IndonesiaDesk Editorial · 15 May 2026
Law No. 27/2022 on Personal Data Protection has been enforceable since October 2024. Here is what foreign companies operating in Indonesia must address.
This article is for general informational purposes only and does not constitute legal or investment advice. Always consult qualified professionals before making business decisions.
Law No. 27 of 2022 on Personal Data Protection completed its two-year transition period in October 2024. All provisions are now fully in force. There is no further grace period — companies that have not completed compliance reviews are already exposed to regulatory risk.
The most common compliance gap for foreign companies in Indonesia is a privacy policy that does not meet the minimum requirements of the Personal Data Protection Law. Copying a privacy policy from another website — or using a generic template — is particularly risky: it may describe data processing practices that do not actually match what the company does, or omit mandatory disclosures required by Indonesian law.
If a privacy policy states that no data is shared with third parties but the company uses third-party analytics services, that is a false statement to users — and a potential legal liability under the law.
Under Law No. 27/2022, a compliant privacy policy must include the identity and contact details of the data controller, the types of personal data collected and how they are collected, the purpose and lawful basis for each type of processing, the data retention period, any third parties who receive the data, information about cross-border data transfers, the rights of data subjects and how to exercise them, and contact information for submitting data-related requests.
The lawful basis requirement is the most frequently missing element. The law requires every processing activity to have a valid legal basis — consent, contractual necessity, legal obligation, vital interest, public interest, or legitimate interest. This basis must be communicated to users.
Listing data subject rights in a privacy policy is not sufficient. Companies must provide a working mechanism for users to actually exercise these rights: access to their data, correction of inaccurate data, withdrawal of consent, deletion of data in certain circumstances, and the right to object to certain types of processing.
The company must respond to these requests within the timeframe required by law and must have an internal process for handling them. Companies without a documented Data Subject Access Request (DSAR) procedure are likely unable to comply with requests in time.
A Government Regulation issued in March 2026 adds a specific layer for platforms with users under 18: mandatory age verification mechanisms, parental consent for data collection from minors, a ban on behavioral profiling of children, and restrictions on collecting precise geolocation data from minor users. Platforms have a two-year adjustment period — ending March 2028 — but preparation should begin now.
Our research briefs go deeper — tailored to your business, sector, and specific regulatory question. Delivered within 5 business days.
Order a Brief — from $99 →