By Setyawati Fitrianggraeni and Cassey Jovenia

Introduction

The enactment of Law Number 27 Year 2022 concerning Personal Data Protection (“PDP Law”) marks as Indonesia’s new era of personal data protection. In October 2024, the two-year transition period has ended. Now, all entities acting as a controller or processor must fully implement and carry out the law. However, the PDP Law itself is incomplete without its implementing regulation, and most importantly, the PDP Body as promised by Article 58 of the PDP Law that will carry out the enforcement and implementation of personal data protection in Indonesia.[1]

Functions and Authority of PDP Body

The PDP Body is to be established by and to be responsible to the President of Republic of Indonesia.[2] Meaning, the PDP Body is not under any ministry, but wholly independent directly under the President. The PDP Body in essence has four functions according to Article 59 of the PDP Law, as follows:[3]

1. Formulate and stipulate regulations and strategies on personal data protection as a guidance for personal data subjects, controllers, and processors;
2. Supervise personal data protection implementation;
3. Enforce administrative violations as regulated by PDP Law; and
4. Facilitate alternative dispute resolution.

As of now, the PDP Body is not established yet. The inexistence of a PDP Body hinders the full power which the PDP Law actually has, as the administrative violations set therein are not yet applicable to controllers and processors. Not only that, data subjects’ rights to protection under the law are not fully enforced.

In carrying out its functions, the PDP Body has several authorities as set forth in Article 60 of the PDP Law.

Absence of PDP Body

In the current state of no PDP Body, surely it impacts the implementation of personal data protection by businesses and institutions aside from the obvious of no supervision and enforcement of the PDP Law. Without the PDP Body, compliance with the current applicable law in Indonesia is tricky as there is no entity with authority to provide interpretation and further regulation. Moreover, the inexistence of PDP Body in Indonesia may be an obstacle for cross border data transfer as one of the determinants is adequacy of level of protection and when dispute arises, there will be no party to cooperate with other countries’ personal data protection authority. Data protection failure incident handling may also be affected as there is no authority that can receive the report and investigate it.[4] Therefore, the establishment of PDP Body is important as ever and needed as soon as possible.

Current Updates

The establishment of the PDP Body has not been broadly discussed by the general public. However, the most recent update known to the public is that the establishment process is currently already in the hands of Ministry of State Apparatus Utilization and Bureaucratic Reform. The Ministry is currently finalizing the draft presidential regulation concerning the PDP Body establishment.[5] It is still unknown when exactly the establishment process will be completed. The PDP Law is incomplete without the PDP Body that serves several functions and authorities, mainly supervision and enforcement. This independent body is highly needed in order to ensure compliance with the law and to enforce the law itself. Without the PDP Law fully enforceable and functioning, this may affect corporations in carrying out their business activities, not only locally within the country but also internationally.

Conclusion

In conclusion, despite the PDP Law taking full effect in October 2024, its enforcement remains limited due to the absence of the PDP Body, an independent authority tasked with supervision, enforcement, and dispute resolution. Without it, key provisions such as administrative sanctions and oversight cannot be implemented, leaving data subjects unprotected and businesses without clear guidance. This also hinders cross border data transfers and legal compliance. Although the draft presidential regulation is being finalized by the Ministry of State Apparatus Utilization and Bureaucratic Reform, the timeline for establishment remains unclear. Until the PDP Body is formed, the PDP Law remains incomplete and largely unenforceable.

 Bibliography

 Hukumonline Pro, ‘Terkait PP Turunan UU PDP, Kominfo Dan Kemenkumham Baru 1 Kali Kick Off’ (2024) <https://pro.hukumonline.com/legal-intelligence/a/terkait-pp-turunan-uu-pdp–kominfo-dan-kemenkumham-baru-1-kali-kick-off-lt67025f30cbe7e/?utm_source=newsletter_LIU_title_hl&utm_medium=email&utm_content=liu&utm_campaign=Terkait+PP+Turunan+UU+PDP%2C+Kominfo+dan+Kemenkumham+Baru+1+Kali+Kick+Off>

Saputra D and Marpaung ZA, ‘Analisis Yuridis Penanggulangan Penyalahgunaan Data Pribadi Dalam Bentuk Phising Yang Dilakukan Oleh Paid Verified Account Di Media Sosial Menurut Undang- Undang Perlindungan Data Pribadi’ (2023) 5 UNES Law Review 4764

Watkat FX, Ingratubun MT and Apriyanti A, ‘Perlindungan Data Pribadi Melalui Penerapan Sistem Hukum Pidana Di Indonesia’ (2024) 5 Jurnal Hukum Ius Publicum 153

 [1] Fransiscus Xaverius Watkat, Muhammad Toha Ingratubun and Adelia Apriyanti, ‘Perlindungan Data Pribadi Melalui Penerapan Sistem Hukum Pidana Di Indonesia’ (2024) 5 Jurnal Hukum Ius Publicum 153, 168.

[2] Article 58 of PDP Law.

[3] Dewana Saputra and Zaid Alfauza Marpaung, ‘Analisis Yuridis Penanggulangan Penyalahgunaan Data Pribadi Dalam Bentuk Phising Yang Dilakukan Oleh Paid Verified Account Di Media Sosial Menurut Undang- Undang Perlindungan Data Pribadi’ (2023) 5 UNES Law Review 4764, 4772.

[4] Article 60 of PDP Law.

[5] Hukumonline Pro, ‘Terkait PP Turunan UU PDP, Kominfo Dan Kemenkumham Baru 1 Kali Kick Off’ (2024) <https://pro.hukumonline.com/legal-intelligence/a/terkait-pp-turunan-uu-pdp–kominfo-dan-kemenkumham-baru-1-kali-kick-off-lt67025f30cbe7e/?utm_source=newsletter_LIU_title_hl&utm_medium=email&utm_content=liu&utm_campaign=Terkait+PP+Turunan+UU+PDP%2C+Kominfo+dan+Kemenkumham+Baru+1+Kali+Kick+Off>.

 DISCLAIMER: