Indonesia's Personal Data Protection Law sets rules for processing personal data by individuals, companies, public bodies and international organisations. It sets out rights for data subjects, duties for controllers and processors, rules on transfers abroad, administrative sanctions of up to two per cent of annual revenue and criminal penalties.
Free account needed to download. You come straight back to the file.
Who it is for. Any person, public body or international organisation that processes personal data in Indonesia, or acts abroad with legal effect in Indonesia or on Indonesian citizens. Purely personal or household use by an individual is excluded.
What this list covers. Law No. 27 of 2022, promulgated 17 October 2022. Read in the Indonesian text as annotated by the Constitutional Court (Anotasi 2025, mkri.id, which records ruling 151/PUU-XXII/2024 on Art. 53(1)(b)), and in the ABNR bilingual edition (translation by Wishnu Basuki, updated 18 October 2022), a law-firm translation and not an official one. Where they differ we followed the Indonesian. The official portals peraturan.go.id and JDIH Kemenkeu could not be fetched. Press reports mention an implementing government regulation, PP 33/2026, which we did not read, and the data protection institution was reported as not yet established. Check for later changes.: 89 articles. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| Art. 2 | Who the law reaches | It covers any person, public body or international organisation acting in Indonesia, and acts abroad that have legal effect in Indonesia or on Indonesian citizens. Purely personal or household use by an individual is outside it. |
| Art. 4 | General and specific personal data | Sort your data into specific data (health, biometric, genetic, criminal records, children's, personal financial and others set by law) and general data such as name, gender, nationality, religion, marital status and combinable identifiers. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 5 | Right to information | Tell people who is asking for their data, on what legal ground, for what purpose, how the data will be used, and who answers for the request. |
| Art. 6 | Right to complete and correct | Let people complete, update and fix errors or inaccuracies in their data, in line with the purpose it is processed for. |
| Art. 7 | Right of access and a copy | Give people access to their data and a copy, in line with the law. The copy is free, except in certain cases where a charge is allowed. |
| Art. 8 | Right to end processing and erase | Let people ask you to stop processing, erase or destroy their data, in line with the law. |
| Art. 9 | Right to withdraw consent | Let people withdraw the consent they gave you for processing their data. |
| Art. 10 | Right to object to automated decisions | Let people object to a decision made only by automated processing, including profiling, that has a legal effect or a significant impact on them. A government regulation sets how objections are made. |
| Art. 11 | Right to delay or restrict | Let people postpone or restrict the processing of their data, in proportion to the purpose of the processing. |
| Art. 12 | Right to sue and claim damages | People may bring a claim and receive compensation for a breach in processing their data. A government regulation sets what counts as a breach and how compensation is decided. |
| Art. 13 | Right to data in a usable format and portability | On request, give people their data in a structured, commonly used or machine-readable form, and let them send it to another controller where the systems can exchange it securely. |
| Art. 14 | How rights are claimed | Expect people to claim the rights in Arts. 6 to 11 by a written request to you, sent electronically or on paper. Set up a way to receive and record these requests. |
| Art. 15 | Exceptions to the rights | Some rights (Arts. 8, 9, 10(1), 11, 13(1)-(2)) give way for defence and security, law enforcement, state administration, financial-sector supervision, and statistics or scientific research, and only to apply a law. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 16(1) | What counts as processing | Treat every stage as processing: collecting, analysing, storing, correcting, displaying, publishing, transferring, disclosing, erasing and destroying. |
| Art. 16(2)(a)-(d) | Principles: limited, purposeful, accurate | Collect only a limited, specific amount, lawfully, fairly and openly. Use data only for its purpose, respect people's rights, and keep it accurate, complete, not misleading, current and provable. |
| Art. 16(2)(e)-(h) | Principles: secure, notified, deleted, accountable | Protect data from unauthorised access, disclosure, change, misuse, destruction or loss. Say what you do and when protection fails. Erase when retention ends or on request, and be able to prove compliance. |
| Art. 17 | Cameras and visual data devices | Fit visual data devices in public places or public services only for security, disaster prevention or traffic work. Post a notice in the area and do not use them to identify people. Crime prevention and law enforcement are exempt from the last two. |
| Art. 18 | Joint controllers | Where two or more controllers process together, record in an agreement each one's role, duties and relationship, set shared purposes and methods, and name one contact person together. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 19 | Who is a controller or processor | A controller or processor can be any person, a public body or an international organisation, so the duties below reach all of them. |
| Art. 20(1) | Have a basis for processing | Have a basis for processing personal data before you process it. |
| Art. 20(2)(a) | Explicit valid consent | Where consent is the basis, get the person's explicit, valid consent for one or more specific purposes that you have told them about. |
| Art. 20(2)(b)-(f) | Other bases for processing | Other bases are performing a contract with the person or acting at their request before one, a legal duty, protecting vital interests, a public task or official authority, and other legitimate interests, weighed against their rights. |
| Art. 21(1) | Information given when relying on consent | When you rely on consent, tell people the legality, purpose, type and relevance of data, retention period, details collected, processing period and their rights. |
| Art. 21(2) | Tell people before changes | If any of that information changes, tell the person before the change takes place. |
| Art. 22(1)-(3) | Written or recorded consent | Obtain consent in writing or on record, electronically or on paper. Either form carries the same legal force. |
| Art. 22(4)-(5) | Consent requests must be clear | Where a consent request covers other matters, make it stand out from them, easy to understand and reach, in plain Indonesian. Consent that fails this, or the written or recorded form, is void. |
| Art. 23 | Void contract clauses | A contract clause asking for data processing without the person's explicit, valid consent is void, so do not hide consent inside general terms. |
| Art. 24 | Prove consent | Keep proof of the consent each person gave, and be able to show it when you process their data. |
| Art. 25 | Children's data | Process children's data in a specific way, and obtain consent from the child's parent or guardian as the law requires. |
| Art. 26 | Data of persons with disabilities | Process data of people with disabilities in a specific way, communicate with them by suitable means, and obtain consent from the person or their guardian. |
| Art. 27 | Limited, specific, lawful, transparent processing | Collect only what the purpose needs, state the purpose when you collect, follow the law, and make sure people can easily see and understand what is processed and how. |
| Art. 28 | Process for the stated purpose | Process personal data only for the purpose it is processed for. |
| Art. 29 | Accuracy, completeness and consistency | Keep data accurate, complete and consistent as the law requires, and verify it to do so. |
| Art. 30 | Correct data within three days | Update or correct errors within three days (3 x 24 hours) of a request, and tell the person the outcome. |
| Art. 31 | Record processing activities | Keep a record of all your processing activities. |
| Art. 32 | Access within three days | Give people access to the data processed about them, with processing records for the retention period, within three days (3 x 24 hours) of the request. |
| Art. 33 | Refuse access to changes in some cases | Refuse a person access to changes to their data if it would endanger the safety or physical or mental health of anyone, expose another person's data, or go against national defence and security. |
| Art. 34(1) | Impact assessment for high-risk processing | Carry out a data protection impact assessment where processing is likely to pose a high risk to people, weighing the risks, the steps to reduce them and compliance with the law. |
| Art. 34(2) | What counts as high risk | High risk includes automated decisions with legal or significant effects, specific data, large scale, systematic evaluation, scoring or monitoring, matching datasets, new technology, and limits on people's rights. |
| Art. 35 | Protect and secure data | Prepare and apply technical and operational measures against unlawful processing, and set the level of security by the nature and risk of the data. |
| Art. 36 | Keep data confidential | Keep personal data confidential while processing it. |
| Art. 37 | Supervise those you control | Supervise every party involved in processing personal data under your control. |
| Art. 38 | Protect against unauthorised processing | Protect personal data from processing that the law does not permit. |
| Art. 39 | Prevent unauthorised access | Prevent unauthorised access by using a security system and, for electronic processing, a reliable, secure and accountable electronic system, as the law requires. |
| Art. 40 | Stop processing within three days of withdrawal | Stop processing when consent is withdrawn, and do so within three days (3 x 24 hours) of receiving the withdrawal request. |
| Art. 41(1)-(2) | Delay or restrict processing | Delay or restrict all or part of the processing within three days (3 x 24 hours) of a request, unless the law, the safety of others or a written agreement does not allow it. |
| Art. 41(3) | Tell the person it was restricted | Notify the person that processing has been delayed or restricted. |
| Art. 42 | End processing | End processing when retention has run out, the purpose is met or the person asks, as the law requires. |
| Art. 43 | Erase data | Erase data that is no longer needed for the purpose, after withdrawn consent, on request, or where it was obtained or processed unlawfully. |
| Art. 44 | Destroy data | Destroy data when retention has run out and the record schedule says so, on request, where no legal case is pending, or where it was obtained or processed unlawfully. |
| Art. 45 | Tell people about erasure or destruction | Notify the person when you erase or destroy their data. |
| Art. 46(1) | Notify a protection failure within three days | If personal data protection fails, send written notice within three days (3 x 24 hours) to the affected people and to the institution the law sets up to oversee data protection. |
| Art. 46(2) | What the notice must contain | Say which data was exposed, when and how it happened, and what you are doing to handle it and recover. |
| Art. 46(3) | Tell the public in some cases | In certain cases, such as a failure that disrupts public services or seriously affects the public interest, also notify the public. |
| Art. 47 | Be responsible and show it | Take responsibility for processing, and be able to show how you meet the data protection principles. |
| Art. 48(1)-(2) | Tell people about mergers and similar changes | A company that merges, splits, is acquired, consolidates or dissolves must notify people before and after, either directly or by general announcement in the media. |
| Art. 48(3)-(5) | Data when a company winds up | When a company dissolves or is dissolved, store, transfer, erase or destroy the data under the law and notify the people affected. A government regulation sets the notice procedure. |
| Art. 49 | Follow the regulator's orders | Carry out orders from the institution responsible for personal data protection, whether you are a controller or a processor. |
| Art. 50 | Exemptions for state purposes | Several controller duties (Arts. 30, 32, 36, 42, 43(1)(a)-(c), 44(1)(b), 45, 46(1)(a)) give way for defence and security, law enforcement, state administration and financial supervision, only to apply a law. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 51(1)-(3) | Processors follow instructions | A processor appointed by a controller processes only on the controller's instructions and under this law. The controller stays responsible for that processing. |
| Art. 51(4)-(5) | Sub-processors need written approval | A processor may bring in another processor, but only after the controller approves in writing. |
| Art. 51(6) | Processing outside instructions | If a processor goes beyond the controller's instructions and purposes, that processing becomes the processor's own responsibility. |
| Art. 52 | Controller duties that also bind processors | Processors must also meet the controller duties on accuracy (29), records (31), security (35), confidentiality (36), supervision (37) and protection against unlawful processing and access (38, 39). |
| Ref | Control | What it requires |
|---|---|---|
| Art. 53(1) | When to appoint a data protection officer | Appoint one for public-service processing, or where core activity needs large-scale regular and systematic monitoring, or large-scale specific or criminal-offence data. A 2025 court ruling treats these as alternatives. |
| Art. 53(2)-(3) | Who the officer can be | Choose the officer on professional qualities, legal knowledge, data protection practice and ability to do the tasks. They can come from inside or outside the organisation. |
| Art. 54(1) | Minimum duties of the officer | The officer informs and advises on compliance, monitors compliance with the law and your policies, advises on impact assessments and monitors performance, and coordinates and acts as the contact point. |
| Art. 54(2)-(3) | Risk focus and further rules | The officer weighs the risks of processing by its nature, scope, context and purposes. A government regulation will set more detail on officers. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 55 | Transfers within Indonesia | A controller may transfer data to another controller in Indonesia, and both the sender and the receiver must protect it under this law. |
| Art. 56(1)-(2) | Transfers abroad: equal protection | You may transfer data to a controller or processor abroad if its country protects data to a level equal to or higher than this law, which you must make sure of before sending. |
| Art. 56(3) | Transfers abroad: binding safeguards | If the destination country does not give equal protection, make sure adequate and binding protection for the data applies. |
| Art. 56(4) | Transfers abroad: consent | If neither equal protection nor binding safeguards exist, obtain the person's consent before transferring. A government regulation adds detail. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 57(1) | Which breaches draw sanctions | Breaching most controller and processor duties in Chapter VI, and Arts. 55(2) and 56(2)-(4), can lead to administrative sanctions. The full list of articles is in Art. 57(1). |
| Art. 57(2) | Forms of sanction | Sanctions are a written warning, a temporary halt to processing, erasure or destruction of data, and an administrative fine. |
| Art. 57(3) | Fine cap of two per cent | An administrative fine is capped at 2 per cent of annual income or annual revenue, tied to the violation variable. A government regulation sets how the fine is worked out. |
| Art. 57(4)-(5) | Who imposes sanctions | The institution responsible for data protection imposes the sanctions. A government regulation sets the procedure. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 58 | The institution that oversees data protection | The President sets up the institution that runs data protection, which answers to the President. A presidential regulation will set out its details. |
| Art. 60 | What the institution can do | Expect it to monitor compliance, issue orders and sanctions, receive complaints, summon people, request documents and experts, and inspect electronic systems and premises, including with a third party. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 64 | Resolving disputes | Disputes go through arbitration, the courts or other alternative dispute bodies. Electronic information and documents count as evidence, and a trial can be closed to protect personal data. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 65 | Do not acquire, disclose or use data unlawfully | No one may unlawfully obtain or collect another person's data to benefit anyone and harm the data subject, nor unlawfully disclose or use it. |
| Art. 66 | Do not falsify personal data | No one may create false personal data or falsify data to benefit anyone and cause harm to another person. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 67(1) | Unlawfully obtaining or collecting data | Intentionally and unlawfully obtaining or collecting another's data to gain a benefit and harm the subject carries up to 5 years in prison and/or a fine of up to Rp5 billion. |
| Art. 67(2) | Unlawfully disclosing data | Intentionally and unlawfully disclosing another person's data carries up to 4 years in prison and/or a fine of up to Rp4 billion. |
| Art. 67(3) | Unlawfully using data | Intentionally and unlawfully using another person's data carries up to 5 years in prison and/or a fine of up to Rp5 billion. |
| Art. 68 | Falsifying personal data | Intentionally creating false data or falsifying data to gain a benefit and harm another carries up to 6 years in prison and/or a fine of up to Rp6 billion. |
| Art. 69 | Additional penalties | On top of those sentences, a court may order seizure of profits or assets obtained from the offence and payment of compensation. |
| Art. 70(1)-(3) | Corporations: who is liable and fine ceiling | Where a corporation offends, the sentence may fall on managers, controlling shareholders, those giving orders, beneficial owners and/or the company. A company can only be fined, up to 10 times the maximum fine. |
| Art. 70(4) | Corporations: additional penalties | A company may also face seizure of gains, suspension or closure of business, a permanent ban on certain acts, compulsory performance of neglected duties, compensation, licence revocation or dissolution. |
| Art. 71-73 | Paying fines and compensation | A fine is payable within one month of a final judgment, extendable by one month. Unpaid fines lead to seizure of assets, or imprisonment for individuals, or for a company suspension of business for up to 5 years. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 74 | Two years to comply | Controllers, processors and others involved in processing had to bring their practice into line within two years of the law's promulgation on 17 October 2022. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
It can. Art. 2 covers acts outside Indonesia that have legal effect in Indonesia or on Indonesian citizens abroad, as well as everything done within Indonesia.
Administrative sanctions in Art. 57 range from a warning to a fine of up to 2 per cent of annual income or revenue. Chapter XIV adds prison terms of 4 to 6 years and fines of Rp4 to 6 billion for individuals, and a fine of up to ten times that for corporations.
Several duties run to three days (3 x 24 hours): correcting data (Art. 30), giving access (Art. 32), stopping processing after withdrawal (Art. 40), restricting processing (Art. 41(1)) and notifying a protection failure (Art. 46(1)).
Art. 53(1) requires one for public-service processing, large-scale regular and systematic monitoring, or large-scale processing of specific or criminal-offence data. A 2025 Constitutional Court ruling reads these triggers as alternatives, not cumulative.
No. It is a plain-English summary in our own words, and the Indonesian text of the law is the authority. A government regulation and a data protection institution are still developing the details, so check the current texts.