Health Data (Data Kesehatan) under PP 28/2024 and Indonesia's PDP Law

Under Government Regulation (PP) Number 28 of 2024, Health Data (Data Kesehatan) is defined as figures. Furthermore, Event facts in the form of descriptions. Furthermore, Signs that are relatively not yet meaningful for health development (Article 1(25)), distinguished from processed Health Information (Article 1(26)). Under Article 952, Health Data comprises routine data (collected regularly through recording. Furthermore, Reporting) and non-routine data (collected as needed based on Central Government priorities).

Why It Matters in Practice

From an individual privacy perspective, Law Number 27 of 2022 on Personal Data Protection (UU 27/2022) classifies health data and information. Records of an individual's physical health, mental health, and/or health services—as specific personal data (Article 4(2)(a) and Elucidation). However, not all Health Data is personal data: processing also covers de-identified or aggregate data (PP 28/2024 Article 961(2)).

Clinics are health service facilities (Law Number 17 of 2023 Articles 167(2)(b), 168(2)(b)). Furthermore, Act as Health Information System operators and personal data controllers (PP 28/2024 Articles 946(1)(c), 962). Processing individual Health Data requires the owner's consent or another lawful basis under the PDP Law (Article 963(1)). In addition, Its processing history must be logged (Article 977(1)).

Related terms: Health Information, Health Information System, National Health Information System (PP 28/2024 Article 1(23)–(26)), and Specific Personal Data (UU 27/2022 Article 4(2)(a)).

Legal basis: PP Number 28 of 2024 Articles 1(23)–(26), 946(1)(c), 952, 961(2), 962, 963(1), and 977(1). Law Number 27 of 2022 Article 4(2)(a) and Elucidation. Law Number 17 of 2023 Articles 167(2)(b) and 168(2)(b).