Overview of Indonesia’s Law No. 27 of 2022 on Personal Data Protection
Indonesia’s Law No. 27 of 2022 on Personal Data Protection (PDP Law) came into full force on October 1, 2024, marking a significant milestone in the country’s regulatory framework for safeguarding personal data. The law introduces key provisions such as the right to object to automated decision-making and imposes administrative fines of up to 2% of an organization’s annual revenue for non-compliance. However, the establishment of the supervisory authority responsible for enforcing these rules remains in progress, with its operationalization targeted for mid-2024.
The PDP Law was enacted following years of deliberation, with discussions dating back to 2016 on the necessity of an independent agency to oversee data privacy. The law explicitly mandates the creation of the Personal Data Protection Authority (PDPA), an executive agency under the President of Indonesia, to enforce the provisions of the PDP Law. This decision was made after considering alternatives, such as vesting enforcement powers in existing agencies like the Ministry of Communication and Information Technology or the National Cyber and Crypto Agency. The final legislation, signed by President Joko Widodo on October 17, 2022, formalized the establishment of the PDPA as a separate entity.
It applies to both domestic and foreign entities processing personal data within Indonesia, with specific obligations for data controllers and processors.
Key Provisions and Enforcement Mechanisms
The PDP Law grants individuals several rights that directly impact AI systems and automated decision-making processes.
Enforcement of the PDP Law is primarily the responsibility of the PDPA, which is tasked with formulating policies, supervising compliance, and resolving disputes outside of court proceedings. The authority’s powers, as outlined in Articles 59 and 60 of the law, include investigating violations, issuing orders to data controllers and processors, and cooperating with international data protection authorities. The PDPA is also empowered to assess compliance with cross-border data transfer requirements, ensuring that personal data leaving Indonesia adheres to Indonesian legal standards. Administrative fines of up to 2% of an organization’s annual revenue serve as a deterrent for non-compliance, though the exact enforcement procedures and penalty structures are yet to be fully detailed in secondary regulations.
The PDPA’s operational timeline has faced delays, with the Ministry of Communication and Information Technology initially targeting its establishment for mid-2024. As of October 2024, the agency remains in the process of being formalized, with its structure expected to be a spin-off from the ministry. This delay has left a temporary regulatory gap, as the PDP Law’s provisions are enforceable without the PDPA’s full operational capacity.
Addressing AI and Automated Decision-Making Under the PDP Law
The right to object to automated decisions, for example, requires organizations deploying AI to implement mechanisms for individuals to challenge or request explanations for decisions made by algorithms.
The PDP Law’s focus on transparency and accountability extends to data processing activities, including those involving AI. Organizations must ensure that personal data used in AI training, inference, or decision-making processes is collected lawfully, processed fairly, and stored securely. Failure to comply with these requirements could result in administrative fines, though the PDPA’s enforcement actions will depend on its operational readiness.
In addition to the PDP Law, Indonesia has issued supplementary guidance on AI ethics through a 2023 ministerial ethics circular. The circular does not override the PDP Law but serves as a complementary framework for organizations seeking to align their AI practices with broader ethical standards. The interplay between the PDP Law and this circular highlights Indonesia’s dual approach to regulating AI—through both legally enforceable data protection rules and voluntary ethical guidelines.
Challenges and Future Outlook for Data Protection in Indonesia
The implementation of the PDP Law faces several challenges, chief among them being the establishment and operationalization of the PDPA. The agency’s delayed formation has created uncertainty for businesses operating in Indonesia, particularly those relying on AI and automated systems that process personal data. Without a fully functional supervisory authority, enforcement of the PDP Law’s provisions remains inconsistent, and organizations may struggle to interpret their obligations under the law.
However, the PDP Law’s strict data protection measures—such as the right to object to automated decisions and cross-border data transfer restrictions—may pose obstacles for businesses seeking to deploy AI solutions that rely on large-scale data processing or international data flows.
Looking ahead, the success of Indonesia’s data protection framework will depend on the PDPA’s ability to fulfill its mandates effectively. Once operational, the authority will play a pivotal role in shaping the country’s approach to data privacy, AI governance, and cross-border data transfers. For organizations operating in Indonesia, staying informed about the PDPA’s developments and preparing for compliance with the PDP Law’s provisions will be necessary to avoid administrative penalties and reputational risks.
Required actions
- Article 10: individuals may object to decisions based solely on automated processing, including profiling, that have legal or significant effects - Obtain explicit consent, appoint a DPO where required and conduct impact assessments for high-risk processing