Act 2022
Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (Law Number 27 of 2022 on Personal Data Protection)
Effective: 17 Oct 2022
Plain-English summary
Indonesia's personal data protection law, enacted 17 October 2022. It sets lawful bases for processing, data subject rights, breach notification, data protection officers and administrative sanctions, and provides for a data protection agency reporting to the President. Controllers had two years from promulgation to comply (Article 74).
Who it applies to
All industries
Topics
Data Protection & Privacy
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Lawful basis, notice and data subject rights | Ongoing | — | source | |
Art. 20 requires a controller to have a lawful basis for processing, and Art. 21 requires notice of purpose, data types, retention period and rights when processing relies on consent. Arts. 5 to 15 give data subjects rights to information, correction, access, deletion, withdrawal of consent, objection to automated decisions, restriction, compensation and portability. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.