Regulations › Rest of world › Indonesia
PDP Law
Law No. 27 of 2022 on Personal Data Protection
WhenIn effect since 17 October 2024
Who enforces itMinistry of Communication and Digital Affairs (Komdigi), pending the PDP agency
Who it applies toPersons, public bodies and organizations processing personal data in Indonesia, or abroad with legal effect in Indonesia or on Indonesian citizens.
Tell the regulatorWritten notice to the agency within 72 hours (3x24 hours) after a failure is established
DPO requiredDPO required for public-service processing, large-scale systematic monitoring, or large-scale…
RegistrationNo PDP Law registration
Transfers abroadDestination must offer equal or higher protection, else adequate binding safeguards, else cons…
Request deadlineMost data subject requests must be actioned within 72 hours (3x24 hours)
Maximum fineAdministrative fines up to 2% of annual revenue
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
3
Applies inside Indonesia and to acts abroad with legal effect in Indonesia or on Indonesian citizens abroad.Art. 2 · secondary source · source ↗
Lawful basis
1
Consent, contract, legal obligation, vital interests, public interest/authority, and legitimate interests.Art. 20 · secondary source · source ↗
Consent
3
Consent must be explicit, for specific purposes, and in written or recorded form; controller must hold proof.Arts. 20-24 · secondary source · source ↗
Sensitive data
1
'Specific' data (health, biometric, genetic, criminal, child, financial) defined; mainly triggers DPIA and DPO duties rather than a ban.Art. 4 · secondary source · source ↗
Article number from CMS/DLA Piper summaries or recall; official text not fetched this session.
Children
3
Processing children's data needs consent of parent or guardian; child means under 18 under Indonesian child law.Art. 25 · secondary source · source ↗
Article number from CMS/DLA Piper summaries or recall; official text not fetched this session. Age threshold from Child Protection Law, not stated in PDP Law.
People's rights
Rights
3
Information, correction, access, erasure, withdrawal, objection to automated decisions, restriction/suspension, portability and compensation.Arts. 5-13 · secondary source · source ↗
Request deadline
3
Most data subject requests must be actioned within 72 hours (3x24 hours).Arts. 30-43; GR 33/2026 · secondary source · source ↗
GR 33/2026 reaffirms 72 hours; clock for copies starts after verification.
Marketing
0
Not addressed specifically; marketing needs a lawful basis and consent can be withdrawn.None · secondary source · source ↗
Governance
DPO required
1
DPO required for public-service processing, large-scale systematic monitoring, or large-scale specific/criminal data; any one trigger suffices.Art. 53; GR 33/2026 · secondary source · source ↗
Article number from CMS/DLA Piper summaries or recall; official text not fetched this session.
DPO qualifications
1
DPO appointed on professionalism, legal knowledge and data protection practice; must access senior management.Art. 53(2) · secondary source · source ↗
Article number from CMS/DLA Piper summaries or recall; official text not fetched this session.
Registration
1
No PDP Law registration; electronic system operators register with the ministry under GR 71/2019.GR 71/2019 (sectoral) · secondary source · source ↗
DPIA
2
DPIA required for high-risk processing incl. specific data, large-scale, automated decisions, and new technology such as AI.Art. 34; GR 33/2026 · secondary source · source ↗
Article number from CMS/DLA Piper summaries or recall; official text not fetched this session.
Records
2
Controllers must record all processing activities.Art. 31 · secondary source · source ↗
Article number from CMS/DLA Piper summaries or recall; official text not fetched this session.
Retention
2
Delete or destroy data at the end of the retention period or on request; notices must state the retention period.Arts. 16, 21, 43-44 · secondary source · source ↗
Article number from CMS/DLA Piper summaries or recall; official text not fetched this session.
Breaches
Tell the regulator
2
Written notice to the agency within 72 hours (3x24 hours) after a failure is established.Art. 46 · secondary source · source ↗
GR 33/2026 says clock starts once failure is established with certainty.
Tell people
3
Written notice to affected data subjects within 72 hours, and public notice for serious breaches.Art. 46 · secondary source · source ↗
Transfers
Transfers abroad
2
Destination must offer equal or higher protection, else adequate binding safeguards, else consent; BCRs need DPA approval under GR 33.Art. 56; GR 33/2026 · secondary source · source ↗
CMS cites Art. 55 for transfers; article number unconfirmed (Art. 56 per recall).
Localization
1
Public-scope electronic system operators must store data in Indonesia; financial-sector rules add limits.GR 71/2019 Art. 20 (sectoral) · secondary source · source ↗
Article number not verified.
Enforcement
Maximum fine
3
Administrative fines up to 2% of annual revenue; criminal corporate fines up to 10x individual maximum.Arts. 57, 70 · secondary source · source ↗
GR 33/2026: revenue means gross inflows; sanctions apply from 16 Jan 2027.
Criminal liability
2
Imprisonment up to 5 years for unlawful collection or use, 4 for disclosure, 6 for falsifying data.Arts. 67-68 · secondary source · source ↗
Private action
2
Data subjects may sue for compensation for violations of processing.Art. 12 · secondary source · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws