Indonesia’s Data Protection Law: Four Years in Force
Indonesia’s Personal Data Protection Law reached four years in force on October 17, 2026. For organisations handling personal information, the anniversary is a reminder to demonstrate compliance—not a countdown to new obligations.
What's changing
Law No. 27/2022 on Personal Data Protection took effect on October 17, 2022, establishing a national framework for how personal data is collected, used, protected and shared. It has been binding throughout the four years since that date.
The anniversary itself does not change the law. The important compliance milestone already passed: Article 74 gave controllers and processors two years to align their processing with its requirements. That transition ended on October 17, 2024. Organisations should now be operating compliant processes, rather than treating alignment as a future project.
The law distinguishes between a controller, which decides why and how personal data is processed, and a processor, which handles it on a controller’s behalf. These roles matter when assigning responsibilities across an organisation and its suppliers. Outsourcing payroll, customer support or cloud storage does not remove the need to understand who makes decisions about the data.
Article 20 requires a lawful basis for processing. Consent is one option, but it is not the only one: other grounds include contractual necessity and compliance with legal obligations. The practical requirement is to identify a valid basis for each activity, rather than assume that one broad consent covers every use.
Article 4 distinguishes general personal data from specific personal data. Specific categories include health information, biometric and genetic data, criminal records, children’s data and personal financial data. Organisations need to recognise these categories in their systems and apply safeguards that reflect the risks involved.
Individuals also have rights over their information, including rights to access, correct and seek deletion of personal data, subject to the law’s conditions. These rights require working procedures: a published privacy notice is not enough if staff cannot locate records or handle requests.
Security and incident response are operational duties. Under Article 46, a personal data protection failure triggers written notification requirements within 3 × 24 hours, including notification to affected individuals and the institution designated under the law. A response plan needs a clear escalation route, responsible decision-makers and enough information to prepare the required notice.
Who is affected
This is an Indonesian national law, not a provincial or local measure. Its reach is not limited to technology companies: retailers, banks, healthcare providers, employers, schools and other organisations can all process personal data in their everyday operations.
Article 2 covers processing within Indonesia and certain processing outside Indonesia where it has legal consequences in Indonesia or for Indonesian citizens abroad. Overseas providers therefore need to examine their activities against the law’s scope, rather than assume that a foreign headquarters places them outside it.
Organisation size alone is not a reliable guide to exposure. A small clinic may hold highly sensitive health records; a modest online shop may maintain customer addresses, payment-related information and marketing profiles. The types of data, processing purposes and operational risks all matter.
Article 2 excludes processing by individuals in personal or household activities. That exclusion should not be confused with a general exemption for small businesses.
Three things to do this week
1. Build or refresh a usable data inventory. Ask each team to list the personal data it collects, where it is stored, who can access it, which suppliers receive it and how long it is retained. Mark general and specific categories separately, using Article 4. Prioritise overlooked stores such as spreadsheets, shared drives, recruitment files and support exports.
2. Match every processing purpose to a lawful basis. Review the inventory against Article 20. Separate order fulfilment, fraud prevention, staff administration and advertising: they are different purposes and may require different reasoning. Record the basis and supporting evidence. Where consent is used, check how it was obtained and how withdrawal is handled. Flag activities where the justification is missing or unclear.
3. Test security and the breach-response workflow. Review access permissions, remove unnecessary accounts and check protections for high-risk records. Run a short incident exercise: can the team identify affected data, contain the problem and prepare notifications within Article 46’s timeframe? Assign owners and deadlines for any gaps. Keep evidence of the exercise and resulting fixes.
These steps turn compliance from a policy statement into something verifiable. Four years after the law took effect—and two years after the transition ended—the central question is whether safeguards work in practice.
Related context
Indonesia’s Government Regulation No. 71/2019 on Electronic Systems and Transactions provides related context for electronic-system operations. The 2024 second amendment to the Electronic Information and Transactions Law is also relevant to the wider digital legal framework. Neither replaces the need to assess personal data processing under Law No. 27/2022.
For regional comparisons, Thailand’s Personal Data Protection Act is a separate instrument with its own scope and requirements. Compliance in one country should not be assumed to establish compliance in another.
Note: this article was drafted by AI - OpenAI GPT-6.1