Indonesia PDP Law compliance and requirements, built into the way you handle personal data.

What it is

What is the Indonesia PDP Law and what is it used for?

The PDP Law, formally Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi, is Indonesia's first comprehensive statute on personal data. It replaced a patchwork of sectoral rules with one set of obligations covering how personal data is collected, used, stored, shared, transferred abroad and destroyed.

The law speaks in three roles. The controller (Pengendali Data Pribadi) decides why and how personal data is processed. The processor (Prosesor Data Pribadi) processes it on the controller's behalf. The data subject (Subjek Data Pribadi) is the individual the data relates to. Many businesses act as both, for different activities.

Current text. Law No. 27 of 2022, enacted and promulgated on 17 October 2022 and in force from that date. Article 74 gave controllers, processors and other parties two years to adjust, a period that ended in October 2024. Several procedures are left to a Government Regulation, and supervision is assigned to an agency established by the President; confirm the current status of both with your legal advisers before relying on either.

Who it is for

Who needs to comply with the Indonesia PDP Law?

Article 2 reaches beyond Indonesia's borders: it covers processing inside Indonesian jurisdiction and processing elsewhere that has legal consequences in Indonesia or for Indonesian citizens abroad. Organisations usually come to Sterling from one of four directions:

• Your customers hand you a privacy questionnaire. Banks, insurers, telecoms and platforms in Indonesia now ask suppliers how they meet the PDP Law, and want to see records rather than a policy statement.
• A tender or partnership asks for compliance evidence. Government and enterprise buyers increasingly write data protection terms into contracts; your answer needs to match what you actually do.
• A regulator or a data subject tests you. A complaint, an access request or an incident exposes whether rights, breach and retention procedures actually work.
• Your group operates across borders. A parent company, a shared service centre or an offshore processor handles Indonesian data, and the group needs one approach that also respects the law's transfer conditions.

Requirements

What are the main Indonesia PDP Law requirements?

The law has sixteen chapters and 76 articles. The summary below follows the chapters that shape a compliance programme, in plain English and at title level; it is an orientation, not a legal reading, and we work alongside your legal advisers on interpretation.

• Chapter I General provisions (Art. 1–2): the defined roles of controller, processor and data subject, and the territorial reach of the law.
• Chapter III Types of personal data (Art. 4): general personal data and specific personal data, the latter including health, biometric, genetic, criminal record, children's and personal financial data.
• Chapter IV Rights of data subjects (Art. 5–15): information, correction, access, deletion, withdrawal of consent, objection to automated decisions, restriction, compensation and portability.
• Chapter V Processing of personal data (Art. 16–18): how processing is carried out, from collection to deletion.
• Chapter VI Obligations of controllers and processors (Art. 19–54): a legal basis for each purpose, impact assessment for high-risk processing, written breach notification within three times 24 hours, and a data protection officer where the law requires one.
• Chapter VII Transfer of personal data (Art. 55–56): conditions for sending personal data outside Indonesia.
• Chapters VIII and XIV Administrative sanctions and criminal provisions: the consequences of breaching the law.
• Chapter IX Institutions (Art. 58–61): the supervisory agency established by, and responsible to, the President.
• Chapter XV Transitional provisions (Art. 74–75): the two-year adjustment period, now ended.

Compliance route

How do you comply with the Indonesia PDP Law?

There is no audit to pass and no certificate at the end. Compliance is a state you maintain and must be able to show at any moment. The route is regulatory compliance: build the programme, run it and keep proof that it runs.

1. 01
   Establish your roles and reach.Identify the entities, systems and activities that touch personal data, decide where you act as controller or processor, and confirm whether Article 2 reaches operations outside Indonesia.
2. 02
   Gap analysis: compare current practice with the law.Map data flows, vendors and transfers, test notices, consent, rights handling, security and breach response, and agree actions with owners and dates.
3. 03
   Build and operate the controls.Record legal bases, complete impact assessments, update notices and contracts, appoint a data protection officer if required and train the people who handle data.
4. 04
   Test through internal audit and management review.We audit the programme against the law, rehearse a breach, trace a sample of requests and close findings with evidence.
5. 05
   Keep it current and ready for scrutiny.Track implementing regulations and agency guidance, review new products and vendors, and answer client due diligence from evidence that already exists.

Check the route before you sign. No body issues a certificate of compliance with Law No. 27 of 2022; treat any offer of a "PDP Law certificate" with suspicion. If you want independent certification, ISO/IEC 27701 is audited by accredited certification bodies under the Global ACI arrangement; verify the body's accreditation directly. The certification buyer's checklist

Cost

How much does Indonesia PDP Law compliance cost?

The effort follows your data, not your headcount alone: one customer database and a few vendors is a different job from a platform processing specific personal data at scale through many processors. We scope first, then fix the fee.

Timeline

How long does Indonesia PDP Law compliance take?

As an estimate, most programmes need three to nine months. The short end suits organisations that already run an information security system and keep a data inventory; the long end applies where apps, websites or core systems need engineering work for consent, retention or deletion.

Tell us about any contract or client deadline at the outset, and we will say plainly what can be ready by then.

Your engagement

What your Indonesia PDP Law engagement includes

One team takes you from first mapping to a programme that runs, under one all-inclusive proposal. Sterling does not certify, attest or validate compliance: we build the programme, and judgement of compliance rests with the supervisory agency and, in disputes, the courts.

• Scope, gap analysis and plan

  Roles, reach and priorities agreed, with owners and dates.

• Records, notices and contracts

  Processing records, privacy notices, consent wording and processor terms drafted with your team for your legal advisers' review.

• Effivity ISO & GRC software

  Registers, requests and incidents run in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal audit and management review

  An audit of the programme against the law, with findings closed on evidence.

• Readiness for scrutiny

  An evidence pack for client due diligence, complaints and agency enquiries.

Delivery follows Sterling OS™. Choose Design™ if your team builds the programme with our guidance, or Drive™ if we manage the work for you; the two are alternative support levels, not stages. After the programme is running, Sustain™ keeps it current, and Automate™ is Effivity.

No certificate exists under the PDP Law; compliance is judged by the supervisory agency and the courts.

Often combined with

Standards organisations pair with Indonesia PDP Law

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.