← Global Privacy Laws Research Library
Law No. 27 of 2022 on Personal Data Protection
Personal Data Protection Law: Indonesia
Prepared by Shubhank Suman · Last reviewed
CURRENT / IN FORCE
- Legal character
- National statute
- Region
- Asia-Pacific
- Enacted
- 17 October 2022
What it covers
The PDP Law regulates:
- personal-data principles
- categories of personal data
- data-subject rights
- processing
- controllers
- processors
- international transfers
- administrative sanctions
- institutional arrangements
- dispute resolution
- prohibited processing
- criminal provisions.
The BPK legal database explicitly describes all of these components. (Database Peraturan \| JDIH BPK)
Why it matters
It is Indonesia's first comprehensive, dedicated national personal-data statute and replaces the previous fragmented framework.
It is especially important for digital businesses, technology companies, financial services, health systems and organisations operating large-scale personal-data ecosystems.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: Very High
AI
HIGH
The PDP Law is not an AI Act.
But it is highly relevant to AI systems that:
- train on Indonesian personal data
- profile individuals
- use sensitive datasets
- make automated decisions
- process biometric information
- transfer model-related data internationally.
Cybersecurity
VERY HIGH
Security, breach response, data governance and accountability are central features.
Read first
Definitions/data categories → data-subject rights → lawful processing → controller/processor duties → impact assessment → security/breach → transfers → sanctions.
Provisions / sections covered
IMPORTANT AREAS
Personal-data categories
The law distinguishes:
General personal data
such as:
- full name
- gender
- nationality
- religion
- marital status
- data combined to identify a person.
Specific personal data
including:
- health
- biometric data
- genetics
- criminal records
- child data
- personal financial data.
The official BPK database confirms these categories. (Database Peraturan \| JDIH BPK)
Data-subject rights
The framework includes rights concerning:
- information
- access
- correction
- deletion
- restriction
- portability
- objection
- withdrawal of consent
- compensation.
Processing
The Act establishes processing principles and lawful-processing grounds.
Controller/processor obligations
Controllers determine processing purposes/means; processors act on behalf of controllers.
Security
Controllers/processors must implement appropriate measures to protect personal data.
Impact assessment
The law provides for a Personal Data Protection Impact Assessment in specified high-risk circumstances.
International transfers
The Act regulates transfer outside Indonesia through an adequacy/safeguard framework.
Enforcement
The law contains:
- administrative sanctions
- dispute mechanisms
- prohibited-use provisions
- criminal penalties.
CURRENT REGULATORY DEVELOPMENT
The law is in force, while the Indonesian Government has continued working on implementing regulations and institutional arrangements. The Indonesian Ministry's 2025 regulatory-planning material records work on implementing regulations and the institutional body responsible for PDP. (Peraturan)
Subject-matter tags
- Lawful basis
- Consent
- Sensitive data
- Children's data
- Data subject rights
- Erasure and deletion
- Data portability
- Profiling
- Automated decision-making
- Impact assessment
- Data breach
- Cross-border transfers
- Data protection officer
- Controller and processor
- Biometrics
- Enforcement and penalties
- Transparency
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.