What Is a DPIA and When Is Your Business Required to Conduct One in Indonesia?

What Is a DPIA?

A Data Protection Impact Assessment (DPIA) is a structured process for identifying and minimizing privacy risks before commencing a high-risk data processing activity. It is not an audit after the fact — it is a preventive step that must be completed before the processing begins.

Under Indonesia's Personal Data Protection Law (Law No. 27/2022), data controllers are required to conduct a DPIA when a planned processing activity presents a high risk to the rights and interests of data subjects.

When Is a DPIA Required?

The law and its implementing framework identify several categories of processing that typically require a DPIA: automated decision-making that significantly affects individuals (including profiling); large-scale processing of sensitive personal data; systematic monitoring of data subjects (such as CCTV systems, user behavior tracking, or location monitoring); use of new technologies in data processing; processing that could restrict the rights of data subjects; and matching or combining datasets from multiple sources.

If your business uses AI to analyze customer behavior, operates recommendation systems, stores biometric data, or processes sensitive data at scale, a DPIA is very likely required before those activities can lawfully continue.

What Must a DPIA Contain?

A valid DPIA must include a systematic description of the processing activity and its purpose, an assessment of the necessity and proportionality of the processing, an assessment of the risks to data subjects' rights and interests, and the mitigation measures to be taken to reduce identified risks.

The Data Protection Officer (DPO) must be involved in the DPIA process. If no internal DPO exists, an external consultant can support the process.

Lessons from Enforcement Cases Abroad

A credit card company in Europe was fined 150,000 euros for failing to conduct a valid DPIA before implementing a digital identification system for 1.5 million customers. The assessment they had conducted was found invalid because it focused on financial risk rather than personal data protection risk. In another case, a government body using vehicle-mounted cameras was sanctioned despite being a public institution — the DPIA obligation applies regardless of whether the controller is public or private.

Indonesia's enforcement framework is still developing, but the legal obligation exists now. Companies that wait for detailed enforcement guidance risk starting from a compliance deficit.