Indonesia Personal Data Protection Law: Complete Business Guide
Sources, AI assistance & corrections
Enquiry forms, customer accounts, and order systems may process personal data. This guide helps website teams map technical work against Law No. 27 of 2022 without replacing legal assessment of a specific business case.
Reviewed and updated: October 13, 2026.
Inventory actual processing
Map collection points: forms, account databases, chat, Analytics, logs, backups, and third-party services. Record collected data, purpose, recipients, ownership, and retention. Avoid extra fields merely because a form can accommodate them. A clear inventory helps reduce unnecessary processing.
Define lawful basis and purpose
Article 20 requires a basis for processing personal data. Consent is not the only basis; application depends on the activity and relevant provisions. A privacy notice should describe real operations rather than copied generic text. Legal and operational owners should agree purposes and request-handling processes.
Limit access and retention
Separate administrator, support, and ordinary-user roles. Identify who can view or export records. Apply least privilege, security updates, and staff-access revocation. Retention covers active databases, spreadsheet exports, logs, and backups; removal from one screen does not necessarily remove every copy.
Test user requests and vendor arrangements
Provide processes for access, correction, or deletion as applicable. Verify requesters without excessive collection. Review vendor roles and processing terms. Storage locations, subprocessors, and cross-border transfers need assessment against actual operations. A consent checkbox alone does not establish compliance.
Prepare incident procedures
Article 46 provides for written notification within a maximum of 3 x 24 hours in the event of a personal data protection failure. Define escalation, fact recording, and notification ownership before an incident. Review the law and applicable rules for the specific requirements.
Correct the description of sanctions
Article 57(3) provides an administrative fine of up to two percent of annual revenue or annual receipts against violation variables. It does not set a universal Rp 70 billion ceiling. Criminal provisions are separate and depend on the conduct. This article does not determine sanctions for a specific case.
A technical review example
An enquiry form should collect only information needed to respond. Role-based systems such as EPN ATRACK in SWY's portfolio illustrate access-control design, not certified PDP compliance. Test unauthorized cross-account access, export logging, and exclusion of sensitive data from URLs and Analytics events. Document evidence and remediation.
Sources and practical references
The cover is an illustration. Implementation advice is SWY editorial analysis; examples do not establish a client location or guarantee an outcome.
