Indonesia. Comprehensive data protection. Law
PDP LawLaw No. 27 of 2022 on Personal Data Protection (UU PDP)
In force
§1Summary
- Synopsis
Indonesia's GDPR-style data protection law with lawful bases, rights, DPO, DPIA and 72-hour breach notice. Applies extraterritorially where processing has legal effect in Indonesia or on Indonesian citizens abroad.
- Key themes
- Unique features
Combines administrative fines of up to 2% of annual revenue with criminal sanctions; corporate criminal fines up to 10x.
- SaaS relevance
Foreign SaaS processing Indonesians' data is in scope; PSE registration with KOMDIGI also applies to services offered in Indonesia.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Individuals and agency within 72h (3x24h)
- DPO
- Conditional
- Cross-border transfers
- Equal or higher protection, binding safeguards, or consent
- Maximum penalty
- Administrative 2% of annual revenue; criminal up to 6 years/IDR 6bn (individual), corporate fines up to 10x
§3Dates
- Key dates
- Adopted
- In force
- Two-year transition ended 2024-10-17; implementing Government Regulation still in harmonisation; PDP Agency targeted 2026
§4Text and authority
- Text
- Authoritative text peraturan.bpk.go.id
- Authority
- PDP Agency (not yet established); interim: Ministry of Communication and Digital Affairs (KOMDIGI)
§5Where it applies
- Domestic law of
- Indonesia
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Agency status as of Feb 2026 per DLA Piper. Criminal maximum figures partly from general knowledge. [Link: official Indonesian (BPK JDIH); no verified government English translation]