Skip to main content
NOPE
In Effect Law Data Protection

Indonesia UU PDP

Indonesia Personal Data Protection Law (UU PDP / Law 27/2022)

Indonesia's comprehensive data protection law. Health and children's data = "specific personal data" with enhanced protections. Criminal penalties up to 6 years imprisonment.

Jurisdiction

Indonesia

Enacted

Oct 17, 2022

Effective

Oct 17, 2024

Enforcement

Ministry of Communication and Informatics (Kominfo)

BPK Indonesia

Why It Matters

Fourth largest country (~275M). Criminal penalties create personal liability. Health classification applies to mental health AI.

Recent Developments

Full enforcement October 2024. Main implementing Government Regulation (PP) still being finalized.

At a Glance

Who Must Comply

  • Data controllers/processors in Indonesia
  • Foreign entities processing Indonesian residents' data

Obligations fall on:

Safety Provisions

  • Article 4: Specific personal data includes health and children's data
  • Article 34: DPIA required before processing specific data
  • Article 35: DPO required for large-scale specific data processing
  • Article 57: Rights regarding automated decision-making
  • Article 65: Explicit consent for specific personal data
  • Cross-border transfer restrictions

Compliance & Enforcement

Penalties

IDR 6.0B + 2% revenue; criminal (up to 6yr)

Criminal liability

View on map

Indonesia

Focus Areas

Mental health & crisis
Child safety
Algorithmic accountability
Active safeguards required

Compliance Help

Requires explicit consent for health/mental health data; DPIA; DPO if large-scale; automated decision mechanisms; cross-border safeguards.

See how NOPE helps

Cite This

APA

Indonesia. (2022). Indonesia Personal Data Protection Law (UU PDP / Law 27/2022).

Related Regulations

In Effect ID

Indonesia PP 17/2025

Indonesia's comprehensive child online protection regulation establishing age-appropriate design requirements for electronic systems accessible to children. Most granular age classification globally (5 groups). Requires risk assessments, privacy-by-default, parental consent, DPIAs, and prohibits data profiling of children. First of its kind in Asia and Global South.

In Effect BN

Brunei PDPO

Brunei's personal data protection order requiring DPIA and imposing penalties up to 10% Brunei turnover or $1M.

In Effect IN

India DPDP Act

STRICTEST children's provisions in APAC. Children = under 18; verifiable parental consent MANDATORY; PROHIBITION on tracking, behavioral monitoring, targeted advertising to children.

In Effect CN

China CSL Amendments

First major revision of China's foundational Cybersecurity Law since 2017. Introduces formal AI governance provisions, significantly increases penalties, and expands extraterritorial application to all cybersecurity violations.

In Effect NP

Nepal AI Policy

Nepal national AI policy establishing governance framework and development priorities. Creates AI Governance Council (chaired by Minister for Communications and IT), AI Regulation Council, National AI Centre, and AI Regulatory Authority. Six pillars including ethics, human resource development, and sectoral application.

In Effect PK

Pakistan AI Policy

Pakistan's national AI roadmap establishing six strategic pillars: AI Innovation Ecosystem, Awareness and Readiness, Research and Development, Infrastructure, Governance, and International Cooperation. Creates National AI Fund (NAIF), Centres of Excellence in 7 cities, and targets training 200,000 individuals annually.

All regulations Check if this applies to you

Last updated February 17, 2026. Verify against primary sources before relying on this information.