Indonesia’s Personal Data Protection Regime

The principal law governing personal data protection in Indonesia is Law No. 27 of 2022, commonly referred to as the Personal Data Protection Law (PDPL). Before the PDPL was enacted, Indonesia had a piecemeal framework for data protection and privacy. There are several regulations that continue to regulate the personal data processed in the electronic systems by the Electronic Service Operators (ESOs). These are:

• Regulation No. 20 of 2016 concerning Protection of Personal Data in Electronic Systems (MoCI Reg); 
• Amended Law No. 11 of 2008 on Electronic Information and Transaction (EIT Law);
• Government Regulation No. 71 of 2019 on the Implementation of the Electronic System and Transaction (GR 71).

The MoCI Reg, EIT Law, and GR 71 primarily focus on electronic information where its provisions apply to local electronic service operators that deal with Indonesian citizens. These also apply extraterritorially in certain circumstances. 

Securiti enables enterprises and supports them in their journey towards compliance with Indonesia’s Personal Data Protection Regulations through automation, enhanced data visibility, and identity linking.

See how our comprehensive PrivacyOps platform helps you comply with various sections of the MoCI Reg, EIT Law, and GR 71.