Indonesia

Article 1 defines an Electronic Agent as a device of an Electronic System built to perform an action against particular electronic information automatically, on behalf of a Person, a definition that reaches a chatbot, an automated transaction system, or another AI-driven agent acting without a human directly initiating each step.

Article 21 allocates legal responsibility for an electronic transaction conducted through an Electronic Agent to the party who operates that Electronic Agent, and separately makes the operator of a failed Electronic Agent responsible for resulting loss where the failure was caused by a third party's direct action against the Electronic System.

Article 22 requires the operator of a certain Electronic Agent to provide a feature letting a user correct information while a transaction is still in process, with further detail on which operators this reaches left to a Government Regulation. Neither provision has been amended by the Law's 2016 or 2024 amendments.

Article 4 distinguishes specific personal data (the sensitive category) from general personal data, listing biometric data among health data, genetic data, criminal records, children's data, and personal financial data. The official elucidation to Article 4(2)(b) defines biometric data as data relating to a person's physical, physiological, or behavioral characteristics enabling unique identification, naming a facial image expressly as an example alongside fingerprint, retinal, and DNA data.

A direct search for suara (voice) in the elucidation returned zero hits, so voiceprint coverage rests on the general definitional language rather than an express example. As specific personal data, biometric data processing requires stricter consent under Article 21 and related provisions.

Article 114(1) requires a Personal Data Controller, on a failure of personal data protection, to give written notification no later than 3 x 24 hours to the data subject and to the institution (Lembaga). The period runs from the moment the failure is known with certainty, properly and reasonably (Article 114(2)). The notification must at least state the personal data disclosed, when and how it was disclosed, and the controller's handling and recovery efforts (Article 114(3)).

It must also give the details of the data protection officer or the contact person the controller designates (Article 114(4)). The controller must also notify the public where the failure disrupts public services or seriously affects the public interest (Article 115(1)). The controller must draw up documentation of each failure (Article 116(1)). Government Regulation No. 33 of 2026 was signed and promulgated in Jakarta on 16 July 2026. Under Article 225 it takes effect after 6 months counted from the date of promulgation.

Article 46(1) requires a Personal Data Controller to give written notification no later than 3 times 24 hours (72 hours) to the personal data subject and to the supervisory institution on a failure of personal data protection. The notification must at minimum describe the data disclosed, when and how it was disclosed, and the controller's handling and recovery efforts; in certain cases the controller must also notify the public.

Law No. 27 of 2022 (UU PDP) is Indonesia's first standalone, comprehensive personal-data statute, running lawful basis primarily through Article 20's consent model. Enforcement and rulemaking authority sits with a to-be-established supervisory institution under Chapter IX, referred to in the Act as lembaga; that institution had not been formally established as of 7 October 2026. The Act delegated the procedure for imposing administrative sanctions, including the fine, to a Government Regulation.

The Act likewise delegated the procedure for compensation claims to a Government Regulation. The House of Representatives' own news service records that Government Regulation No. 33 of 2026 has since been issued as the implementing regulation. The Act's own substantive duties are themselves statutory and binding now. The Act's text is cited from a city-government legal-documentation network (JDIH) copy, corroborated against the national Audit Board's legal database.

Article 165(1) requires a Personal Data Controller transferring personal data to a controller or processor outside Indonesia to ensure that the country where the recipient is located has a level of personal data protection equal to or higher than that of the Personal Data Protection Law. Where that is not met, the controller must ensure adequate and binding personal data protection (Article 165(2)).

Where neither is met, the controller must obtain the consent of the data subject (Article 165(3)). A transfer on the data subject's consent may be made only in the cases Article 173(2) lists, which include that the transfer is not repeated. The controller must assess the legal instrument it relies on before the transfer (Article 162(1)). Government Regulation No. 33 of 2026 was signed and promulgated in Jakarta on 16 July 2026. Under Article 225 it takes effect after 6 months counted from the date of promulgation.

Article 56 permits a Personal Data Controller to transfer personal data to a controller or processor outside Indonesia's legal territory, provided the recipient's country of domicile has a level of personal data protection equal to or higher than the Act's own standard. Later paragraphs of Article 56, which provide fallback mechanisms such as binding instruments or consent where the adequacy standard is not met, are not reproduced here. No data-localization mandate was found in the paragraphs read.

Article 184(1) subjects a breach of the provisions it lists, among them Article 165(1) to (3) on cross-border transfer, to administrative sanctions. The listed provisions also include Articles 114(1) and 115(1) on breach notification. Under Article 184(2) the sanctions are a written warning, temporary suspension of personal data processing, deletion or destruction of personal data, and an administrative fine, which may be combined.

Article 185(1) sets the administrative fine at up to 2% of the annual revenue or annual receipts of the controller or processor, applied to the violation variables. The variables are calculated on the basis of the negative impact, the duration, the type of data affected and the number of data subjects affected, among others (Article 185(2)). Article 185(3) allows the fine to be set as low as Rp0.00 or 0% for particular considerations.

Article 187 leaves the procedure for imposing administrative sanctions to a regulation of the institution (Peraturan Lembaga). Government Regulation No. 33 of 2026 was signed and promulgated in Jakarta on 16 July 2026. Under Article 225 it takes effect after 6 months counted from the date of promulgation.

Article 12(1) gives a Personal Data Subject the right to sue and receive compensation for a violation, with the detailed procedure delegated to a Government Regulation.

Article 57 subjects a violating controller to administrative sanctions, including written warning, temporary suspension of processing, deletion or destruction of data, and an administrative fine of up to 2 percent of annual revenue or income, with the fine-imposition procedure likewise delegated to the implementing Government Regulation.

Enforcement authority sits with the not-yet-formally-established supervisory institution under Chapter IX, whose confirmed duties include compliance oversight, imposing sanctions, cross-border cooperation with peer regulators, and receiving complaints.

Article 332 of the Criminal Code (Law No. 1 of 2023), as reworded by Law No. 1 of 2026, punishes three escalating forms of accessing a computer or electronic system without right or unlawfully: paragraph (1), accessing another person's computer or electronic system by any means, by up to six years' imprisonment or a fine of up to category V; paragraph (2), accessing a computer or electronic system by any means in order to obtain electronic information or documents, by up to seven years' imprisonment or a fine of up to category V; and paragraph (3), accessing a computer or electronic system by any means by violating, breaking through, exceeding or breaching a security system, by up to eight years' imprisonment or a fine of up to category VI.

Article 79(1) of the Criminal Code fixes the maximum fine for category V at Rp500,000,000 and for category VI at Rp2,000,000,000, and article 79(2) provides that a Government Regulation sets the amounts if the value of money changes. As first enacted, paragraphs (1) and (2) of article 332 each applied to a person who acted dengan sengaja dan tanpa hak atau melawan hukum (intentionally and without right or unlawfully).

Law No. 1 of 2026 restated all three paragraphs as applying to a person who acts tanpa hak atau melawan hukum (without right or unlawfully), with no express word for intentionally. Article 36(2) of the Criminal Code provides that a punishable offence is one committed intentionally, and that a negligent offence is punishable only where a law expressly says so.

The Criminal Code directs that references to articles 30 and 46 of the Electronic Information and Transactions Law are replaced by references to article 332. Law No. 1 of 2026 provides in its article IX that it takes effect on 2 January 2026. Under its article 624, the Criminal Code takes effect three years after its promulgation.

Article 9 gives a Creator or Copyright Holder the exclusive economic right to reproduce a work in any form, and paragraph (3) prohibits anyone from reproducing or commercially using a work without the Creator's or Copyright Holder's permission.

Article 44(1)(a) excepts the use, taking, reproduction, or alteration of a work, in whole or a substantial part, from infringement where the source is fully cited and the purpose is education, research, scientific writing, report preparation, or criticism or review of a matter, conditioned on not harming the Creator's or Copyright Holder's reasonable interest.

No provision of the Act creates a text-and-data-mining exception, so reproducing copyrighted text at scale to train a model rests, if at all, on Article 44(1)(a)'s narrow and interest-balancing research ground rather than on a dedicated exception, and a commercial training use sits outside that ground's plain terms.

Article 40(1) lists a database (basis data) among protected works at letter (n), alongside a compilation of works or data in machine-readable or other format at letter (p), and paragraph (2) protects such a work as an original work in its own right without prejudice to the copyright in the underlying material it compiles.

Article 46(2)(c) then carves a database out of the personal-use copying exception that otherwise lets anyone make a single copy of a published work without permission, expressly excluding the whole or a substantial part of a digital database from that exception.

Protection therefore runs through ordinary copyright in a database's compilation or arrangement rather than through a sui generis right in the underlying data itself; the Act creates no database right independent of that compilation-copyright theory.

Article 19 defines a Personal Data Controller to include every person, public body, and international organisation, and Article 20(1) requires a Controller to have a lawful basis before processing personal data.

Article 20(2) lists six lawful bases exhaustively: explicit consent for one or more stated purposes, performance of a contract to which the data subject is a party, compliance with the Controller's legal obligation, protection of the data subject's vital interest, performance of a public-interest or public-service task, or another legitimate interest balanced against the data subject's rights.

No basis in that list turns on the data having already been made public or being otherwise publicly accessible, so personal data collected from a public Indonesian website remains subject to the Act's ordinary lawful-basis, notice, and cross-border-transfer requirements on the same footing as personal data collected by any other means.

Article 21(1) requires a commercial bank to maintain cyber resilience, through processes that at least cover identifying assets, threats and vulnerabilities, protecting assets, detecting cyber incidents, and responding to and recovering from cyber incidents. Article 22(1) requires a commercial bank to carry out a self-assessment of its cyber security maturity level annually, as at the end of December.

Article 22(4) requires the bank to submit the result of that self-assessment to the Financial Services Authority as part of its current IT report. Article 23 requires a commercial bank to test its cyber security on the basis of vulnerability analysis and scenarios. Article 24(1) requires vulnerability-analysis testing to be carried out periodically. Article 25(1) requires scenario-based cyber security testing at least once in one year.

Article 25(3) requires the bank to report the result of scenario-based testing to the Financial Services Authority within 10 working days after the testing is completed. Article 26 requires a commercial bank to form a unit or function that handles cyber resilience and cyber security and is independent of the IT management function.

Article 27 provides for a written warning for a bank that violates Article 21(1), 22(1), 22(4), 23, 24, 25(1) or 26(1), and, if the bank has still not complied, a ban on issuing new products, a freeze on certain business activities, or a lower governance score in its soundness rating. The Regulation applies to a commercial bank, which includes the branch office of a bank domiciled abroad and a sharia business unit.

Article 73 provides that the Regulation takes effect after three months from the date of its promulgation. The Regulation was promulgated in Jakarta on 7 July 2022.

Article 1 defines an operator of vital information infrastructure as a state body, business entity or organization that owns or operates vital information infrastructure. Article 4 lists the sectors of vital information infrastructure, among them energy and mineral resources, transportation, finance, health, information and communication technology, food and defense.

Article 6 has the ministry or agency determine the electronic system as vital information infrastructure and the operator of the system in a vital sector as an IIV operator. Article 6 requires every electronic system operator in a vital sector to identify its vital information infrastructure at least once a year. Article 9 requires an operator to apply the information security standards and other security standards that the ministry or agency, or the Agency, sets.

Article 10 requires every operator to apply cybersecurity risk management effectively. Article 12 requires the operator to form an organizational Cyber Incident Response Team. Article 22 requires an operator to measure its cybersecurity maturity itself at least once a year. The Regulation was promulgated at Jakarta on 24 May 2022.

Every Electronic System Operator, government or private, must operate its Electronic System reliably and securely and is legally responsible for its proper operation. It must secure the system's components and have and run procedures and means to protect the system against disruption, failure, and loss. It must also provide a security system with prevention and countermeasure procedures against a threat or attack that causes such disruption, failure, or loss.

