The enactment of the Personal Data Protection (PDP) Law marks a significant milestone in Indonesia’s data protection landscape, establishing the first comprehensive legal framework for safeguarding personal data. This legislation ensures that personal data is protected both in traditional forms of sharing and within electronic-based systems. The new law calls for all stakeholders, including businesses and individuals, to understand and comply with these changes, as personal data is now formally protected under Indonesian law.

Previous personal data protection regulations and sector-specific rules remain in effect, provided they do not conflict with the new PDP Law.

The PDP Law covers 16 main topics, structured as follows:

1. Main Principles of the PDP Law

2. Types of Personal Data

3. Rights of Personal Data Subjects

4. Personal Data Processing

5. Obligations of the Data Controller

6. Obligations of the Data Processor

7. Personal Data Protection Officers

8. Domestic and International Data Transfers

9. Regulatory Institutions

10. International Cooperation

11. Public Participation

12. Dispute Resolution and Applicable Procedures

13. Prohibitions on the Use of Personal Data

14. Administrative Sanctions

15. Criminal Penalties

16. Transitional Provisions

    
    

Officially enacted on October 17, 2022, by President Joko Widodo, the PDP Law successfully passed through the Indonesian House of Representatives after extensive deliberation. To ensure a smooth transition and compliance with the new law, stakeholders—particularly Controllers and Processors—are granted a two-year transition period, effectively enforced on 17 October 2024 to align their operations with the PDP Law’s requirements.