Regulations › Rest of world › Indonesia
PDP Law
Law No. 27 of 2022 on Personal Data Protection
WhenIn effect since 17 October 2024
Who enforces itMinistry of Communication and Digital Affairs (Komdigi), pending the PDP agency
Who it applies toPersons, public bodies and organizations processing personal data in Indonesia, or abroad with legal effect in Indonesia or on Indonesian citizens.
Tell the regulatorWritten notice to the agency within 72 hours (3x24 hours) after a failure is established
DPO requiredDPO required for public-service processing, large-scale systematic monitoring, or large-scale…
RegistrationNo PDP Law registration
Transfers abroadDestination must offer equal or higher protection, else adequate binding safeguards, else cons…
Request deadlineMost data subject requests must be actioned within 72 hours (3x24 hours)
Maximum fineAdministrative fines up to 2% of annual revenue
57%
of Indonesia's 21 requirements are already met by European Union (GDPR). Here is what PDP Law adds, biggest gaps first.
Reach abroadReach and lawful basisGap
GDPR2 Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.
PDP Law adds3 Applies inside Indonesia and to acts abroad with legal effect in Indonesia or on Indonesian citizens abroad.
Art. 2 · source ↗
ConsentReach and lawful basisGap
GDPR2 Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.
PDP Law adds3 Consent must be explicit, for specific purposes, and in written or recorded form; controller must hold proof.
Arts. 20-24 · source ↗
ChildrenReach and lawful basisGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
PDP Law adds3 Processing children's data needs consent of parent or guardian; child means under 18 under Indonesian child law.
Art. 25 · source ↗
Request deadlinePeople's rightsGap
GDPR2 Respond within one month, extendable by two further months for complex or numerous requests.
PDP Law adds3 Most data subject requests must be actioned within 72 hours (3x24 hours).
Arts. 30-43; GR 33/2026 · source ↗
RegistrationGovernanceGap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
PDP Law adds1 No PDP Law registration; electronic system operators register with the ministry under GR 71/2019.
GR 71/2019 (sectoral) · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
PDP Law adds2 Delete or destroy data at the end of the retention period or on request; notices must state the retention period.
Arts. 16, 21, 43-44 · source ↗
Tell peopleBreachesGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
PDP Law adds3 Written notice to affected data subjects within 72 hours, and public notice for serious breaches.
Art. 46 · source ↗
LocalizationTransfersGap
GDPR– Not addressed
PDP Law adds1 Public-scope electronic system operators must store data in Indonesia; financial-sector rules add limits.
GR 71/2019 Art. 20 (sectoral) · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
PDP Law adds2 Imprisonment up to 5 years for unlawful collection or use, 4 for disclosure, 6 for falsifying data.
Arts. 67-68 · source ↗
Already covered by GDPR: Lawful basis, Sensitive data, Rights, Marketing, DPO required, DPO qualifications, DPIA, Records, Tell the regulator, Transfers abroad, Maximum fine, Private action.
A gap means PDP Law is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws