Personal data protection is the area of law that regulates the processing of personal data: any information relating to an identified or identifiable natural person. It aims to protect privacy and individual autonomy while allowing the legitimate use of data.
Core Principles
Modern data protection laws share common principles: processing must be lawful, fair and transparent; data must be collected for specified purposes and not used incompatibly; only data that is necessary should be collected; data must be accurate, kept no longer than necessary, and kept secure; and controllers must be accountable for compliance.
In Indonesia
Law No. 27 of 2022 on Personal Data Protection (UU PDP) became fully effective in October 2024. It distinguishes general personal data from specific personal data, such as health, biometric, genetic, criminal record and financial data, and children's data. It requires a lawful basis for processing, such as explicit consent, performance of a contract, a legal obligation, vital interests, public duties or legitimate interests.
Rights of Data Subjects
Data subjects have rights to information, access, rectification, deletion, withdrawal of consent, objection to automated decision-making, data portability and compensation. Controllers must notify data subjects and the authority of a data breach within three days (72 hours) and must appoint a data protection officer in specified cases.
Sanctions
Violations may lead to administrative fines of up to two per cent of annual revenue, and to criminal penalties for unlawful collection, disclosure, use or falsification of personal data.
The European Model
The UU PDP draws heavily on the European Union's General Data Protection Regulation (GDPR) of 2016, which remains the most influential data protection law worldwide.