Data protection & privacy laws in Indonesia (2026)

The long-delayed implementing regulation (RPP PDP) and the Presidential Regulation establishing Indonesia's Personal Data Protection Agency entered the harmonization stage at the Ministry of Law in October 2025, with the agency targeted to become operational in 2026; until then the Ministry of Communication and Digital Affairs handles supervision.

The grace period under Law No. 27/2022 expired, so all data controllers and processors must now fully comply with the PDP Law and face administrative and criminal sanctions for breaches, even though the dedicated supervisory authority is not yet operational.

A LockBit 3.0-variant ransomware attack on Indonesia's temporary National Data Centre disrupted 282 public services including immigration, with attackers demanding US$8 million; the government refused to pay and the breach exposed that only ~2% of hosted data was backed up.

President Joko Widodo signed the second revision of the Electronic Information and Transactions Law, refining provisions on electronic systems, content, and criminal penalties that had drawn criticism for chilling online speech.

A threat actor exfiltrated and offered for sale a database of roughly 252 million voter records from the General Elections Commission (KPU) ahead of the February 2024 presidential election, after employee credentials were compromised by infostealer malware.

Indonesia's first comprehensive data-protection law came into force, establishing data-subject rights, controller/processor obligations, special-category data rules, cross-border transfer requirements, fines up to 2% of annual revenue, and a mandate to create a national supervisory authority.

Highly sensitive data (national ID/NIK, phone, email, address) tied to the state health-insurance agency BPJS Kesehatan was leaked and sold on Raid Forums; the National Police summoned BPJS executives, intensifying public pressure for a dedicated data-protection law.

GR 71/2019 (replacing GR 82/2012) modernized rules for electronic system operators, mandated PSE registration for both public and private operators, eased data-localization for private operators, and set personal-data-protection and security obligations.

The first dedicated personal-data-protection rule required written consent, encrypted storage, a minimum five-year retention, breach notification, and coordination with the ministry for cross-border transfers — the de facto framework until the PDP Law.

The first revision of the ITE Law added the concept of electronic system providers, a right to request deletion of irrelevant electronic information (right to be forgotten), content-blocking powers, and recalibrated criminal penalties.

Indonesia's foundational digital-law statute recognized electronic documents and signatures and contained the country's earliest, limited personal-data provision (consent to use electronic personal data), forming the legal base later built upon by GR 71/2019 and the PDP Law.