Processes personal data, in Indonesia

Government Regulation No. 71 of 2019 (PP PSTE), Pasal 24(3) · Read the law's page

• On a system failure or disruption with a serious impact resulting from another party's act against your Electronic System, such as an attack or intrusion, secure the affected Electronic Information and/or Electronic Document.
• Report the incident immediately, at the first opportunity, to law enforcement officials and the relevant Ministry or Agency; the Government Regulation states no numeric clock for this report, only immediacy.
• A violation can draw the same Article 100 administrative sanctions (written warning, an administrative fine of an amount this Government Regulation does not itself fix, temporary suspension, access termination, or removal from the operator registry) as this jurisdiction's security-system duty.
• This binds the same Electronic System Operator as this jurisdiction's Article 23/24(1)-(2) security-system duty; it adds an incident-reporting duty rather than reaching a different party.

Government Regulation No. 71 of 2019 (PP PSTE), Pasal 3, 23, 24(1)-(2), 31, 32, 39, 40 · Read the law's page

• Operate your Electronic System reliably and securely, and take legal responsibility for it operating as it should.
• Secure your Electronic System's components, and have and run procedures and means to protect the system against disruption, failure, and loss.
• Provide a security system covering procedures and technical measures, such as antivirus, anti-spam, a firewall, intrusion detection or prevention, or an information security management system, to prevent and counter a threat or attack against your Electronic System.
• Protect your users and the wider public from harm caused by the Electronic System you operate, and provide, train, and equip personnel tasked with and responsible for securing the system's facilities and infrastructure.
• Where you operate an Electronic Agent, an automated device that carries out an action on Electronic Information for a user without that user's direct intervention, such as an automated transaction or e-commerce system, additionally run a standard operating procedure meeting six security-control principles for user data and Electronic Transactions: confidentiality, integrity, availability, authenticity, authorization, and non-repudiation, and test a transacting user's identity and authorization before completing the transaction.
• A violation of Articles 23, 24, 31, 32, 39(2), or 40 can draw an administrative sanction from the Minister, a written warning, an administrative fine of an amount this Government Regulation does not itself fix, temporary suspension, access termination, or removal from the Electronic System Operator registry; the Article 100 sanction list does not name Article 3 itself.
• This binds every Electronic System Operator under Indonesian law, whether a government body (Penyelenggara Sistem Elektronik Lingkup Publik) or a private business (Penyelenggara Sistem Elektronik Lingkup Privat), with no sector or size gate.

Law No. 27 of 2022 on Personal Data Protection, Article 46 · Read the law's page

• An app that suffers a failure of personal data protection affecting an individual in Indonesia must give written notification within 72 hours to the affected individual and to the supervisory institution, describing the data disclosed and the remedial measures taken.

Law No. 27 of 2022 on Personal Data Protection, Article 56 · Read the law's page

• An app transferring the personal data of an individual in Indonesia, including a faceprint, voiceprint, or other biometric identifier, to a recipient outside Indonesia must ensure the recipient's country of domicile provides a level of personal data protection equal to or higher than this Law's standard.

Law No. 27 of 2022 on Personal Data Protection, Articles 12, 57-58 · Read the law's page

• An app processing the personal data of an individual in Indonesia risks an administrative fine of up to 2 percent of annual revenue for a violation, and an individual whose data is misused has a statutory right to sue for compensation, though both the fine-imposition and compensation-claim procedures are delegated to the implementing Government Regulation.

Law No. 27 of 2022 on Personal Data Protection, State Gazette 2022 No. 196, signed and promulgated 17 October 2022 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Indonesia must establish a lawful basis under Article 20, most commonly consent, though the procedural detail for several related duties is delegated to Government Regulation No. 33 of 2026.

Government Regulation No. 33 of 2026, Article 114 · Read the law's page

• An app that suffers a failure of personal data protection affecting an individual in Indonesia must give written notification within 3 x 24 hours (72 hours) to the affected individual and to the institution, stating the personal data disclosed, when and how it was disclosed, and the handling and recovery efforts, and must also give the data protection officer or contact person details.

Government Regulation No. 33 of 2026, Article 165 · Read the law's page

• An app that transfers the personal data of an individual in Indonesia to a recipient outside Indonesia must ensure the recipient's country has an equal or higher level of personal data protection; failing that, ensure adequate and binding protection; and failing both, obtain the data subject's consent, after assessing the legal instrument relied on.

Government Regulation No. 33 of 2026, Article 184 · Read the law's page

• An app processing the personal data of an individual in Indonesia that breaches a listed provision of the Regulation risks an administrative sanction: a written warning, temporary suspension of processing, deletion or destruction of the data, and an administrative fine of up to 2% of annual revenue or receipts.