Constitutional Court Clarifies Mandatory Personal Data Protection Officers Through Critical Wording Change
Constitutional Court Clarifies Mandatory Personal Data Protection Officers Through Critical Wording Change
On July 30, 2025, the Constitutional Court (the “Court“) rendered its decision towards Case No. 151/PUU-XXII/2024 (the “Decision”). The case was submitted and examined for the judicial review of Law No. 27 of 2022 dated October 17, 2022 on Personal Data Protection (the “PDP Law”).
The petitioners, Mr. Eric Cihanes and Mr. Garin Arian Reswara (collectively, the “Petitioners”), sought a judicial review of Article 53(1) point b of the PDP Law. The Petitioners contended that the wording in this provision causes uncertainty regarding the conditions under which personal data protection is implemented, thereby conflicting with the constitutional right to protection as stipulated by the 1945 Constitution of the Republic of Indonesia (the “Constitution”).
We set out below the key arguments of the Petitioners and the Decision of the Court.
♦ Petitioner’s Argument
The Petitioners submitted Article 53(1) point b of the PDP Law for a judicial review which reads as follows:
“Personal Data Controller and Personal Data Processor must appoint officials or officers who carry out the Personal Data Protection function in the event that:
a. The Personal Data are for the benefit of public services;
b. The core activities of the Personal Data Controller have the nature, scope, and/or purposes that require regular and systematic monitoring of Personal Data on a large scale; and
c. The core activities of the Personal Data Controller consist of the Personal Data processing on a large scale for specific Personal Data and/or Personal Data related to crimes.”
The Petitioners contended that the word “and” at the end of point (b) makes the conditions cumulative (as opposed to alternative). This implied that a Personal Data Controller would only be required to appoint a Personal Data Protection official or officer (a “PDP Officer”) if all three conditions were met simultaneously. For reference, under the PDP Law, a PDP Officer is responsible for ensuring that the Personal Data Controller complies with the PDP Law and acts as a liaison for issues related to the processing of Personal Data.
The Petitioners proposed that the word “and” be replaced with “and/or”. The Petitioners argued that by implementing this change, the conditions could be applied both cumulatively and alternatively. In other words, the requirement to appoint a PDP Officer would be imposed upon a Personal Data Controller even if just one of the above mentioned criteria in Article 53(1) is fulfilled, and not necessarily all three simultaneously.
♦ Court Decision
Considering the Petitioner’s argument, the Court acknowledges that using the word “and” makes the conditions cumulative, restricting the criteria for the obligation of Personal Data Controllers to appoint a PDP Officer. The Court also acknowledges that this infringes upon the constitutional right to personal protection as set out under Article 28G(1) of the Constitution.
The Court then grants the petition in full by ruling that the word “and” found in Article 53(1) point b of the PDP Law must be interpreted as “and/or.”
♦ Impact of Decision
Following the issuance of the Decision, Article 53 (1) point b of the PDP Law must now be interpreted as follows:
“Personal Data Controller and Personal Data Processor must appoint officials or officers who carry out the Personal Data Protection function in the event that:
a. The Personal Data are for the benefit of public services;
b. The core activities of the Personal Data Controller have the nature, scope, and/or purposes that require regular and systematic monitoring of Personal Data on a large scale; and/or
c. The core activities of the Personal Data Controller consist of the Personal Data processing on a large scale for specific Personal Data and/or Personal Data related to crimes.”
The Court’s Decision clarifies the conditions under which a Personal Data Controller is required to appoint a PDP Officer. This change strengthens the implementation of the PDP Law by ensuring that more entities are required to appoint a PDP Officer.
AKSET
Please contact Johannes C. Sahetapy-Engel (jsahetapyengel@aksetlaw.com), Mochamad Fatih Satria Kasmaliputra (mkasmaliputra@aksetlaw.com), or Giorgio Alexander William Robot (grobot@aksetlaw.com) for further information.
Disclaimer:
The foregoing material is the property of AKSET and may not be used by any other party without prior written consent. The information herein is of general nature and should not be treated as legal advice, nor shall it be relied upon by any party for any circumstance. Specific legal advice should be sought by interested parties to address their particular circumstances.
Any links contained in this document are for informational purposes and are available and relevant at time this publication is made. We provide no liability whatsoever in respect of any information or content in such links.