It must protect its users and the public from harm the system causes, and provide, train, and equip personnel responsible for securing the system's facilities and infrastructure. An operator running an Electronic Agent, an automated device carrying out actions on Electronic Information for a user, must additionally run a standard operating procedure meeting six security-control principles for user data and transactions. That operator must also test a transacting user's identity and authorization before completing a transaction.

Where a system failure or disruption with a serious impact results from another party's act against its Electronic System, such as an attack or intrusion, the Electronic System Operator must secure the affected Electronic Information and/or Electronic Document and report the incident immediately, at the first opportunity, to law enforcement officials and the relevant Ministry or Agency.

The Government Regulation states no numeric clock for that report, only immediacy at the first opportunity, and binds the same general population of government and private Electronic System Operators as this jurisdiction's Article 23/24(1)-(2) security-system duty.

Article 60(1) requires a commercial bank, where an IT incident has or may have caused a significant loss or disrupted the smooth running of the bank's operations, to send an initial notification within 24 hours and an IT incident report within 5 working days after the incident becomes known. Article 60(2) requires the initial notification to be sent to the Financial Services Authority in writing by electronic means, on the basis of the initial information available.

Article 60(4) requires the bank, where another authority sets a faster deadline for the notification or report than Article 60(1), to give the Financial Services Authority the notification and report at the same time as it meets that deadline. The elucidation of Article 60(1) defines an IT incident as a critical event, misuse or crime in the operation of IT, in the form of a cyber incident or a non-cyber incident.

The elucidation of Article 60(1) defines a cyber incident as a cyber threat, in the form of an attempt, activity or act, that causes an electronic system not to function as it should. Article 63 provides for a written warning for a bank that is late in sending the initial notification, and, if the bank has still not complied, a ban on issuing new products, a freeze on certain business activities, or a lower governance score in its soundness rating.

The Regulation applies to a commercial bank, which includes the branch office of a bank domiciled abroad and a sharia business unit. Article 73 provides that the Regulation takes effect after three months from the date of its promulgation. The Regulation was promulgated in Jakarta on 7 July 2022.

Article 13 requires the organizational Cyber Incident Response Team to report a cyber incident on vital information infrastructure to the sectoral team. Article 13 sets the deadline for that report at no later than 24 hours after the incident is found. Article 13 has the report go to the ministry or agency of the sector where no sectoral team has been formed. Article 14 requires the organizational team to handle the cyber incident on the infrastructure within its organization. The Regulation was promulgated at Jakarta on 24 May 2022.

The Regulation applies to every Electronic System operator, distinguishing operators in the public sphere from those in the private sphere, and requires each to disclose the minimum age and age range able to use its Product, Service, or Feature, to provide a mechanism verifying whether a user is a child, and to provide a mechanism for reporting a Product, Service, or Feature that violates or risks violating a child's rights.

Article 20(2) sets five age bands: ages 3 to 5, 6 to 9, 10 to 12, 13 to 15, and 16 up to under 18. Article 21(1)(a) lets a child under 13 hold an account only on a Product, Service, or Feature specifically designed for a child's use, carrying a low risk profile, and only with parental consent.

Article 22 requires an operator performing age verification to protect the privacy and personal data of users, particularly children, to calibrate the verification mechanism's level of assurance to the risk the Product, Service, or Feature poses to a child's rights, to process verification data only for that purpose and delete it once the purpose is fulfilled (subject to any statutory retention duty), and to give users a mechanism to dispute or seek correction of an age determination.

Oversight of compliance sits with the Minister, who may monitor, investigate reports and complaints, and act on the results of an investigation; the specific administrative sanction types are set out later in the Regulation's own text, not described here.

Article 43(c) of the Copyright Law excepts, from copyright infringement, taking actual (current) news, in whole or in part, from a news agency, broadcasting institution, newspaper, or similar source, on condition that the source is cited in full.

Article 43(d) separately excepts producing and disseminating copyrighted content through information and communication technology media where the activity is non-commercial, benefits the creator or a related party, or the creator has stated no objection to it. Neither clause is limited to a particular industry or medium, and no reported Indonesian decision applies either to a systematic news aggregator rather than an individual taking or quoting a published work.