IndonesiaLaw on Personal Data Protection, biometric data definition
Law No. 27 of 2022 on Personal Data Protection, Article 4(2)(b) and its official elucidation
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 17 October 2022.
A biometric privacy rule binding public and private bodies.
As of 29 August 2026.
What it requires
- An app that derives a faceprint, voiceprint, or other biometric identifier from an individual in Indonesia must treat it as specific personal data under Article 4 and obtain the stricter consent Article 21 requires for that category.
What it reaches
Excludes recording-derived identifiersNo
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 4 distinguishes specific personal data (the sensitive category) from general personal data, listing biometric data among health data, genetic data, criminal records, children's data, and personal financial data. The official elucidation to Article 4(2)(b) defines biometric data as data relating to a person's physical, physiological, or behavioral characteristics enabling unique identification, naming a facial image expressly as an example alongside fingerprint, retinal, and DNA data.
A direct search for suara (voice) in the elucidation returned zero hits, so voiceprint coverage rests on the general definitional language rather than an express example. As specific personal data, biometric data processing requires stricter consent under Article 21 and related provisions.
When LexLint raises it
processes_biometricsprocesses_voicetrains_modelscrawls_web
Read the law
government (.go.id) legal-documentation network mirror
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.