Data Breaches and Legal Liability in Indonesia

The Legal Framework for Data Breach Liability

Data breach liability in Indonesia is now governed primarily by Law No. 27 of 2022 on Personal Data Protection (UU PDP), which came into full enforcement in October 2024 after a two-year transition period. The law applies to any personal data controller or processor — domestic or foreign — that processes personal data of Indonesian residents. Foreign companies with no physical presence in Indonesia but with Indonesian users are within scope.

Prior to the UU PDP, breach liability derived mainly from the Electronic Information and Transactions Law (UU ITE) and Government Regulation No. 71 of 2019 on Electronic Systems and Transactions. Those provisions remain relevant but are now supplementary to the more comprehensive UU PDP framework.

Notification Obligations

The Personal Data Protection Law imposes a mandatory breach notification obligation. Where a data controller becomes aware of a breach that has or is likely to have a significant impact on data subjects, notification must be made to the supervisory authority within 14 calendar days of the controller becoming aware of the breach. Written notification to affected data subjects must also be made within 14 days, containing information about what data was compromised, what the company has done in response, and contact information for follow-up.

The 14-day window is shorter than the equivalent requirements in the EU (72 hours for the GDPR) and the US (which varies by state). Companies that have built breach response processes around international benchmarks should verify that their current response timelines meet the Indonesian requirement.

Administrative Sanctions

The supervisory authority — currently under the Ministry of Communication and Digital Affairs pending the establishment of a dedicated data protection authority — may impose administrative sanctions for breach-related violations. These include written warnings, temporary suspension of data processing activities, deletion of personal data, and administrative fines. The maximum administrative fine under the UU PDP is 2% of annual revenue in Indonesia, which aligns broadly with the proportional approach used in other major data protection regimes.

Criminal Liability

The Personal Data Protection Law creates criminal offenses for specific categories of conduct beyond general breach negligence. Deliberately processing personal data without a lawful basis carries a maximum sentence of one year imprisonment and a fine of IDR 1 billion. Collecting personal data through deception for personal gain carries up to five years and a fine of IDR 5 billion. Corporate criminal liability provisions apply — meaning the company itself, as a legal entity, can be held criminally liable in addition to the individual responsible.

Civil Liability to Data Subjects

The UU PDP grants data subjects the right to seek compensation through civil proceedings for damages resulting from a violation of the law, including as a result of a data breach. This creates a direct cause of action separate from any regulatory enforcement. Class-action style civil suits by groups of affected data subjects are permissible under Indonesian civil procedure, which is a significant liability exposure for companies experiencing large-scale breaches involving consumer data.

Preparedness as a Legal Obligation

The law does not only create liability after a breach occurs — it creates affirmative obligations around breach preparedness. Controllers are required to have a documented breach response procedure, to designate a responsible person or team for data security incidents, and to conduct periodic security assessments proportionate to the risk profile of their data processing activities. Companies that cannot demonstrate these safeguards at the time of a breach will face compounded enforcement exposure beyond the breach itself.