If you are doing business in Indonesia or your website & mobile app is accessible to Indonesian users, you must comply with the new Indonesian Privacy Law, the Personal Data Protection (PDP) law when you collect and process Indonesians’ personal data.
Whether your business is located in Indonesia, your global website is accessible to users from Indonesia, or you run an e-commerce store, you will likely be subject to the new law. In this article, we cover the new requirements and how you can comply to avoid fines.
- New Indonesia privacy law in a nutshell
- Does the new law apply to your business?
- What are the main requirements and how to comply?
- Do you need consent for cookies?
- GDPR VS Indonesian privacy law
- How Didomi can help
New Indonesia privacy law in a nutshell
On 17.10.2022, The Indonesian President signed the Personal Data Protection Bill (PDP) into law. This made Indonesia the fifth South-Asian country that passed its own specific data privacy law, alongside Singapore, Malaysia, Thailand, and the Philippines.
Previously, Indonesia did have various laws and regulations that addressed aspects of personal data protection and that applied to specific sectors, collectively referred to as PDP Regulations. These PDP Regulations included Law No. 11 of 2008 on Electronic Information and Transactions and ‘Kominfo Regulation 20’.
However, this new PDP Law is the first comprehensive data protection law that addresses a wide variety of issues such as:
Data controller and data processor obligations
Data subject rights
Special categories of data and how they can be processed
Appointment of data protection officer
Monetary fines and imprisonment for violating the law
While the PDP Law aims to give individuals more control over their personal data, there was another factor behind the passing of the law: Increasing data security threats.
Considering the growing cyber threat landscape, it is not surprising that violation of the new law is subject to up to 5 years of imprisonment.
Does the new law apply to your business?
The new law may apply to your business activities in a variety of situations. For instance, when you collect, use, or process the personal data of Indonesian individuals via your website or send marketing emails or SMS texts, you may have to comply.
However, you must always assess if you fall under both the material and territorial scope of the new law.
Material scope of Indonesia's new Personal Data Protection (PDP) law
Indonesia PDP Law applies when an individual, business, entity, or international organization processes personal data or sensitive data.
Personal data is defined broadly and includes any information that can directly or indirectly identify an individual.
For instance, an IP address, name, and email address can be examples of personal data.
When you collect, analyze, use, store, sell or delete this personal data, the new law’s requirements will apply.
Territorial Scope of Indonesia's new Personal Data Protection (PDP) law
When one of the following conditions occurs, you will be subject to the PDP Law:
- Involve legal consequences within the territory of Indonesia;
Affect Indonesian citizens in and outside of the territory of Indonesia
Is there a transitionary period?
Organizations or persons subject to the Law must bring their data processing activities into compliance within two years after the Law becomes applicable.
What are the main requirements and how to comply?
If you are already familiar with the EU General Data protection (GDPR) Regulation’s requirements, dealing with the Indonesian Privacy Law will not be too difficult.
PDP Law was drafted based on the GDPR and it contains highly similar obligations and provides individuals with extensive data subject rights just like the GDPR.
Here are the key requirements and how you can comply:
You must identify a lawful basis to process personal data
When you collect, use, sell or delete personal data, you must identify and rely on one of the seven lawful bases to justify the data processing.
While consent of the data subject is one of the legal bases, there is no hierarchy between these legal bases. Therefore, it is your responsibility to ensure that you rely on the correct basis for each data processing activity.
These legal bases are as follows:
Consent of the individual
The legitimate interest of the data controller or data subject
Fulfillment of contractual obligation
Compliance with your legal obligations imposed by law
Protection of data subject’s vital interest
Exercise of authority given to the data controller by law
Fulfillment of a public service obligation to which the data controller is subject in the public interest
You must obtain consent as specified in the Law
Although there is no hierarchy between the legal bases and consent is not superior to other legal bases, it is likely that certain processing activities will require the consent of individuals.
Just like the EU GDPR, the PDP Law of Indonesia requires you to obtain consent from the data subject in a specific manner. In particular, consent must fulfill the following requirements:
When you ask for consent, you need to provide individuals with certain information such as the purpose of data collection and the legal basis you choose to rely on. Furthermore, you should provide this information in a clear and easily accessible format;
Consent must be explicit and informed. Furthermore, it should be for a specific purpose such as the use of an email address to send promotional emails or the collection of basic personal details for account creation;
You need to document and record that you obtained valid consent.
You must implement appropriate security measures
Article 35 of the PDP Law states that organizations must take a risk-based approach to data security and identify and implement appropriate organizational and technical security measures to ensure the protection of personal data.
Furthermore, article 39 requires organizations to protect personal data from unauthorized access.
However, the PDP Law does not list specific measures that organizations must implement.
You must satisfy data subject requests
Under the PDP Law, you must respond to and satisfy valid data subject requests when individuals exercise one of the following nine data subject rights:
A right to obtain information
The right to access and obtain a copy of the data subject’s personal data free of charge (Art 7);
A right to rectification of personal data
The right to end processing, delete or destroy their personal data
The right to delay or restrict processing (Art 11)
The right to withdraw consent
The right to object to decision-making measures(Art 10)
The right to data portability
The right to sue and receive compensation for violations.
You must process data in accordance with data protection principles
When you carry out personal data processing activities, you need to comply with data protection principles.
These principles include:
Personal data must be processed in a limited, specific, lawful, and transparent manner (Art 27);
You must only process personal data in accordance with the purpose you disclosed (Art 28);
You must ensure the accuracy, completeness, and consistency of the personal data you process as required by article 29;
You must ensure the security of personal data processing by implementing appropriate measures;
In accordance with the accountability principle, you need to record all processing activities and implement other measures.
Data breach notifications
When a data breach occurs, you need to inform both affected individuals and the data protection authority within three days and provide the following information:
Types of personal data affected,
How the breach took place,
What types of measures you have implemented to minimize the effects.
Do you need consent for cookies?
Since cookies contain personal data, you must ensure that you comply with all requirements when you place cookies that process personal data.
For example, you need to identify a lawful basis to use various cookie types such as “functional”, “analytics”, and “advertisement” cookies.
GDPR VS Indonesian Privacy Law
PDP Law is inspired by the EU GDPR and they are highly similar in terms of data subject rights, fundamental principles, security requirements, and legal bases.
However, there are differences between the GDPR and the Indonesia privacy law(PDP law) that you should be aware of:
Financial industry is largely exempt from the PDP Law’s requirements;
PDP Law introduces more detailed requirements for keeping records of processing activities compared to the GDPR;
PDP Law explicitly addresses the use of facial recognition technologies whereas GDPR does not refer to it
Under the PDP Law, financial data and data concerning children fall under the scope of “specific personal data”. GDPR, however, does not include these as sensitive data;
Under the GDPR, data controllers must respond to data subject requests within 1 month. PDP Law, however, states that controllers must handle access, rectification, and restriction requests within 72 hours.
How Didomi can help
If you want to satisfy all PDP Law requirements and safely handle Indonesian people’s data, you need to start by relying on a legal basis to justify your data processing activities. Consent is one of the most common legal bases you will rely on, and it can justify the use of third-party advertising and analytics cookies, ad personalization, and email marketing.
However, you must obtain consent as specified by the PDP Law and be able to prove that you obtained consent lawfully. With a Consent management platform to collect consent in a PDP-compliant manner and to keep a record of all consent obtained.
Customer privacy has to become a priority for brands, and for businesses operating in Indonesia, this means complying with the PDP Law.