UU PDP (Personal Data Protection Law No. 27/2022)
UU PDP, Indonesia's Law No. 27 of 2022 on Personal Data Protection, classifies health data as specific personal data. It governs controller and processor duties, data-subject rights, processing, security, breaches, transfers, and sanctions.
Law No. 27 of 2022 on Personal Data Protection, dated 17 October 2022, lists health data as specific personal data in Article 4. Article 20 requires a controller to identify an applicable processing basis; explicit consent is one of six listed bases, not the automatic basis for every use.
For healthcare AI, the institution should confirm its controller or processor role, purpose, and processing basis, then translate the law into controls for collection, access, security, retention, deletion, processors, and transfers. Article 34 requires a Data Protection Impact Assessment for high-risk processing and expressly includes processing specific personal data.
Micromeet — AI for governed healthcare. See the public benchmark →