

• Data Protection Impact Assessment (DPIA): Data Controllers must conduct a DPIA whenever processing poses high potential risk to data subjects. This Explicitly includes processing Specific Personal Data (Article 34(1) and (2)(b)).
• Data Protection Officer (DPO): Controllers. Furthermore, Processors whose core activities involve large-scale processing of Specific Personal Data must appoint a data protection official or officer (Article 53(1)(c)).

In workplace medical check-ups, keeping full clinical data with the healthcare facility while sharing only fitness-to-work outcomes or aggregate de-identified summaries with the employer minimizes unnecessary Specific Personal Data exposure. Separately, under Permenkominfo 5/2020 Article 36(4)-(5). Law enforcement requests for Specific Personal Data held by private electronic system providers require a district court chief determination letter (Article 36(4)(e)).

Related Terms

General personal data (Data Pribadi yang bersifat umum) includes full name, gender. Nationality, religion, marital status, and/or combined identifying data (Law 27/2022 Article 4(3). Article 1 point 1).

Legal basis: Law Number 27 of 2022 Articles 1 point 1, 4 and Elucidation, 34, and 53(1)(c). Permenkominfo Number 5 of 2020 (as amended by Permenkominfo Number 10 of 2021) Articles 1 points 11 and 21, and 36(4)-(5).