Personal Data Subject (Subjek Data Pribadi) under Indonesia's PDP Law

Under Law Number 27 of 2022 on Personal Data Protection (UU 27/2022). A Personal Data Subject (Subjek Data Pribadi) is an individual to whom personal data is attached (Article 1(6)). In a clinic, hospital, or workplace setting, patients, workers, job applicants, and visitors are data subjects for their personal records.

Position in the Law

Article 1 distinguishes three parties in data processing: the Subject is the individual (Article 1(6)), the Controller determines purposes. Furthermore, Controls processing (Article 1(4)), and the Processor processes data on the Controller's behalf (Article 1(5)). While a Controller can be a corporation (Article 1(4), (7)), a Personal Data Subject is strictly a natural person.

Why It Matters in Practice

Chapter IV attaches core rights to the data subject: receiving information on processing purposes (Article 5), correcting data (Article 6), obtaining access. Furthermore, Copies (Article 7), ending processing or deleting data (Article 8), withdrawing consent (Article 9), and claiming damages for unlawful processing (Article 12). Rights under Articles 6–11 are submitted via recorded electronic or non-electronic requests to the Controller (Article 14). Certain rights under Articles 8, 9, 10(1), 11, and 13(1)–(2) are subject to statutory exceptions such as law enforcement or scientific research (Article 15(1)–(2)).

Health data and information are classified as specific personal data (Article 4(2)(a)), which carry higher risks such as discrimination (Elucidation of Article 4(1)(a)). Child data is also specific (Article 4(2)(e)), and processing data of children or persons with disabilities requires special safeguards (Articles 25(1), 26(1)).

Related terms: Explicit consent of the subject is one lawful basis for processing under Article 20(2)(a), alongside other bases in letters (b)–(f). Other related terms include Personal Data (Article 1(1)) and Personal Data Protection (Article 1(2)).

Legal basis: Law Number 27 of 2022 Articles 1(1), 1(2), 1(4)–(7), 4(1)(a), 4(2)(a), 4(2)(e) and Elucidation, Articles 5–15, 20(2), 25(1), and 26(1).