IndonesiaLaw on Personal Data Protection, cross-border transfer
Law No. 27 of 2022 on Personal Data Protection, Article 56
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of an individual in Indonesia, including a faceprint, voiceprint, or other biometric identifier, to a recipient outside Indonesia must ensure the recipient's country of domicile provides a level of personal data protection equal to or higher than this Law's standard.
These lines are LexLint's reading of the law's text. Also read by: Constitutional Court of Indonesia, Decision No. 137/PUU-XXIII/2025 (Article 56(1) to (4) of Law No. 27 of 2022), pronounced (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://www.mkri.id/public/content/persidangan/putusan/putusan_mkri_13644_1768797987.pdf
- Case citation
- Constitutional Court of Indonesia, Decision No. 137/PUU-XXIII/2025 (Article 56(1) to (4) of Law No. 27 of 2022), pronounced
- Open questions
- What counts as 'Pelindungan Data Pribadi yang memadai dan bersifat mengikat' ('adequate and binding personal data protection') under Article 56(3) of Law No. 27 of 2022 when the recipient's country does not meet the equal-or-higher standard of Article 56(2)?
What it makes you log
Logging duty
Article 56 lets a controller transfer personal data abroad only to a country with an equal or higher level of protection, failing which adequate binding protection must be ensured, failing which the data subject's consent is needed. It asks for no log or record; the processing record of Article 31 is a separate provision this row does not cite.
- Kind
- None
- As of
What this law does
Article 56 permits a Personal Data Controller to transfer personal data to a controller or processor outside Indonesia's legal territory, provided the recipient's country of domicile has a level of personal data protection equal to or higher than the Act's own standard. Later paragraphs of Article 56, which provide fallback mechanisms such as binding instruments or consent where the adequacy standard is not met, are not reproduced here. No data-localization mandate was found in the paragraphs read.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .