IndonesiaLaw on Personal Data Protection, comprehensive regime
Law No. 27 of 2022 on Personal Data Protection, State Gazette 2022 No. 196, signed and promulgated
In force since , under challenge in court.
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Audit expectation
- continuous
- Who audits it
- Self
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Indonesia must establish a lawful basis under Article 20, most commonly consent, though the procedural detail for several related duties is delegated to Government Regulation No. 33 of 2026.
These lines are LexLint's reading of the law's text. Also read by: Constitutional Court of Indonesia, Decision No. 108/PUU-XX/2022 (Articles 1(4), 2(2) and 19 of Law No. 27 of 2022), pronounced (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
Article 59(a) gives the task of setting the policy and strategy that guide data subjects and controllers to the 'lembaga' (institution) that Article 58(2) names to carry out personal data protection, so that institution is the body whose guidance would apply.
- As of
- Case link
- https://www.mkri.id/public/content/persidangan/putusan/putusan_mkri_8970_1681459239.pdf
- Case citation
- Constitutional Court of Indonesia, Decision No. 108/PUU-XX/2022 (Articles 1(4), 2(2) and 19 of Law No. 27 of 2022), pronounced
- Under challenge
- Yes
- Open questions
- When does conduct outside Indonesia count as one that 'memiliki akibat hukum' ('has legal consequences') in Indonesia's jurisdiction under Article 2(1)(b) of Law No. 27 of 2022, so that a foreign app falls within the Act?
What it makes you log
Who may demand the log
Data subject
Logging duty
Article 31 requires the controller to record all of its personal data processing activities, and Article 52 extends it to processors. Article 32(1) gives the data subject access to the processed data together with the processing trail (rekam jejak) for as long as the data is kept. The Act names no log fields and states no retention period for the record itself, tying the trail to the retention of the data. It names no regulator access to the record; the supervisory institution is still to be set up by Presidential decree. The duty in Article 47 to demonstrate accountability and the impact assessment in Article 34 are separate provisions; the row's existing audit values come from Article 34 and are unchanged.
- Kind
- Explicit
- As of
- Provision
- Law No. 27 of 2022, Articles 31 and 32(1)
- Trigger
- personal_data_processing
What this law does
Law No. 27 of 2022 (UU PDP) is Indonesia's first standalone, comprehensive personal-data statute, running lawful basis primarily through Article 20's consent model. Enforcement and rulemaking authority sits with a to-be-established supervisory institution under Chapter IX, referred to in the Act as lembaga; that institution had not been formally established as of . The Act delegated the procedure for imposing administrative sanctions, including the fine, to a Government Regulation.
The Act likewise delegated the procedure for compensation claims to a Government Regulation. The House of Representatives' own news service records that Government Regulation No. 33 of 2026 has since been issued as the implementing regulation. The Act's own substantive duties are themselves statutory and binding now. The Act's text is cited from a city-government legal-documentation network (JDIH) copy, corroborated against the national Audit Board's legal database.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .