The Indonesian government ratified a draft of the new omnibus Personal Data Protection law (“PDP Law”) on 20th September 2022. This PDP Law is intended to unify the protection of personal data into a single comprehensive legal regime for Indonesia.
PDP Law also provides the additional rights for the data privacy subject from the previous regulations such as the Minister of Communication and Information Regulation No. 20 of 2016 on the Personal Data Protection on Electronic System (“Regulation No. 20/2016”) and the Law No. 11 of 2008 on the Electronic Information and Transaction (“EIT Law”).
This PDP Law will also establish a dedicated institution operating under the President of Indonesia. This institution will later formulate provisions relating to the implementation of personal data protection, supervise the implementation of personal data protection, enforce administrative law, and facilitate dispute resolution.
This PDP Law is due to come into force on a date set by the Ministry of State Secretariat or 30 days from 20thSeptember 2022. Parties who engage in the data processing activities are obliged to comply with the new law no later than 2 (two) years.
From the perspective of international investors going into Indonesia, this significant development could provide both positive and, to a lesser extent, negative impact on how they could proceed to invest into Indonesian companies.
It is important to have some form of legal regime to protect personal data. This has been demonstrated by many countries in Asia setting up personal data laws in their countries, establishing networks of co-operation, private enterprises setting standards of minimum conduct and other related action.
So, as a positive development. Indonesia has levelled up its laws to protect personal data with some degree of detail and structure. The familiarity of the proposed mechanisms with data protection laws of other countries would only serve to ease harmonisation of the implementation of the concepts for international transfers of data.
It also means investors of Indonesian companies must add compliance with the PDP Law as part of the due diligence process. Investors into Indonesian companies should also consider proper due diligence to ensure their Indonesian target companies have full compliance with such provisions and have in place proper remedial action for those unable to comply before completion.
In this respect, some provisions in the new PDP Law appear to stand out: –
Except for a few specific exceptions (including aspects of the financial sector) this PDP law shall apply to: –
Since the relevant parties have about two years to ensure compliance with the PDP Law, it would be prudent for parties to consider the following measures: –
It remains to be seen how much the PDP Law would be enforced in Indonesia, but this is a positive step to see how seriously they take personal data protection and a most welcome development to bring certainty to a hitherto uncertain environment of the handling of personal data in Indonesia.
Wun Rizwi
Partner
RHTLaw Asia
rizwi.wun@rhtlawasia.com
+65 6381 6818
Rizwi is a founding member of RHTLaw Asia, and is the Acting Head of the firm’s Intellectual Property and Technology Practice. He also heads the Firm’s Consumer Brands Industry Group, with specific focus on Food & Beverage, Fashion & Luxury, and the Video and Computer Games industries.
RHTLaw Asia is a member of ONERHT, an integrated network of multidisciplinary professional and specialist services which empowers stakeholders to achieve purposeful growth.
© 2023 RHTLaw Asia LLP. All Rights Reserved.
Cookie | Duration | Description |
---|---|---|
cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |