IndonesiaLaw on Personal Data Protection, enforcement and private right to sue
Law No. 27 of 2022 on Personal Data Protection, Articles 12, 57-58
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 17 October 2022.
An enforcement supervision rule binding public and private bodies.
As of 2 September 2026.
What it requires
- An app processing the personal data of an individual in Indonesia risks an administrative fine of up to 2 percent of annual revenue for a violation, and an individual whose data is misused has a statutory right to sue for compensation, though both the fine-imposition and compensation-claim procedures await a Government Regulation that had not yet issued as of the date shown.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Chapter XIV makes it a criminal offence to intentionally and unlawfully obtain or collect another person's personal data (Article 67(1), up to 5 years' imprisonment and/or a fine of up to Rp5,000,000,000), to disclose it (Article 67(2), up to 4 years and/or Rp4,000,000,000), or to use it (Article 67(3), up to 5 years and/or Rp5,000,000,000). Fabricating or falsifying personal data (Article 68) carries up to 6 years and/or a fine of up to Rp6,000,000,000, the highest individual exposure in the chapter. Article 70 extends liability to a corporation, whose management, controlling parties, or beneficial owners may be punished alongside or instead of the corporation, with a corporate fine of up to 10 times the individual maximum.
Penalty structure
Article 57(3) sets the administrative fine at up to 2 percent of annual revenue or annual income against the violation variable, with no fixed monetary cap alongside the percentage. Article 57(5) delegates the fine-imposition procedure to a Government Regulation. Government Regulation No. 33 of 2026 on the Implementing Regulation of Law No. 27 of 2022, State Gazette 2026 No. 88, was established and promulgated 16 July 2026 and covers the sanctions mechanism among its 225 articles; its content is not confirmed in the primary text, and this note relies on secondary legal commentary reporting its establishment, promulgation date, and gazette number. By its own terms it takes effect six months after promulgation, around 16 January 2027, so the fine-imposition procedure remains not yet in force as of the date shown even though the implementing regulation itself has now been enacted.
- Rule
- Turnover pct only
- As of
- 2 September 2026
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The personal data protection supervisory institution (lembaga) mandated by Article 58, appointed by and reporting to the President, with its structure set by Presidential Regulation. As of the date shown that institution had not been formally established; the draft Presidential Regulation remained in the Ministry of Law's harmonization stage, with the Ministry of Communication and Digital Affairs stating in July 2026 that it expected completion within about two months. Pending establishment, the Ministry of Communication and Digital Affairs, through its Directorate General for Digital Space Oversight, carries out the personal data protection supervisory function.
What it reaches
Obligation class
Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 12(1) gives a Personal Data Subject the right to sue and receive compensation for a violation, with the detailed procedure delegated to a Government Regulation not yet issued as of the date shown.
Article 57 subjects a violating controller to administrative sanctions, including written warning, temporary suspension of processing, deletion or destruction of data, and an administrative fine of up to 2 percent of annual revenue or income, with the fine-imposition procedure likewise delegated to a pending Government Regulation.
Enforcement authority sits with the not-yet-formally-established supervisory institution under Chapter IX, whose confirmed duties include compliance oversight, imposing sanctions, cross-border cooperation with peer regulators, and receiving complaints.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
Read the law
government (.go.id) legal-documentation network mirror
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.