Indonesia's Personal Data Protection Law (Law No. 27/2022) has been in full force since October 2024. The regulatory picture continues to evolve — enforcement is beginning, and sector-specific implementing regulations are emerging.
Law No. 27 of 2022 on Personal Data Protection is Indonesia's first comprehensive data protection statute. It applies to any party — including foreign companies — that processes personal data of Indonesian residents, regardless of where the processing takes place.
The law establishes a rights-based framework broadly similar to the EU's GDPR: it requires a lawful basis for processing, mandates transparency through a privacy policy, grants data subjects rights of access, correction, and deletion, and requires breach notification within 14 days of discovery.
| Obligation | Who It Applies To | Notes |
|---|---|---|
| Privacy policy (in Bahasa Indonesia) | All data controllers processing Indonesian residents' data | Must include lawful basis, retention periods, data subject rights |
| Data Processing Agreement with vendors | Controllers who engage data processors | Mandatory; processors have direct obligations |
| Data Protection Impact Assessment (DPIA) | High-risk processing activities | Required before commencing high-risk processing |
| Data Protection Officer (DPO) | High-volume or sensitive data processors | Can be internal or external |
| Breach notification to regulator | All data controllers | 14 days from discovery |
| Child data protection | Any platform accessible to users under 18 | Government Regulation issued March 2026 |
In March 2026, the Indonesian government issued a Government Regulation specifically on child protection in digital platforms — a key implementing regulation under the broader data protection and electronic information framework. It imposes mandatory age verification, parental consent requirements for data collection, a ban on behavioral profiling of minors, and restrictions on geolocation data collection from users under 18. Digital platform operators have a two-year adjustment period ending March 2028.
The supervising authority is the Ministry of Communication and Digital Affairs (Komdigi), supported by BSSN for cybersecurity aspects. Enforcement is in its early stages — the primary enforcement mechanism currently is administrative sanctions, including warnings, fines, and service suspension orders.
Foreign companies operating digital services in Indonesia that have not yet completed a full Personal Data Protection Law compliance review are exposed to regulatory risk. The two-year transition period ended in October 2024 — there is no further grace period.
A structured brief on current Personal Data Protection Law implementation — what has changed, what is pending, and what your business specifically needs to address.
Order a Brief — from $149 →