CevroIndonesia: Law 27/2022 on Personal Data Protection and what it requires
Law 27/2022 on Personal Data Protection: a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by Data protection authority still forming.
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Depends on thresholds or circumstances |
| Breach notification | Within 72 hours |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Administrative fines of up to 2% of annual revenue; criminal liability possible.
What to know in practice
Fully in force since the 2024 transition period ended; implementing regulation (GR 33/2026) phases in further from 2027.
How Cevro helps
- Maps Law 27/2022 on Personal Data Protection to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Indonesia?
Data protection authority still forming oversees Law 27/2022 on Personal Data Protection.
Is breach notification mandatory under Law 27/2022 on Personal Data Protection?
The law sets a 72-hour window for notifying the regulator of a personal data breach, so you need detection and an incident process that can meet it.
Does Indonesia restrict cross-border data transfers?
Yes. Moving personal data out of Indonesia is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Law 27/2022 on Personal Data Protection?
Only in some cases, usually depending on the scale or sensitivity of your processing. Confirm whether you cross the threshold.
What are the penalties for non-compliance in Indonesia?
Administrative fines of up to 2% of annual revenue; criminal liability possible.