Personal Data Protection (Pelindungan Data Pribadi) under Indonesia's Law 27/2022

Law Number 27 of 2022 on Personal Data Protection (UU 27/2022) defines Personal Data Protection (Pelindungan Data Pribadi or PDP) in Article 1(2). It covers all efforts to protect personal data across the processing chain to guarantee the constitutional rights of the Personal Data Subject.

Scope Under the PDP Law

Personal data refers to data about an identified or identifiable individual, alone or combined with other information (Article 1(1)). Health data and information are classified as specific personal data (Article 4(2)(a)) because processing them carries greater potential impact on the subject. Such as discrimination (Elucidation of Article 4(1)(a)).

Under Article 16(1), processing spans acquisition, collection, storage, disclosure, and erasure or destruction. The PDP Law applies to individuals, corporations, public bodies. Furthermore, International organizations performing regulated legal acts inside or outside Indonesia with legal consequences in Indonesia or for Indonesian citizens abroad. Excluding personal or household activities (Articles 1(7), 2).

Why It Matters in Practice

Article 16(2) requires data to be collected in a limited, specific, lawful, and transparent manner, processed accurately for its stated purpose, kept secure. In addition, Deleted or destroyed after the retention period ends unless regulations require otherwise. Data subjects hold statutory rights under Articles 5–13. Violations of key obligations face administrative sanctions under Article 57(2), including written warnings, temporary suspension of processing, data deletion, or administrative fines. The two-year transition period from enactment on 17 October 2022 has ended (Article 74).

Related terms: Personal Data Controller (Article 1(4)), Personal Data Processor (Article 1(5)), and Personal Data Subject (Article 1(6)).

Legal basis: Law Number 27 of 2022 Articles 1, 2, 4 and Elucidation, 5–13, 16, 57, and 74.