IndonesiaPersonal Data Protection Law, scraped personal data
Law No. 27 of 2022, Article 20, Personal Data Protection Law
In force since .
A personal data rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Audit expectation
- none
What it requires
- Have a lawful basis under Article 20 before collecting or otherwise processing the personal data of an individual in Indonesia, including data collected from a public website; the Act carries no basis keyed to the data already being public.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 19 and 20 define who is a controller and require a lawful basis for processing, listing the permitted bases. The cited articles impose no duty to create, keep, produce or review a log or record; the Act's other articles on records, security and notification are not cited by this row. Article 2(1) applies the Act to a legal act regulated by it done within Indonesia or done abroad with legal effect in Indonesia.
- Kind
- None
- As of
What this law does
Article 19 defines a Personal Data Controller to include every person, public body, and international organisation, and Article 20(1) requires a Controller to have a lawful basis before processing personal data.
Article 20(2) lists six lawful bases exhaustively: explicit consent for one or more stated purposes, performance of a contract to which the data subject is a party, compliance with the Controller's legal obligation, protection of the data subject's vital interest, performance of a public-interest or public-service task, or another legitimate interest balanced against the data subject's rights.
No basis in that list turns on the data having already been made public or being otherwise publicly accessible, so personal data collected from a public Indonesian website remains subject to the Act's ordinary lawful-basis, notice, and cross-border-transfer requirements on the same footing as personal data collected by any other means.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .