IndonesiaLaw on Personal Data Protection, enforcement and private right to sue
Law No. 27 of 2022 on Personal Data Protection, Articles 12, 57-58
In force since , under challenge in court.
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- none
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- An app processing the personal data of an individual in Indonesia risks an administrative fine of up to 2 percent of annual revenue for a violation, and an individual whose data is misused has a statutory right to sue for compensation, though both the fine-imposition and compensation-claim procedures are delegated to the implementing Government Regulation.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Chapter XIV makes it a criminal offence to intentionally and unlawfully obtain or collect another person's personal data (Article 67(1), up to 5 years' imprisonment and/or a fine of up to Rp5,000,000,000), to disclose it (Article 67(2), up to 4 years and/or Rp4,000,000,000), or to use it (Article 67(3), up to 5 years and/or Rp5,000,000,000). Fabricating or falsifying personal data (Article 68) carries up to 6 years and/or a fine of up to Rp6,000,000,000, the highest individual exposure in the chapter. Article 70 extends liability to a corporation, whose management, controlling parties, or beneficial owners may be punished alongside or instead of the corporation, with a corporate fine of up to 10 times the individual maximum.
Penalty structure
Article 57(3) sets the administrative fine at up to 2 percent of annual revenue or annual income against the violation variable, with no fixed monetary cap alongside the percentage. Article 57(5) delegates the fine-imposition procedure to a Government Regulation. Government Regulation No. 33 of 2026 on the Implementing Regulation of Law No. 27 of 2022, State Gazette 2026 No. 88, was established and promulgated and covers the sanctions mechanism among its 225 articles; its content is not confirmed in the primary text, and this note relies on secondary legal commentary reporting its establishment, promulgation date, and gazette number. By its own terms it takes effect six months after promulgation, around .
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The personal data protection supervisory institution (lembaga) mandated by Article 58, appointed by and reporting to the President, with its structure set by Presidential Regulation. As of that institution had not been formally established; the draft Presidential Regulation remained in the Ministry of Law's harmonization stage, with the Ministry of Communication and Digital Affairs stating in July 2026 that it expected completion within about two months. Pending establishment, the Ministry of Communication and Digital Affairs, through its Directorate General for Digital Space Oversight, carries out the personal data protection supervisory function.
Settledness
Article 59(a) gives the task of setting the policy and strategy that guide data subjects and controllers to the 'lembaga' (institution) that Article 58(2) names to carry out personal data protection, so that institution is the body whose guidance would apply.
- As of
- Under challenge
- Yes
- Open questions
- Which 'ketentuan peraturan perundang-undangan' ('provisions of laws and regulations') govern a data subject's suit and the compensation recoverable under Article 12(1) of Law No. 27 of 2022?
- What does 'variabel pelanggaran' ('violation variable') mean as the base to which the 2 percent cap on the administrative fine applies under Article 57(3) of Law No. 27 of 2022?
What it makes you log
Logging duty
Article 12 gives the data subject a right to sue for and receive compensation for a violation of the processing of their data, with the procedure left to a Government Regulation, and Articles 57 and 58 set administrative sanctions and the role of the supervisory institution. None requires a log or record. Article 57 lists Article 31 (the duty to record processing) among the provisions whose breach is sanctioned; that duty is coded on the comprehensive row.
- Kind
- None
- As of
What this law does
Article 12(1) gives a Personal Data Subject the right to sue and receive compensation for a violation, with the detailed procedure delegated to a Government Regulation.
Article 57 subjects a violating controller to administrative sanctions, including written warning, temporary suspension of processing, deletion or destruction of data, and an administrative fine of up to 2 percent of annual revenue or income, with the fine-imposition procedure likewise delegated to the implementing Government Regulation.
Enforcement authority sits with the not-yet-formally-established supervisory institution under Chapter IX, whose confirmed duties include compliance oversight, imposing sanctions, cross-border cooperation with peer regulators, and receiving complaints.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .