Regulations › Rest of world › Indonesia
PDP Law
Law No. 27 of 2022 on Personal Data Protection
WhenIn effect since 17 October 2024
Who enforces itMinistry of Communication and Digital Affairs (Komdigi), pending the PDP agency
Who it applies toPersons, public bodies and organizations processing personal data in Indonesia, or abroad with legal effect in Indonesia or on Indonesian citizens.
Tell the regulatorWritten notice to the agency within 72 hours (3x24 hours) after a failure is established
DPO requiredDPO required for public-service processing, large-scale systematic monitoring, or large-scale…
RegistrationNo PDP Law registration
Transfers abroadDestination must offer equal or higher protection, else adequate binding safeguards, else cons…
Request deadlineMost data subject requests must be actioned within 72 hours (3x24 hours)
Maximum fineAdministrative fines up to 2% of annual revenue
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws