Privacy Map

Asia. National jurisdiction.

Indonesia ID

Primary authority: PDP Agency (not yet established); interim: Ministry of Communication and Digital Affairs (KOMDIGI)
Part I

Domestic law

Comprehensive data protection1

  • PDP LawLaw No. 27 of 2022 on Personal Data Protection (UU PDP)In force
    In force from     Indonesia's GDPR-style data protection law with lawful bases, rights, DPO, DPIA and 72-hour breach notice. Applies extraterritorially where processing has legal effect in Indonesia or on Indonesian citizens abroad.
    Synopsis

    Indonesia's GDPR-style data protection law with lawful bases, rights, DPO, DPIA and 72-hour breach notice. Applies extraterritorially where processing has legal effect in Indonesia or on Indonesian citizens abroad.

    Key themes
    • lawful bases
    • data subject rights
    • DPO
    • DPIA
    • breach notification
    • cross-border
    • criminal penalties
    Unique features

    Combines administrative fines of up to 2% of annual revenue with criminal sanctions; corporate criminal fines up to 10x.

    SaaS relevance

    Foreign SaaS processing Indonesians' data is in scope; PSE registration with KOMDIGI also applies to services offered in Indonesia.

    Extraterritorial
    Yes
    Breach notification
    Individuals and agency within 72h (3x24h)
    DPO
    Conditional
    Cross-border transfers
    Equal or higher protection, binding safeguards, or consent
    Maximum penalty
    Administrative 2% of annual revenue; criminal up to 6 years/IDR 6bn (individual), corporate fines up to 10x
    Key dates
    • Adopted
    • In force
    • Two-year transition ended 2024-10-17; implementing Government Regulation still in harmonisation; PDP Agency targeted 2026
    Text
    Authority
    PDP Agency (not yet established); interim: Ministry of Communication and Digital Affairs (KOMDIGI)
    Sources consulted
    Verification

    High confidence.

    Agency status as of Feb 2026 per DLA Piper. Criminal maximum figures partly from general knowledge. [Link: official Indonesian (BPK JDIH); no verified government English translation]

    Full record for PDP Law

Sectoral privacy1

  • GR 71/2019Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and TransactionsIn force
    In force from     Sets duties for electronic system operators (PSEs), including privacy protection, data deletion and registration, and lets private PSEs store data offshore if supervision is assured.
    Synopsis

    Sets duties for electronic system operators (PSEs), including privacy protection, data deletion and registration, and lets private PSEs store data offshore if supervision is assured.

    Key themes
    • PSE registration
    • data protection
    • deletion
    • supervision access
    • content blocking
    Unique features

    Access blocking for unregistered or non-compliant PSEs.

    SaaS relevance

    Foreign SaaS serving Indonesian users must register as a private PSE with KOMDIGI.

    Key dates
    • Adopted
    • In force
    • Implemented by MOCI Reg. 5/2020 and MOCD Reg. 5/2025 (PSE registration)
    Text
    Authority
    PDP Agency (not yet established); interim: Ministry of Communication and Digital Affairs (KOMDIGI)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Adoption date from general knowledge. [Link: official Indonesian (BPK JDIH); no verified government English translation]

    Full record for GR 71/2019
    Partly verifiedMedium confidence. Adoption date from general knowledge. [Link: official Indonesian (BPK JDIH); no verified government English translation]
Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 9 instruments from 3 bodies.

Association of Southeast Asian Nations (ASEAN)

  • ASEAN DMF / MCCsASEAN Digital Data Governance Framework, ASEAN Data Management Framework and ASEAN Model Contractual Clauses for Cross Border Data FlowsIn force
    In force from     The DMF is a voluntary guide for businesses on data governance across the data lifecycle. The MCCs are voluntary template contract terms for controller-to-controller and controller-to-processor transfers between ASEAN member states, setting baseline protections.
    Synopsis

    The DMF is a voluntary guide for businesses on data governance across the data lifecycle. The MCCs are voluntary template contract terms for controller-to-controller and controller-to-processor transfers between ASEAN member states, setting baseline protections.

    Key themes
    • model contractual clauses
    • cross-border flows
    • data governance
    • processor terms
    Unique features

    They are designed as a regional baseline. A joint EU–ASEAN guide maps the MCCs against the EU SCCs.

    SaaS relevance

    A SaaS provider can use the ASEAN MCCs as a transfer and processor contract template for intra-ASEAN data flows.

    Breach notification
    MCCs: processor notifies controller of breaches
    DPO
    No
    Cross-border transfers
    Voluntary model clauses
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Framework on Digital Data Governance 2018; DMF and MCCs endorsed by the 1st ASEAN Digital Ministers' Meeting on 2021-01-22; joint EU–ASEAN guide on MCCs/SCCs in 2023
    Text
    Authority
    ASEAN Digital Ministers (ADGMIN)
    Sources consulted
    Verification

    High confidence.

    The 2018 DDG Framework date and the 2023 EU–ASEAN guide come from memory.

    Full record for ASEAN DMF / MCCs
  • ASEAN PDP FrameworkASEAN Framework on Personal Data ProtectionIn force
    In force from     A statement of intent by ASEAN members to cooperate on personal data protection. It sets out principles: consent, notification and purpose; accuracy; security; access and correction; transfers to other countries; retention; and accountability. It creates no legal obligations.
    Synopsis

    A statement of intent by ASEAN members to cooperate on personal data protection. It sets out principles: consent, notification and purpose; accuracy; security; access and correction; transfers to other countries; retention; and accountability. It creates no legal obligations.

    Key themes
    • principles
    • consent
    • transfers
    • accountability
    • regional cooperation
    Unique features

    Expressly non-binding and leaves room for domestic law; it is the basis of ASEAN cross-border data instruments.

    SaaS relevance

    Background only; national ASEAN laws apply.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Consent or reasonable steps to protect data abroad
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Adopted at the 16th ASEAN Telecommunications and IT Ministers Meeting (TELMIN), November 2016
    Text
    Authority
    ASEAN Digital Ministers (ADGMIN) / ASEAN Digital Senior Officials
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not re-verify the exact adoption date or the asean.org PDF URL.

    Full record for ASEAN PDP Framework
    Partly verifiedMedium confidence. I did not re-verify the exact adoption date or the asean.org PDF URL.

Asia-Pacific Economic Cooperation (APEC)

  • APEC CBPR / PRPAPEC Cross-Border Privacy Rules (CBPR) System and Privacy Recognition for Processors (PRP) SystemIn force
    In force from     Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
    Synopsis

    Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.

    Key themes
    • certification
    • accountability agents
    • cross-border enforcement
    • processors
    Unique features

    It is one of the few certification-based transfer tools recognised by several national laws (e.g. Japan, Singapore).

    SaaS relevance

    PRP is designed for SaaS and other processors, and CBPR or PRP certification can support transfers and customer due diligence in participating economies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Certification-based transfer mechanism
    Maximum penalty
    Decertification; enforcement under local law
    Key dates
    • Adopted
    • In force
    • CBPR endorsed by APEC Leaders in 2011, first certifications 2013; PRP launched 2015. Since 2022–25 the systems have been mirrored by the separately administered Global CBPR and Global PRP (see separate row).
    Text
    Authority
    Participating economies' privacy enforcement authorities; APEC-recognised Accountability Agents
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.

    Full record for APEC CBPR / PRP
    Partly verifiedMedium confidence. The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
  • APEC Privacy FrameworkAPEC Privacy FrameworkIn force
    In force from     A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.
    Synopsis

    A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.

    Key themes
    • preventing harm
    • notice
    • choice
    • accountability
    • cross-border privacy enforcement
    • interoperability
    Unique features

    Its harm-based, accountability-led model contrasts with the rights-based European approach. It is the basis of the CBPR and PRP certification systems.

    SaaS relevance

    It underpins CBPR and PRP certifications, which SaaS providers can use to show compliance and support transfers in participating economies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Accountability-based; CBPR system
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Endorsed by APEC Ministers in 2004 and published in 2005; updated in 2015 (endorsed 2016)
    Text
    Authority
    APEC Digital Economy Steering Group (DESG) Data Privacy Subgroup
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not re-check the publication URL this session.

    Full record for APEC Privacy Framework
    Partly verifiedMedium confidence. I did not re-check the publication URL this session.

United Nations

  • UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
    Synopsis

    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

    Key themes
    • cybercrime offences
    • e-evidence
    • production orders
    • data preservation
    • mutual legal assistance
    • human rights safeguards
    Unique features

    It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

    SaaS relevance

    Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Cooperation channels for electronic evidence
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
    Text
    Authority
    UNODC (secretariat); Conference of the States Parties once in force
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.

    Full record for UN Cybercrime Convention
    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
  • Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
    In force from     This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
    Synopsis

    This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

    Key themes
    • surveillance
    • interception
    • AI and privacy
    • encryption
    • business responsibility
    • remedies
    Unique features

    The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

    SaaS relevance

    These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
    Text
    Authority
    Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.

    Full record for Right to privacy in the digital age
    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
  • ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
    In force from     This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
    Synopsis

    This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

    Key themes
    • right to privacy
    • state obligations
    • legality
    • arbitrariness
    • individual communications
    Unique features

    It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

    SaaS relevance

    It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None (treaty-body views; no fines)
    Key dates
    • Adopted
    • In force
    • Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
    Text
    Authority
    UN Human Rights Committee (treaty body)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate and was not re-checked against the UN Treaty Collection.

    Full record for ICCPR Art 17
  • UDHR Art 12Universal Declaration of Human Rights, Article 12In force
    In force from     Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
    Synopsis

    Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

    Key themes
    • right to privacy
    • correspondence
    • reputation
    • protection of the law
    Unique features

    Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

    SaaS relevance

    Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Proclaimed by the UN General Assembly in Paris on 10 December 1948
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1948UDHR.pdf).

    Full record for UDHR Art 12
  • UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
    In force from     Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
    Synopsis

    Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

    Key themes
    • fair information principles
    • sensitive data
    • access
    • security
    • supervisory authority
    • transborder flows
    Unique features

    Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

    SaaS relevance

    Gives no direct obligations; it is historical background to UN-system data protection policies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow to states with comparable safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

    Full record for UN Guidelines 1990
    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.