Global Business Guide Indonesia

Website Navigation
Indonesia
Sign up for the GBG Indonesia Quarterly Business Intelligence Report for the latest news on your sector.
Sign Up
Legal Updates | Data Protection Rules and Principles in Indonesia

There are several main obligations that must be fulfilled by an electronic system provider (ESP) in Indonesia under Minister of Communication and Informatics Regulation No. 20 of 2016 regarding Personal Data Protection in Electronic Systems (MOCI Regulation 20) to ensure that personal data is processed properly. These obligations include:

  1. Conducting certification of the electronic system managed by the ESP and ensuring the electronic system:
    • has interoperability and compatibility capabilities; and
    • uses legal software.
  2. Having internal regulations related to the protection of personal data.
  3. Obtaining sufficient consent from the data subject by providing a consent form.
  4. Ensuring that the personal data acquired and collected is restricted to only the relevant information and pursuant to its purpose. The data must also be acquired and collected accurately.
  5. Respecting the confidentiality of the personal data by providing options to the data subject regarding:
    • whether the personal data is confidential; and
    • the amendment, addition, or update of the personal data.
  6. Verifying the accuracy of the personal data.
  7. Only processing the personal data in accordance with the ESP's requirements, which have been clearly stated during the acquisition and collection of such personal data.
  8. Ensuring the personal data stored in the electronic system is in an encrypted form.
  9. Ensuring the storage of the personal data in the electronic system is done in accordance with the procedures and facilities of the electronic system security.
  10. Providing a contact person who can be easily contacted by the data subject relating to the management of their personal data.

Consent and Processing Personal Data

Personal data can only be processed if the proper prior consent of the data subject is obtained, as under personal data protection regulations. MOCI Regulation 20 specifically stipulates that the consent must be in writing and can be provided manually or electronically. The language of the consent should be Indonesian, although there is no prohibition on having it in a bilingual format. In any case, Indonesia’s personal data protection regulations do not state that the consent must be in the form of a separate stand-alone document.

If the data subject is a child, consent can be provided by a parent or guardian, in accordance with the applicable laws and regulations. The parent must be either the biological father or mother, while the guardian must be the person who has a lawful obligation to take care of the child.

If consent is not given, there are no other grounds to enable the processing of personal data.

SSEK - 4th January 2018

icone share

Indonesia Snapshot

Capital: Jakarta
Population: 259 million (2016)
Currency: Indonesian Rupiah
Nominal GDP: $936 billion USD (IMF, 2016)
GDP Per Capita: $3,620 USD at Current Prices (IMF, 2016)
GDP Growth: 5.0% (2016)
External Debt: 36.80% of GDP (BI, Q2 2016)
Ease of Doing Business: 91/190 (WB, 2017)
Corruption Index: 90/176 (TI, 2016)