Law on Personal Data Protection, comprehensive regime

Law No. 27 of 2022 on Personal Data Protection, State Gazette 2022 No. 196, signed and promulgated 17 October 2022

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 17 October 2022.

A comprehensive regime rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app that collects, uses, or discloses the personal data of an individual in Indonesia must establish a lawful basis under Article 20, most commonly consent, though the procedural detail for several related duties awaits implementing regulations that had not yet issued as of the date shown.

Who checks it

Audit expectation

continuous

Who audits it

Self

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Law No. 27 of 2022 (UU PDP) is Indonesia's first standalone, comprehensive personal-data statute, running lawful basis primarily through Article 20's consent model. Enforcement and rulemaking authority sits with a to-be-established supervisory institution under Chapter IX, referred to in the Act as lembaga; as of the date shown, that institution had not been formally established, with a draft Presidential Regulation on it still in stakeholder discussion.

Nine mandated Peraturan Pemerintah delegated implementing detail, including the fine-calculation procedure, the automated-decision objection procedure, and the compensation-claim procedure, and remained unissued as of the date shown, though the Act's own substantive duties are themselves statutory and binding now. The Act's text is cited from a city-government legal-documentation network (JDIH) copy, corroborated against the national Audit Board's legal database.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Read the law

government (.go.id) legal-documentation network mirror
corroborated against the national Audit Board's legal database (peraturan.bpk.go.id)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app