Expiry of Transitional Period of Personal Data Protection Law
On October 17, 2022, the Government enacted Law No. 27 of 2022 on Personal Data Protection (the “PDP Law”). Under the PDP Law, Controllers, Processors, and other parties relevant to the processing of personal data have 2 (two) years from the date of enactment of the PDP Law to comply with the PDP Law. So, on October 17, 2024, the foregoing transitional period officially expired.
Despite the above, there are several remaining questions that need to be addressed to ensure full compliance with the PDP Law, including the following.
♦ Implementing Regulation of PDP Law
As of October 17, 2024, the Government has not issued the implementing regulation(s) of the PDP Law. The absence of the implementing regulation(s) makes it difficult for the relevant parties to comply with the PDP Law. Without the implementing regulation(s), key aspects such as the scope of processing activities, data subjects’ rights, details on data protection officers, transfer of personal data, enforcement mechanisms, and sanctions procedures remain unclear.
The Government issued a draft implementing regulation of the PDP Law as of August 31, 2023. Based on the information obtained from the website of the Ministry of Communication and Informatics (https://pdp.id/rpp-ppdp/1), the draft is currently at the harmonization stage. The Government is yet to confirm when the implementing regulation of the PDP Law will be officially enacted.
♦ Supervisory Institution
The PDP Law mandates the establishment of a specific supervisory institution, determined by the President, which reports directly to the President. The Institution’s responsibilities are to: (i) formulate and determine personal data protection policies and strategies, serving as guidelines for the personal data subjects and relevant key-players within the data processing environment; (ii) supervise the implementation of personal data protection; (iii) enforce administrative sanctions against violations of the PDP Law; and (iv) facilitate alternative dispute resolutions.
The Institution is crucial for monitoring compliance, providing guidance to organizations, and handling complaints from data subjects. Without a functioning supervisory institution, there may be a lack of accountability and a framework for addressing violations, leaving individuals and organizations without the necessary support to navigate their rights and responsibilities under the PDP Law.
Based on several news publications, the Government is actively preparing for the establishment of the supervisory institution mandated by the PDP Law, though it has yet to confirm an official timeline for its launch.
Notwithstanding the missing links in the PDP Law, we strongly recommend that all relevant parties comply with the PDP Law. We will continue to monitor the situation closely and provide timely updates and guidance as new information becomes available.
AKSET
Please contact Johannes C. Sahetapy-Engel (jsahetapyengel@aksetlaw.com) or M. Fatih Satria Kasmaliputra (mkasmaliputra@aksetlaw.com) for further information.
Disclaimer:
The foregoing material is the property of AKSET and may not be used by any other party without prior written consent. The information herein is of general nature and should not be treated as legal advice, nor shall it be relied upon by any party for any circumstance. Specific legal advice should be sought by interested parties to address their particular circumstances.
Any links contained in this document are for informational purposes and are available and relevant at time this publication is made. We provide no liability whatsoever in respect of any information or content in such links.
